Reviewing AI Agent Permission Changes Before Merge

AI coding agents are changing what belongs in code review. A pull request may no longer be only application code. It might also add an MCP server, modify AGENTS.md , change Cursor or Claude rules, expand GitHub Actions permissions, or add package lifecycle scripts. Those changes are worth reviewing because they can alter what tools an agent can run, which tokens it expects, or what CI automation can publish or deploy. I built ScopeDiff as a small local CLI to make those changes visible before me