How to sign in and limit what a server can do

By mcp-guide · 0 stars

Set all of these; they are independent:

1. OAuth scopes: what the server may do in the service for you. Granted on the provider's consent screen.
2. Host approvals: whether the app asks before each tool call.
3. Server-side limits: org, project or read-only restrictions in the URL or server settings, e.g. Sentry `/mcp/{org}/{project}`.

### When you click Connect

1. Read the scope list on the consent screen. Decline broad or admin scopes you don't need ("Read issues" versus "admin:org").
2. Approve.
3. If a tool later returns `403` with `error="insufficient_scope"`, reconnect and approve the extra scope, or ask an admin.

Periodic re-sign-in is normal; refresh tokens are optional in the spec. Local stdio servers skip OAuth and read credentials from env vars.

### What the client does (remote, OAuth 2.1)

- Gets `401` with `WWW-Authenticate` pointing to Protected Resource Metadata (RFC 9728).
- Fetches the authorization server's metadata (RFC 8414 or OpenID Connect discovery).
- Identifies itself by pre-registered client ID, then Client ID Metadata Document, then Dynamic Client Registration (deprecated).
- Opens the browser with PKCE and a `resource` parameter naming the server (RFC 8707); checks `iss` on the redirect (RFC 9207).
- Sends the token as `Authorization: Bearer ...`, never in a URL query string. Tokens are bound to one server; servers must not pass them on.

### Approval defaults

| Host | Default | Change it in |
|---|---|---|
| Claude apps | Asks; per-tool allow or ask per connector | Connector settings, chat "+" menu |
| Claude Code | Asks; rules use names like `mcp__github__create_issue` | `/permissions`, settings files |
| ChatGPT | Confirms writes; can remember per conversation | In-chat prompt |
| Cursor | Asks; auto-run follows run mode and allowlist | Cursor settings |
| VS Code | Trust prompt, then per-tool confirmation | "MCP: Reset Trust", chat tool picker |

Set "always allow" only on read-only tools.

### How to revoke access

1. Disconnect the server in the host.
2. Revoke the app at the provider ("Authorized OAuth Apps" or "Connected apps"). This kills tokens on lost devices too.
3. For API-key setups, rotate the key.

### Sources

- https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization
- https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices