OAuth & scopes
17 scopes across three sensitivity tiers. Your first handshake usually misses canvas + skill.
17 scopes across three sensitivity tiers. Your first handshake usually misses canvas:* and skill:*. Reconnect to pick up the full set.
The 17 scopes
Sprout uses OAuth 2.0 for partner authentication. Each scope maps to a family of MCP tools. Request only what you need; the parent sees the full list at consent time.
| Scope | Tier | Tools unlocked |
|---|---|---|
family:read | Read | family_query_overview |
task:read | Read | task_list, task_review |
task:write | Write | task_create, task_update, task_complete, task_delete |
skill:read | Read | skill_list, skill_get |
skill:write | Write | skill_write, skill_activate, skill_update, skill_invoke |
canvas:read | Read | canvas_list, canvas_get |
canvas:write | Write | canvas_create, canvas_update |
reward:read | Read | reward_list |
reward:write | Write | reward_create, reward_update |
routine:read | Read | routine_list, routine_describe |
routine:write | Write | routine_create, routine_update |
screentime:read | Read | screentime_list_requests, screentime_query_state |
gems:read | Read | gems_query_balance, gems_list_transactions |
project:read | Read | project_list, project_get |
project:write | Write | (reserved, not yet active) |
gems:adjust | High | gems_adjust |
screentime:approve | High | screentime_review_request |
First connect
Most MCP hosts (Claude Desktop, Cursor, etc.) present the scope list on first connect. The parent approves. Common pitfall: the default scope set may not include canvas:* or skill:*. If your agent tries canvas_create and gets "tool not in catalog," disconnect and reconnect with the full scope set.
Shell
# Check which scopes your token has
mcp_whoami
# Look at the sprout_scopes array in the response
# Missing canvas:write or skill:write?
# /mcp -> sprout -> disconnect -> connect
# Approve the expanded scope setScope request flow
- Your agent connects to Sprout via MCP.
- The MCP host shows the requested scopes to the parent.
- Parent approves (or narrows the set).
- Your agent receives a token scoped to the approved set.
- Any tool call outside the granted scopes returns a clear error naming the missing scope.
Request all scopes you will need up front. Incremental scope expansion requires a full disconnect/reconnect cycle, which interrupts the parent's flow.
Further reading
Was this page helpful?
Hello, family