--- title: Scopes description: OAuth scopes required by the AIC Remote MCP Server and how to request them from each environment tier. component: build-with-ai page_id: build-with-ai:aic-remote-mcp-server:scopes canonical_url: https://developer.pingidentity.com/build-with-ai/aic-remote-mcp-server/scopes.html llms_txt: https://developer.pingidentity.com/build-with-ai/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: 2026-08-20 keywords: ["MCP", "AI", "AIC", "OAuth", "scopes", "PingOne Advanced Identity Cloud", "Model Context Protocol"] section_ids: scope-reference: Scope reference requesting-scopes-by-environment-tier: Requesting scopes by environment tier sandbox-and-development: Sandbox and Development uat-staging-and-production: UAT, Staging, and Production --- # Scopes | | | | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | The AIC Remote MCP Server is currently available in **Rapid (Sandbox)** environments only. Support for Development, UAT, Staging, and Production environments is rolling out over the coming weeks. | The AIC Remote MCP Server uses OAuth 2.0 scopes to gate which tools an MCP client is permitted to invoke. Every Bearer token the server accepts must include the scopes required by the tools the client wants to call. Your MCP client requests scopes when it obtains an access token during sign-in. * **Automatic discovery.** Clients such as Claude Code, Cursor, VS Code with GitHub Copilot, and OpenAI Codex CLI discover the required scopes from the authorization server's metadata endpoint (or from [RFC 9728 Protected Resource Metadata](https://datatracker.ietf.org/doc/html/rfc9728)). You don't need to list scopes in these clients' configuration files. * **Explicit scope lists.** Some MCP clients require you to name the scopes you want in the client's configuration. For these clients, the server URL must also be configured as the OAuth `resource` parameter. If it's missing or doesn't match, sign-in fails. | | | | - | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | While some clients' perform automatic discovery and request all scopes available, narrower scope sets limit what the server is permitted to do on your behalf. | ## Scope reference Every request must include the mandatory `aic:mcp:access` scope in addition to the scopes required by the tools you want to call. The **Tier** column indicates where each scope is honored: * **All:** available in every environment tier. * **Lower:** Sandbox and Development only. `aic:mcp:reports.write` is the only write scope honored in upper tiers (UAT, Staging, and Production). All other write, delete, and restart scopes are Lower-only. | Scope | Tier | Purpose | | -------------------------- | ----- | ------------------------------------------------------------------------------------------------------------------------------------------ | | `aic:mcp:access` | All | **Required on every request.** Gates access to the MCP endpoint itself. | | `aic:mcp:identities.read` | All | Read managed objects (users, roles, groups, organizations, custom types) and their schemas. | | `aic:mcp:identities.write` | Lower | Create, update, and delete managed objects, managed object type definitions, and custom relationship properties. | | `aic:mcp:journeys.read` | All | Read authentication journeys, nodes, scripts, AM services, social identity providers, and read the password policy. | | `aic:mcp:journeys.write` | Lower | Create, update, and delete authentication journeys, nodes, scripts, AM services, and identity providers, and update the password policy. | | `aic:mcp:apps.read` | All | Read OIDC applications and cross-type application lookups. | | `aic:mcp:apps.write` | Lower | Create, update, and delete OIDC applications. | | `aic:mcp:themes.read` | All | Read theme schemas and configurations. | | `aic:mcp:themes.write` | Lower | Create, update, and delete themes, and set the default theme for a realm. | | `aic:mcp:idm.read` | All | Read features, CORS policies, email templates, and terms and conditions. | | `aic:mcp:idm.write` | Lower | Install features, and create, update, and delete CORS policies, email templates, outbound email provider config, and terms and conditions. | | `aic:mcp:esv.read` | All | Read environment secrets and variables (ESVs). | | `aic:mcp:esv.write` | Lower | Create, update, and delete environment secrets and variables. | | `aic:mcp:esv.restart` | Lower | Publish pending ESV changes (restarts PingOne Advanced Identity Cloud to apply variable updates). | | `aic:mcp:logs.read` | All | List log sources and query logs. | | `aic:mcp:agents.write` | Lower | Enable AI Agents on the tenant. | | `aic:mcp:reports.read` | All | List, run, and export reports. | | `aic:mcp:reports.write` | All | Author custom reports, duplicate existing reports, and import report templates. | For the exact list of tools each scope unlocks, refer to [Available tools](available-tools.html). ## Requesting scopes by environment tier Copy the appropriate scope list into your MCP client's configuration if it doesn't auto-discover. Some clients use a JSON or TOML array of scope strings; others use a single space-separated scope string. Adapt the list to your client's format. ### Sandbox and Development ```none aic:mcp:access aic:mcp:identities.read aic:mcp:identities.write aic:mcp:journeys.read aic:mcp:journeys.write aic:mcp:apps.read aic:mcp:apps.write aic:mcp:themes.read aic:mcp:themes.write aic:mcp:idm.read aic:mcp:idm.write aic:mcp:esv.read aic:mcp:esv.write aic:mcp:esv.restart aic:mcp:logs.read aic:mcp:agents.write aic:mcp:reports.read aic:mcp:reports.write ``` ### UAT, Staging, and Production ```none aic:mcp:access aic:mcp:identities.read aic:mcp:journeys.read aic:mcp:apps.read aic:mcp:themes.read aic:mcp:idm.read aic:mcp:esv.read aic:mcp:logs.read aic:mcp:reports.read aic:mcp:reports.write ```