MCP scopes reference
What each scope on an access token allows.
Scopes narrow what a token can do. They never grant more than the person who created the token already has.
Read scopes
| Scope | Allows |
|---|---|
mcp:read | Everything below. |
mcp:read:identity | Who the token acts as, and which organisation. |
mcp:read:reports | Reports, topics, disclosures, data point values, comments and history. |
mcp:read:esrs | The standard itself: topics, disclosure requirements and data point definitions. |
mcp:read:files | The organisation file library and data point attachments. |
mcp:read:gap | Gap analysis records. |
mcp:read:publications | Publications and their settings. |
Write scopes
| Scope | Allows |
|---|---|
mcp:write | Everything below. |
mcp:write:reports | Changing data point answers, and accepting or skipping items in a version-mapping review. Does not create, delete or publish reports. |
mcp:write:create_reports | Creating new reports and report copies. Not available on a token restricted to specific reports. |
mcp:write:comments | Posting comments. |
mcp:write:gap | Updating gap analysis records. |
Choosing scopes
Start from what the client is for.
| Purpose | Suggested scopes |
|---|---|
| Asking questions about your reporting | mcp:read |
| Looking up the standard while drafting elsewhere | mcp:read:esrs, mcp:read:identity |
| An agent that drafts answers into a specific report | mcp:read, mcp:write:reports, restricted to that report |
| Automating gap-analysis bookkeeping | mcp:read:reports, mcp:read:gap, mcp:write:gap |
