MCP Auth
In-depth analysis of OAuth 2.0 PKCE, scope boundaries, multi-tenant membership checks, and token lifecycle.
The MuseCanto MCP server strictly adheres to OAuth 2.0 specifications and the Principle of Least Privilege, safeguarding your content assets across all connected AI clients.
The Permission Evaluation Triad
Whenever an AI client triggers an MCP tool call, the server computes a real-time intersection across three distinct security layers:
[1. Client OAuth Scope] [2. Workspace Role] [3. Workspace Plan]
(mcp:read / mcp:write) × (Owner / Admin / Member) × (Free / Pro / Team)
│
▼
Comprehensive Decision: Allow / Deny (403)mcp:read (Read Scope)
Allows the client to list workspaces, browse knowledge libraries, search topics, and fetch paginated article text.
mcp:write (Write Scope)
Allows the client to create topics, insert documents, and draft/update X threads (subject to active plan quotas).
Evaluation Decision Matrix
| Scenario | Client Attempt | Server Decision |
|---|---|---|
Free Workspace + mcp:write | Create document or X draft | Allowed; library, storage, and rate limits still apply |
Any workspace + only mcp:read | Write document | Rejected (403), requests re-authorization with write scope |
| Modern Client Onboarding | Standard OAuth flow | Automatically requests both mcp:read and mcp:write |
| User Removed from Org | Call org-scoped tools | Instantly Blocked (403), even if the token remains unexpired |
| Subscription Downgrade | Call write tools | Writes remain; creating a new library may hit the Free library cap |
Token Lifecycle & Cryptographic Rotation
- Short-Lived Access Token: Valid for 15 minutes, held exclusively in client runtime memory to minimize exposure.
- Long-Lived Refresh Token: Valid for 30 days with strict Token Rotation on each exchange; spent refresh tokens are immediately invalidated.
- Cross-Workspace Coverage: Grants are bound to your user identity. When you join new workspaces, the active token dynamically resolves your new permissions without requiring a re-auth.
Never Commit Tokens
Do not paste MCP Access or Refresh tokens into public repository configuration files, system prompts, or support tickets.
Instant Revocation & Audit
If you change workstations or suspect credential compromise, terminate access immediately:
Open Settings
From the MuseCanto dashboard, click your avatar and select Settings → MCP Clients.
Identify Client Connection
Locate the connection card (e.g. Cursor Desktop - Mac or Claude Code CLI).
Revoke Access
Click Revoke. The server instantly blacklists the authorization record, immediately invalidating all active Access and Refresh tokens.