---
title: "Scopes"
description: "SHINE AI's MCP server uses OAuth scopes to restrict what each key can do. This page lists every scope and the tools it enables."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.shineai.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Scopes

Scopes are expressed as `resource:action`. A key granted `answers:read` can call `shine_ask` but not `shine_search`.

## Available scopes

| Scope | Enables | Default on OAuth? |
|---|---|---|
| `answers:read` | `shine_ask` | Yes |
| `search:read` | `shine_search`, `search`, `fetch` | Yes |

## Default consent

When a user signs in through an AI app, the default consented scopes are `answers:read` and `search:read`. These cover the full "ask questions, do retrieval" use case.

## Enforcement

Scope checks happen on every tool invocation. A key missing the required scope returns a JSON-RPC error:

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "error": {
    "code": -32601,
    "message": "forbidden: missing scope answers:read"
  }
}
```

The MCP server returns this immediately — no DB round-trip beyond the key lookup.

Source: https://docs.shineai.io/mcp/scopes/index.mdx