For Projects, Domains, DNS records, Databases, Storage, Teams, and Environments, you can select all resources or allow only specific items. Start with the smallest list that lets the client complete its job.For example, a deployment assistant may need Read access to repositories and logs, plus Update access to one project and its deployments. It does not need access to every database or domain in the workspace.
MCP does not return secrets, environment values, API keys, payment details, passwords, or authentication administration. Granting Update access to a scope does not bypass those protections.
Open a connection and select Permissions to see its current levels and resource allowlists. After changing scopes, reconnect the client so its available tool list reflects the new access.
