MCP review fixes: account scope on usage API, MCP-only audience for pre-existing OAuth grants, unregistered identity survives delegation, token-derived lease holders, metering off the request path, and a fail-closed test hook.
11 files changed+37−15
Rendering diff…