MCP Server
MCP Scopes and Approval Requests
How OAuth scopes limit connected agent tools, and how to review approval requests in the dashboard
MCP Scopes and Approval Requests
Doxa's remote MCP server lets an AI agent work on your projects. Two controls shape what an agent can do: the scopes you grant when you connect the agent, and approval requests for consequential actions. Scopes set the outer limit. Approval requests give you a record to review for specific high-impact actions.
How scopes limit an agent
When an MCP client starts OAuth sign-in, the consent page asks you to choose:
Scopes: the permissions the agent receives. The MCP server defines 8 OAuth scopes.
Projects: the projects the agent can access.
A scope limits which tools the agent can use. If a scope does not cover a tool's work, the agent cannot use that tool for your project. Grant only the scopes the agent needs for its task.
The server exposes 34 tools in eight groups:
| Tool group | Tools | What the agent can do |
|---|---|---|
| Account and projects | get_account, list_projects, get_project, list_github_repositories, create_project, delete_project | Read your account and projects, list repositories, create or delete a project |
| Docs pages | get_docs_structure, read_page, search_docs, write_page, edit_docs, upload_asset | Read, search, and change pages and assets |
| Branches | list_branches, create_branch, get_branch_status, get_branch_diff, sync_branch, build_preview, delete_branch | Work on named branches, review diffs, and build previews |
| Site settings | get_site_settings, update_site_settings | Read and change site configuration |
| Publish and history | publish_branch, list_publications, restore_publication | Publish a branch and restore a prior publication |
| Approval requests | get_approval_request, list_approval_requests, cancel_approval_request | Check and cancel approval requests |
| Domains | list_domains, add_domain, check_domain, remove_domain | Manage custom domains |
| Generation | start_generation, get_generation, cancel_generation | Start, follow, and cancel documentation generations |
Note:
Scopes are the first limit, not the only one. Revoke a connected agent's access when the agent no longer needs it.
Agents work on branches
Writes to main are rejected through MCP, so an agent cannot change your live docs directly. It works on a named branch. To put those changes live, publish the branch with publish_branch, or publish it from the dashboard. See Branches, Previews, Publishing, and Restore for the review and publish workflow, and the Branches tool reference for the branch tools.
Approval requests
Approval requests cover consequential agent actions. Each request is a record of an action that needs review. Agents can work with them through three tools:
list_approval_requestslists requests for your projects.get_approval_requestreturns one request.cancel_approval_requestcancels a request that is no longer needed.
For the request fields and tool parameters, see the Approval requests tool reference.
Review approval requests in the dashboard
Review requests in the dashboard before you let a consequential change go ahead. For each request, check:
The project it applies to.
The action the agent wants to take, and the branch or publication it affects.
Whether the change matches what you asked the agent to do.
If a request does not match your intent, cancel it. If you cannot confirm the change, leave the request open until you can review it. To stop an agent from making further requests, revoke its grant under Connected agents.
Manage grants
To change what a connected agent can do:
Open Connected agents in the dashboard.
Review the scopes and projects granted to each agent.
Revoke the grant for any agent you no longer use.
To connect a new agent or choose different scopes, follow Connect an AI Agent with MCP. Access tokens last 1 hour. Refresh tokens last 30 days, or 14 days without use. See the Exchange OAuth token reference for details.