Scopes and permissions
MCP scopes, Doow roles, and resource access.
The MCP server uses two layers of access control: MCP scopes determine which tool categories are available, and Doow roles determine which resources you can access.
MCP scopes
| Scope | Tools | Description |
|---|---|---|
mcp:read | 44 | Read-only operations including list, get, metrics, and reports |
mcp:write | 85 | All read operations plus create, update, delete, and fund |
Request scopes during OAuth authorization with scope=mcp:read%20mcp:write.
If you only need to query data, request mcp:read alone. The server grants the intersection of requested scopes and your Doow permissions.
Read-only tools (44)
These tools are available with mcp:read:
| Domain | Tools |
|---|---|
| Apps | doow_apps_list, doow_apps_get, doow_apps_metrics, doow_apps_alternatives, doow_apps_compare |
| Contracts | doow_contracts_list, doow_contracts_get, doow_contracts_metrics, doow_contracts_details, doow_contracts_usage_metrics, doow_contracts_renewals_metrics, doow_contracts_renewal_summary, doow_contracts_report |
| Licenses | doow_licenses_list, doow_licenses_get, doow_licenses_report, doow_licenses_usage, doow_licenses_metrics, doow_licenses_unassigned_users, doow_licenses_unassigned_expenses |
| Cards | doow_cards_list, doow_cards_get, doow_cards_metrics, doow_cards_balance, doow_cards_app_metrics, doow_cards_report |
| Team | doow_team_list, doow_team_get |
| Integrations | doow_integrations_list, doow_integrations_get |
| Chat | doow_chat_sessions_list, doow_chat_sessions_get |
| Dashboard | doow_dashboard_overview, doow_dashboard_spend, doow_dashboard_renewals |
| Insights | doow_insights_list, doow_insights_needs_attention, doow_insights_stats |
| Expenses | doow_expenses_list, doow_expenses_get, doow_expenses_metrics, doow_expenses_report, doow_expenses_validate_csv |
| Search | doow_search |
Write tools (41 additional)
These tools require mcp:write:
| Domain | Tools |
|---|---|
| Apps | doow_apps_create, doow_apps_update, doow_apps_deactivate |
| Contracts | doow_contracts_create, doow_contracts_update, doow_contracts_delete, doow_contracts_credit_vintage, doow_contracts_spend_pool, doow_contracts_report_email |
| Licenses | doow_licenses_create, doow_licenses_update, doow_licenses_delete, doow_licenses_add_to_contract, doow_licenses_assign_user, doow_licenses_report_email |
| Cards | doow_cards_create, doow_cards_fund, doow_cards_org_fund, doow_cards_assign_owners, doow_cards_withdraw, doow_cards_freeze, doow_cards_unfreeze, doow_cards_update, doow_cards_delete |
| Team | doow_team_invite, doow_team_update, doow_team_update_roles, doow_team_remove_role, doow_team_deactivate, doow_team_reactivate, doow_team_delete, doow_team_cancel_invite |
| Integrations | doow_integrations_disconnect |
| Chat | doow_chat, doow_chat_action |
| Expenses | doow_expenses_create, doow_expenses_update, doow_expenses_categorize, doow_expenses_delete, doow_expenses_report_email, doow_expenses_import_csv |
Protected tools
These tools require confirmation before executing:
| Tool | Why protected |
|---|---|
doow_apps_deactivate | Changes app status |
doow_contracts_create | Creates a contract |
doow_contracts_delete | Removes contract record |
doow_contracts_credit_vintage | Creates a credit vintage |
doow_contracts_spend_pool | Creates a spend pool |
doow_contracts_report_email | Sends a contract report |
doow_licenses_create | Creates a license |
doow_licenses_delete | Removes license record |
doow_licenses_report_email | Sends a license report |
doow_cards_create | Issues a card |
doow_cards_fund | Moves money to card |
doow_cards_org_fund | Moves money to organization |
doow_cards_assign_owners | Changes card ownership |
doow_cards_withdraw | Moves money from card |
doow_cards_freeze | Blocks card transactions |
doow_cards_unfreeze | Enables card transactions |
doow_cards_delete | Permanently removes card |
doow_team_invite | Grants a team invitation |
doow_team_deactivate | Removes member access |
doow_team_reactivate | Restores member access |
doow_team_remove_role | Removes a member role |
doow_team_delete | Permanently removes member |
doow_team_cancel_invite | Cancels a team invitation |
doow_integrations_disconnect | Disconnects an integration |
doow_expenses_create | Creates an expense |
doow_expenses_delete | Removes expense record |
doow_expenses_report_email | Sends an expense report |
doow_expenses_import_csv | Imports expenses |
Doow roles
Your Doow role determines which resources you can access within your scope:
| Role | Access |
|---|---|
| Admin | All organization resources |
| App Admin | Assigned apps and their contracts, licenses, expenses |
| Department Admin | Assigned departments and their users, apps, expenses |
| Integration Admin | Assigned integrations only |
| Member | Basic organization data, assigned resources only |
MCP scopes determine which tools you can use, while your Doow role determines which resources those tools can access. An Admin with mcp:read can query all resources but cannot modify them. A Department Admin with mcp:write can only modify resources in their assigned departments. Credentials are bound to one member and organization, so resources outside that organization are not available.
Scope errors
If you call a tool without the required scope, the MCP tool result is marked as an error. Its text content contains the Doow error object:
{"isError": true,"content": [{ "type": "text", "text": "{"code":"SCOPE_INSUFFICIENT","message":"Missing required scope","details":{"required_scope":"mcp:write"},"_meta":{"required_scope":["mcp:write"],"current_scope":["mcp:read"],"action":"Re-authorize with scope=mcp:read%20mcp:write"}}"}]}Resource errors
If you access a resource your role does not permit, the server does not expose data from another organization:
{"error": { "code": "RESOURCE_NOT_FOUND", "message": "Resource does not exist"}}Scope downgrade
If your client registered with limited scopes, the server may grant narrower access than you requested:
{"access_token": "eyJ...","scope": "mcp:read","_meta": { "note": "Requested scope was mcp:read mcp:write but client is registered for mcp:read only"}}Request the needed scope during authorization. The server grants only the intersection of the requested scope and your Doow permissions.