Security and access
Scope
A specific permission requested during OAuth or set on an API key, such as 'read orders' or 'manage campaigns'. Narrow scopes limit the damage if something goes wrong.
A scope is one specific permission requested during an OAuth sign-in or attached to an API key: read orders, manage campaigns, write products. The set of scopes a connection holds decides exactly what an MCP server can do on your behalf, regardless of what its tool list says.
Scopes are where least privilege becomes concrete. Vendors name them differently (Shopify access scopes, Google OAuth scopes, Stripe restricted-key permissions, Klaviyo API key scopes) but the question is always the same: does this connection need to change anything? For reporting it does not, so read scopes are enough.
Review scopes at two moments. On the consent screen, because a server may request more than it needs. And in the vendor's account settings afterwards, where authorised applications and their scopes are listed and can be revoked. For local servers, the equivalent is the role of the API user or key you configured. If a vendor only offers one broad scope, note that in your list of connections and keep the host's approval step on for that server.