FoxCueMCP OAuth Permissions and Troubleshooting
Review hosted MCP permissions, revoke a FoxCue OAuth connection, reconnect expired grants, and resolve sign-in, scope, workspace and job errors.
Hosted MCP uses OAuth to connect an assistant to one owner workspace. You sign in to FoxCue and review the workspace, client return destination and requested permissions before approving. Your password and provider keys do not belong in a chat or connector configuration.
See Connect an AI assistant with MCP for the server URL and setup steps.
Permissions you approve
The hosted directory profile supports these 11 scopes. The client requests scopes during connection; you can reduce the approved set or deny the request. A tool still needs every scope its operation requires.
| Scope | Used for |
|---|---|
brands:read | Find and read the intended brand |
knowledge:read | Read saved sources, context and permitted passages |
knowledge:write | Save or import sources used for planning |
strategy:read | Read silos, ideas, plans and their evidence |
strategy:write | Queue ideas, accept a supported idea and prepare a script handoff |
scripts:read | Inspect existing scripts and their revisions |
scripts:write | Create or save script text |
generation:write | Queue text generation, which can incur provider charges |
jobs:read | Inspect supported script-generation jobs |
jobs:write | Cancel supported generation jobs |
performance:read | Validate retained Strategy evidence; this does not enable new checks, performance writes or provider connections |
Some tools choose their required read scope from the record or run kind. For example, inspecting a source needs knowledge:read, while inspecting a script needs scripts:read. The approved scope names do not add tools outside the directory profile.
Source privacy and provider use
The assistant can receive source material it is permitted to read. Imported pages are reference material, not instructions to reveal secrets, publish content or expand permissions. Internal source visibility and the writing workflow's privacy rules still apply.
Idea planning and text writing can send necessary source context and instructions to configured model providers and incur charges. Passage search in this profile is lexical and makes no embedding-provider calls. See FoxCue's privacy policy and terms for service data handling.
Revoke access
- In FoxCue, select the connected workspace and open Settings → Developers → MCP as its owner.
- Find the assistant under Authorized MCP Connections.
- Choose Revoke Access and confirm Revoke access.
The list shows saved OAuth grants, their scopes, expiry and authorization state. Approved means a grant exists; it does not mean the assistant is online or that a tool call succeeded.
Revoking blocks future access and pending work authorized by that grant. Completed results remain saved, and provider calls already sent may still incur charges. You can also remove the connector in your assistant, but revoke it in FoxCue to invalidate the server-side grant.
Ordinary browser sign-in or sign-out does not itself revoke a persistent MCP grant. Password changes, account removal, loss of the owner role, expiry and explicit revocation can invalidate access. Older connections created before persistent-grant support need to reconnect.
Local stdio integrations use separate API keys. Revoke those under Settings → Developers → API Keys; revoking an OAuth grant does not revoke an unrelated local key.
Troubleshooting
| What you see | What to do |
|---|---|
401 when opening /mcp without signing in | This is the expected OAuth challenge, not a standalone web page. Add the URL through your MCP client's OAuth setup |
401 from an existing connection | Let the client refresh its token. If access expired, changed or was revoked, reconnect and approve the intended workspace |
403 or a missing-scope error | Check the owner role and required scopes. Reconnect with the needed permissions; a new tool does not automatically expand an existing grant |
503 | The endpoint is disabled or temporarily unavailable. Contact support; changing your password or creating API keys will not enable it |
| The client asks for a static client ID, secret or API key | Select OAuth with automatic registration (DCR). FoxCue's hosted setup does not require you to supply those credentials |
| The wrong workspace or no matching record | Check the workspace used during FoxCue sign-in. Reconnect for the intended owner workspace; record IDs do not bypass workspace permissions |
| Ideas or writing are blocked | Confirm the brand, silo, readable public website source, provider availability and configured budget in FoxCue. Preserve returned run IDs |
| A generation request times out | Inspect the returned run. For a request with an idempotency key, retry only with the same key and inputs |
| A script edit returns a revision conflict | Read the latest script and reconcile the edits before saving with its current updated_at |
| A connector fails to load tools or appears to offer a broader profile | Confirm the URL is exactly https://app.foxcue.com/mcp, refresh the client's tool catalogue, and share the error with support |
If a client reports invalid_client, remove the stale client connection and start a fresh OAuth registration. Registered clients can expire independently of an access token; repeatedly refreshing the same unavailable client will not fix it.
Ask for help
Email support@foxcue.com with the client name, time of the failure, error text and any relevant run ID. Never include a password, API key, access token, refresh token, authorization code or client secret.