MCP
OAuth scopes
MCP OAuth scopes from MCP_OAUTH_SCOPES and requiredOAuthScopesForAction.
MCP clients obtain tokens from apps/auth (Better Auth OAuth 2.1 + MCP plugin). Scopes are coarse-grained; each tool still checks the canonical action at runtime.
Advertised scopes
From MCP_OAUTH_SCOPES in @loftlancer/actions:
| Scope | Purpose |
|---|---|
openid, profile, offline_access | Standard OAuth |
mcp:tools | Required base scope for any MCP tool |
organizations:read / organizations:write | Org, member, team, invitation tools |
projects:read / projects:write | Projects and environments |
variables:read / variables:write | Variable metadata and mutations |
variables:reveal | Decrypted secret values |
variables:export | Bulk export |
audit:read | Timeline tools |
notifications:read / notifications:write | Notification tools |
requiredOAuthScopesForAction(action) maps each canonical action to mcp:tools plus one resource scope. Platform actions use platform:admin and are not exposed via MCP product tools.
Public documentation
Documenting scope names does not grant access — callers still need a valid token and passing RBAC checks.