MCP permissions
Found this helpful? Share it:
Found this helpful? Share it:
An API key carries scopes that decide which resources a client can reach. Access fails closed, so grant only the scopes a workflow needs 🔒
A scope is a resource name with a read or write level, written drive:read or drive:read,write. The server
denies any action a key is not scoped for, and it denies any action
with no scope mapping at all. Every key must include user:read.
Scope | Read grants | Write grants |
|---|---|---|
| Your profile (required on every key) | Update account preferences |
| List and read workspaces | Update workspace settings |
| Read, search, and list files | Create, edit, move, and delete files |
| Read chats and messages | Create chats and send messages |
| List and read agents | Create and update agents |
| List computers and their status | Run commands, transfer files, manage tunnels and users |
| Read and search Knowledge notes | Create, edit, move, and delete Knowledge notes |
| List automations and their runs | Create, fire, and rotate automations |
| List workspace credentials (metadata only) | Create, rotate, and delete credentials |
| Read your notifications | Send notifications to members |
| List models | Run model inference (text, image, speech) |
Further scopes cover realtime, members, billing, and the repos, surfaces. A key can only exercise a scope its owner could exercise in the app.
Some starting points:
Read files and docs: drive:read, workspace:read, user:read.
Full coding workflow: drive:read,write, chat:read,write, agents:read, workspace:read, user:read.
Computer operations: computers:read,write, drive:read, workspace:read, user:read.
Mint a separate key per client so you can rotate or revoke one without touching the others. See API keys and scopes.
Related articles
Connect your tool
Create a scoped API key and point any MCP client at idapt's endpoint, then check that it worked.
What an MCP client can do
The one idapt tool, how to call it, how to discover every action from inside your client, and what is off limits.
idapt MCP Server
Connect Claude Code, Cursor, Codex, and any other MCP client to your idapt workspace.
Was this helpful?