> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neuro-tech.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Scopes and permissions

> Choose OAuth scopes and identify the role privileges required by MCP tools, resources, and prompts

To use a hosted MCP server, you need an accepted account or client registration, authorized access, and the privileges for your intended actions.

## Scopes and role privileges

These names serve different purposes:

| Setting | Example | Purpose |
| - | - | - |
| OAuth scope | `MCP:Files:Tools` | Identifies a category of capabilities requested by the client. |
| Role privilege | `OAUTH.Scope.MCP.Files.Tools.Create` | Controls access to an operation, in this case creating files. |

Each individual server advertises scope categories ending in `:Tools`, `:Resources`, and `:Prompts`. The [server reference](/mcp/servers/overview) lists the exact names and operation privileges. An advertised category does not guarantee that a server provides custom resources or prompts.

The provider must authorize the requested categories and the operation privileges. Successful OAuth registration or sign-in alone does not grant these permissions. The server checks category access as well as operation access; ask the operator to verify both in the effective role.

Use the scope names advertised by your endpoint. Do not construct a scope by changing the punctuation in an operation privilege and assume the server accepts it.

## Request access for a task

1. Choose the individual server and the operations your application needs.
2. Request the corresponding advertised scope categories in the client's OAuth settings, when the client exposes this setting.
3. Give the operator the required operation privileges from that server's reference.
4. Connect and discover tools, resources, or prompts. Verify that the intended action is available to the session.

For example, to list and read stored files, use `/MCP/Files` and request `MCP:Files:Resources`. Ask the operator to verify resource-category access and these operation privileges:

```text theme={null}
OAUTH.Scope.MCP.Files.Resources.List
OAUTH.Scope.MCP.Files.Resources.Read
```

If you also need to create files, request the tools category and the creation privilege shown in the [File Storage reference](/mcp/servers/file-storage). Choose permissions for the actual task; a tools scope is not a read-only setting.

## Tools, resources, and prompts

* **Tools** perform actions. Several tools can share a privilege, including tools with different side effects. Check the complete group before requesting access.
* **Resources** expose data through returned URIs. Listing, reading, and subscribing can require different privileges.
* **Prompts** provide a guided interaction. Access to a prompt does not automatically authorize the tools needed to complete its steps.

Some operations require multiple privileges; their reference rows list all of them. A combined `/MCP` connection retains the requirements of its constituent servers.

## Account and identity requirements

Messaging, identity, and payment tools also need a connected Neuron account. Approval of a Legal Identity is a separate requirement for operations that use it. Neither sandbox account enablement nor automatic sandbox identity approval assigns an MCP role.

[Agent API credentials](/neuron-api/authentication) belong to that API's authentication flow. Use the hosted MCP server's supported OAuth or other provider-specified authentication method. The local [NeuroAli STDIO connection](/mcp/neuroali) uses a different access model.

## Diagnose missing access

| Symptom | Next step |
| - | - |
| Client registered but capabilities are denied | Ask the operator to confirm that a role was assigned to the registered account. |
| Sign-in succeeds but discovery or a call is denied | Check both category access and the operation privileges against the server reference. |
| An expected tool is missing | Confirm the endpoint and provider's deployed capabilities, then check permissions. |
| A tool requests account details, identity information, or approval | Complete the application prerequisite reported by the tool. OAuth access alone cannot satisfy it. |

See the [original Neuron MCP connection guide](https://lab.tagroot.io/Community/Post/Connecting_an_MCP_Client_to_MCP_Servers_on_a_Neuron) for registration and role requirements. Continue with [Connect to a Neuron](/mcp/quickstart).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.