Scope What a Token Can Do
Limit access to only the right tools and data.
Scope What a Token Can Do is a free MCP Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the MCP Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
A Token Is Not All-or-Nothing
A valid token should not unlock everything. Scopes let a token carry only the specific permissions its holder actually needs. 🎯
What a Scope Is
A scope is a named permission, like read or write. Tokens are issued with a set of scopes describing what they may do.
Least Privilege
Follow the principle of least privilege: grant the smallest set of scopes that gets the job done, and nothing extra.
Scopes Ride on the Token
When OAuth issues a token, the granted scopes are recorded with it. The server can read them to decide what to allow.
{
"access_token": "eyJ...",
"scope": "tools:read tools:run"
}Check Scope per Tool
Before running a sensitive tool, confirm the token includes the required scope. If it is missing, refuse the call.
if "tools:run" not in token_scopes:
raise HTTPException(status_code=403)Read vs Write
Separate a read scope from a write scope so a token meant only to look at data cannot quietly modify it.
Per-Tool Permissions
You can scope access tool by tool, exposing a safe calculator to everyone while gating a delete tool behind a stricter scope.
Limit the Data Too
Scopes can bound which resources a token sees, like one project folder, not every file the server can reach.
Missing Scope Is a 403
A request with a valid token but the wrong scope is authenticated yet not allowed, so the right answer is 403 Forbidden.
Audit What You Granted
Keep a record of which tokens hold which scopes. An audit trail makes it clear who could do what if something goes wrong.
Tighten Over Time
Review scopes regularly and revoke ones no longer needed. Narrowing permissions steadily shrinks your attack surface.
Quick Check
Pick the safest design choice.
Recap: Just Enough Access
Scopes turn one token into a precise key. Grant the least needed, check per tool, and answer 403 when a scope is missing. 🗝️
Frequently asked questions
Is the “Scope What a Token Can Do” lesson free?
Yes — the full text of “Scope What a Token Can Do” is free to read here on the web, and the MCP Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the MCP Academy course, upgrade to CoddyKit PRO.
What will I learn in “Scope What a Token Can Do”?
Limit access to only the right tools and data. You practise MCP Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start MCP Academy?
No prior experience is required. MCP Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Scope What a Token Can Do” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this MCP Academy lesson?
Yes. Every MCP Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Why Remote Servers Need Auth
- Bearer Tokens & Headers
- The OAuth Flow in MCP
- Scope What a Token Can Do