Understand scopes and project access
Understand the permission checks that apply to a customer Cloud MCP read.
Cloud MCP checks the connection's consent, the organization's tool policy and your current project access together.
Checks for project and saved-file reads
Cloud read access
Required checks
- 1. Read scope and tool consent
- 2. OAuth organization and tool policy
- 3. Current project access
- 4. Ready workspace
Reads
- 5. Project read
- 6. Saved-file read
Connections
- 1. Read scope and tool consent → 5. Project read: Required
- 2. OAuth organization and tool policy → 5. Project read: Required
- 3. Current project access → 5. Project read: Required
- 5. Project read → 6. Saved-file read: Selected project ID
- 4. Ready workspace → 6. Saved-file read: Required
Scope and tool consent
A scope identifies the kind of access approved during consent. Cloud reads use https://mcp.altifigence.com/cloud.read. The grant also records the approved tool names.
Organization policy
The organization policy determines which tools the connection may use. The organization approved during OAuth consent is the organization used by the connection.
Project access
Project reads check your current access to the requested project. Choose a project from the accessible project list and use its project ID for workspace and saved-file reads. File reads also check that the workspace is ready.