> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neuro-tech.io/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP permissions

> Reference for OAuth scopes, Neuron privileges, and roles

Use the [quickstart](/mcp/quickstart) first. This page explains the permission model when you need to configure or debug access.

## The three parts

| Part            | Purpose                                             |
| --------------- | --------------------------------------------------- |
| OAuth client    | Identifies the application connecting to the Neuron |
| User or account | Signs in and authorizes the client                  |
| Neuron role     | Grants the operations that account may authorize    |

Creating a client does not grant it access. The authorizing account must have a role containing the requested privileges.

## Scope-to-privilege mapping

Neuron prefixes an OAuth scope with `OAUTH.Scope.` and replaces colons with periods:

```text theme={null}
MCP:Files:Resources:Read
→ OAUTH.Scope.MCP.Files.Resources.Read
```

Built-in scope roots are:

```text theme={null}
MCP:Files
MCP:EventLog
MCP:InternetContent
MCP:XMPP
```

Prefer specific leaf scopes. Granting `OAUTH.Scope.MCP.Files` can authorize the current and future operations below that root; it is not equivalent to read-only access.

## OAuth discovery

Clients discover the OAuth configuration from the Neuron:

```text theme={null}
https://<NEURON_HOST>/.well-known/oauth-authorization-server
https://<NEURON_HOST>/.well-known/oauth-protected-resource
```

Use the endpoints and methods advertised by those documents. Current Neuron deployments can differ in enabled registration and authentication methods.

## Credential handling

* Let the MCP client complete OAuth and store its credentials.
* Never put access tokens in URLs, prompts, documentation, or source control.
* Give each automated client its own identity and role.
* Separate read, write, and destructive permissions.
* Disable the client or account when access should end.

Bearer-token configuration is useful for diagnostics or non-interactive deployments, but it should not replace an available OAuth login flow.