> ## Documentation Index
> Fetch the complete documentation index at: https://atlas.rebuildingus.org/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Scopes & permissions

> OAuth scopes and Atlas package capabilities for MCP access.

## Overview

Atlas MCP access depends on two things:

1. The permissions you approve during sign-in
2. The Atlas package attached to your workspace

This keeps public browsing open while making agent and integration access explicit.

## MCP requirements

Atlas requires both of these for MCP requests:

| Requirement      | Where it appears        | Why it matters                                   |
| ---------------- | ----------------------- | ------------------------------------------------ |
| `discovery:read` | Consent screen          | Allows read-only discovery and catalog retrieval |
| `api.mcp`        | Atlas workspace package | Confirms the workspace includes MCP access       |

If either check is missing, your client shows a permission or plan-required error. Reconnect the client after approving the missing access or upgrading the workspace.

Starting a new research run additionally requires `discovery:write`. Read-only Atlas requests need `discovery:read` + `api.mcp`.

## OAuth scopes

| Scope             | What it allows                                     |
| ----------------- | -------------------------------------------------- |
| `openid`          | Basic identity verification                        |
| `profile`         | User profile details                               |
| `email`           | User email address                                 |
| `offline_access`  | Refresh-token access from the authorization server |
| `discovery:read`  | Read source-linked discovery and catalog results   |
| `discovery:write` | Create and manage discovery runs where enabled     |
| `entities:write`  | Create or update catalog entries where enabled     |

Most read-only Atlas requests use `discovery:read`. Write permissions are not enough to access MCP unless the workspace package also includes MCP access.

## Workspace binding

Atlas connects each assistant authorization to a workspace. Single-workspace users are selected automatically. Multi-workspace users pick the workspace during consent.

## Package capabilities

Package capabilities are derived by Atlas, not requested directly by the client. For MCP, the important capability is:

| Capability | Meaning                                   |
| ---------- | ----------------------------------------- |
| `api.mcp`  | The workspace package includes MCP access |

See [Plans & pricing](/docs/account/pricing) for which packages include MCP access.

## Workspace integration activity

Successful MCP requests and successful external REST API calls can appear in workspace integration activity. The activity view shows counts, surfaces, paths or resources, and last-seen timestamps only.

See [Workspace integration activity](/docs/workspace/integration-activity) for the data boundary.

## Revoking access

To disconnect an MCP client and revoke its access:

1. Sign in to [Atlas](https://atlas.rebuildingus.org)
2. Go to **Account** settings
3. Under **Connected apps**, find the client
4. Revoke the client

After revocation, the client must authorize again before it can use Atlas.