Scopes and consent

Ask for the smallest set of scopes needed for the current workflow. A scope grants capability only to the approved MCP connection and never replaces resource-level authorization.

Task and organization scopes

tasks:read, tasks:write, tasks:delete
categories:read, categories:write
tags:read, tags:write
places:read, places:write
calendar:read

The categories:* identifiers are stable wire names for public List capabilities. There is no calendar:write scope.

Context and collaboration scopes

prayer:read
settings:read, settings:write
comments:read, comments:write
collaborators:read, collaborators:write
attachments:read, attachments:write

Connection scopes

connections:read, connections:write
activity:read

connections:write supports self-revocation by default. A connection receives no scope that was not included in its own completed consent flow. Adding a scope to the product later does not add it to an existing connection.

Integration scopes

events:read
webhooks:read, webhooks:write

These scopes authorize the MCP-only integration event and outbound webhook control plane. They do not imply an equivalent in-app management surface, and an existing connection must complete a fresh authorization to receive them.