An assistant that can only reach what you can
Each connection signs in with OAuth as you. It reaches only the businesses you manage and only what your permissions allow, and it can ask why something was refused.
ChatGPT · signed in as outlet manager
list_accessible_profiles · 1 business
explain_denial · reports
In short
Each MCP connection uses an OAuth token with the mcp:use scope, approved by signing in. The assistant can only reach profiles the user already manages and only what that user's permissions allow; list_accessible_profiles shows which, and explain_denial says why a call was refused.
The problem it solves
A shared API key gives an assistant the owner's whole account, whoever set it up. When a cashier connects their assistant, it should see what a cashier sees.
How it works
4 steps, start to finish
-
1
Approve as yourself
The OAuth consent says it can only reach profiles you already manage, and only what your permissions allow.
-
2
It lists your businesses
list_accessible_profiles returns the profiles you can manage.
-
3
Every call is checked
Each tool checks the business it names against your access.
-
4
Refusals are explained
explain_denial names the missing dependency and whether it shows as a 403 or a 404.
In detail
What scoped access does for you
-
OAuth per connection
A token with the mcp:use scope, approved by you, with PKCE.
-
Your businesses only
Not found and not yours get the same answer.
-
Your permissions
The assistant is limited by the same roles you are.
-
Tools by entitlement
Only the tools your plan and permissions allow are advertised.
-
Why was I refused?
explain_denial answers in plain terms.
-
Only businesses you already manage. For anything else it gets the same answer as for something that does not exist.
-
No. The token acts as the person who approved it, with their roles and permissions.
-
Ask the assistant to call explain_denial; it reports the scope, the missing dependencies and how the denial is presented.
Scoped access · Free to start
Try scoped access on your own business
Set up in a couple of minutes. Your catalogue, orders and books stay yours to export.
- Live in 2 minutes
- Free to start
- No credit card
