Scopes

When you add Engram as an MCP Connector, the client receives an OAuth access token. The token carries a scope that determines what the client may do against your vault.

What the token currently grants

Engram’s MCP endpoint today ships a single monolithic scope: mcp.

A token with the mcp scope grants the client the full MCP tool surface: read notes, search semantically, write notes, edit folders, attach files. It is not split into per-action permissions, but it is limited to the vaults you choose on the consent screen when you connect. You can pick specific vaults, or all vaults (which includes vaults you create later).

Granular scopes are planned

Splitting mcp into per-action scopes (notes:read, notes:search, notes:write, notes:delete, folders:write, metadata:read) is on the roadmap. Once shipped, the Connector flow will let you grant the minimum permissions an agent needs (“read + search but never write”) rather than the all-or-nothing grant today.

If granular permissions matter to you right now, the workaround is don’t connect agents you don’t trust to write your vault. There is currently no in-protocol way to restrict the grant once issued.

Auditing and revoking access

Settings → Connections in the Engram app lists every active OAuth connection and API key. Click Revoke to cut one off:

• A revoked API key stops working immediately.
• A revoked OAuth connection can no longer renew its access, and its current access token expires within 15 minutes.

Scope grammar (for SDK builders)

The endpoint advertises its supported scopes via /.well-known/oauth-authorization-server. SDK builders should read that metadata rather than hardcoding scope strings, because the granular split will surface there first.