Scopes

SHINE AI's MCP server uses OAuth scopes to restrict what each key can do. This page lists every scope and the tools it enables.

Scopes are expressed as resource:action. A key granted answers:read can call shine_ask but not shine_search.

Available scopes

Scope	Enables	Default on OAuth?
`answers:read`	`shine_ask`	Yes
`search:read`	`shine_search`, `search`, `fetch`	Yes

When a user signs in through an AI app, the default consented scopes are answers:read and search:read. These cover the full “ask questions, do retrieval” use case.

Enforcement

Scope checks happen on every tool invocation. A key missing the required scope returns a JSON-RPC error:

{
  "jsonrpc": "2.0",
  "id": 1,
  "error": {
    "code": -32601,
    "message": "forbidden: missing scope answers:read"
  }
}

The MCP server returns this immediately — no DB round-trip beyond the key lookup.