Scopes and permissions

What a connected agent is allowed to do.

OAuth scopes

The consent screen offers two levels. Full access grants the mcp scope; read-only grants mcp:read, which permits only tools marked read-only. The choice belongs to the operator, not to the client.

Confirmation-gated tools

Some tools change the world in ways that are awkward to undo — sending a guest message, closing a folio, revoking access, unlocking a door. Those require an explicit confirmation flag on the call. Omit it and the call is refused rather than performed.

Read-only by design

In the sensitive areas the split is deliberate: an agent may look, but not change. api_keys.list returns names, prefixes and usage timestamps — never a secret — and there is no tool to create or revoke a key, because a key that could mint or kill its siblings is a privilege-escalation path. webhooks.list returns URLs and delivery timestamps but never the signing secret, and there is no tool to add or repoint a subscription. billing.summary reads the subscription state; Checkout and the billing portal stay in the web UI. OAuth grant administration is not exposed at all.