MCP scopes

AgentStack advertises the scopes openid, profile, email, offline_access, mcp:read, mcp:write, mcp:send, mcp:admin, and mcp:billing through MCP authorization discovery. A client must hold a valid token with an MCP scope. When a client omits scopes, the authorization flow defaults to the identity scopes plus mcp:read and mcp:write only, but the flow still shows consent. Integrations must still request the smallest set of capabilities that they need.

mcp:read gates the read-only tools. mcp:write gates the remaining tools, including mutations and other operations that have lasting effects. Dashboard role and permission checks still apply after scope authorization. Deletion and some changes to geographic restrictions need an administrator or owner. Create and update operations need the matching permissions.

Three narrower scopes split specific consequential capabilities out of mcp:write so a connector cannot reach them by default. mcp:send gates tools that deliver a real, customer-facing message, such as replying to an inbox ticket — a connector authorized to manage tickets is not automatically authorized to speak to a customer as your organization. mcp:admin gates organization-administration tools: the member roster, pending invitations, and API key inventory and revocation. mcp:billing gates read access to subscription, usage, and credit-history data. None of these three scopes join the default grant. A client must request the exact scope it needs and pass consent for it, and a token issued before one of these scopes existed fails closed on the matching tool rather than gaining access silently.

Scope is not a substitute for a review step in your own client. Explain the requested access before authorization. Do not expand access after installation without notice to the user. After you change the configuration, reconnect the client. If an action fails after consent, make sure that the OAuth scope and the user's organization role both allow it. Do not assume that the token alone grants every capability.