MCP scopes

AgentStack advertises openid, profile, email, offline_access, mcp:read, and mcp:write through MCP authorization discovery. A client must hold a valid token with an MCP scope. When a client omits scopes, the authorization flow defaults to the identity scopes plus both MCP scopes, while still showing consent; integrations should nevertheless request the smallest capability set they need.

mcp:read gates the read-only tool set. mcp:write gates the remaining tools, including mutations and operations with consequential side effects. Dashboard role and permission checks still apply after scope authorization: deletion and some geographic restriction changes need an administrator or owner, while create and update operations require their corresponding permissions.

Scope is not a substitute for a review step in your own client. Explain requested access before authorization, avoid silently expanding it after installation, and reconnect after changing configuration. If an action fails after consent, inspect both the OAuth scope and the user's organization role instead of assuming the token alone grants every capability.