> ## Documentation Index
> Fetch the complete documentation index at: https://auth0-chore-myaccount-api-autoupdate.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> Learn which management scopes are required for each Auth0 MCP Server tool and how to configure them using glob patterns during initialization.

# Understanding Scopes

export const ReleaseStageNotice = ({feature, stage, plans, contact, terms}) => {
  const stageTextMap = {
    "beta": "Beta",
    "ea": "Early Access"
  };
  const stageText = stageTextMap[stage] || "a product release stage";
  const prsLink = "/docs/troubleshoot/product-lifecycle/product-release-stages";
  const linkify = (text, url) => {
    return <a href={url} target="_blank" rel="noreferrer" class="link">{text}</a>;
  };
  const includeDetails = (plans, contact, terms) => {
    const hasDetails = terms || plans || contact;
    if (!hasDetails) return null;
    return <span data-as="p">
            {plans && <>This feature is available for {linkify(`${plans} plans`, "https://auth0.com/pricing")}. </>}
            {contact && "To participate, contact " + contact + ". "}
            {terms && <>By using this feature, you agree to the applicable Free Trial terms in Okta's {linkify("Master Subscription Agreement", "https://www.okta.com/legal")}.</>}
        </span>;
  };
  return <Warning>
            <span data-as="p">
                <strong>The {feature} feature is in {linkify(stageText, prsLink)}.</strong>
            </span>

            {includeDetails(plans, contact, terms)}
        </Warning>;
};

<ReleaseStageNotice feature="Auth0 MCP Server" stage="beta" />

For security purposes, the Auth0 Model Context Protocol server grants no scopes by default and required scopes must be requested during initialization. After your server is initialized, you can manually set scopes using a glob pattern, an example of which is below:

```bash lines theme={null}
# Select all read scopes
npx @auth0/auth0-mcp-server init --scopes 'read:*'

# Select multiple scope patterns (comma-separated)
npx @auth0/auth0-mcp-server init --scopes 'read:*,create:clients,update:actions'
```

Depending on the type of management operation or tool you wish to use, you may need to request additional scopes to successfully execute the MCP operation on your client. Below are the available scopes.

<Accordion title="Management operation scopes">
  | Management Operation                                 | MCP Tool                         | Required Scope            | Potential Implications                                                                         |
  | ---------------------------------------------------- | -------------------------------- | ------------------------- | ---------------------------------------------------------------------------------------------- |
  | Get details about a specific Auth0 application       | `auth0_get_application`          | `read:clients`            | Allows viewing potentially sensitive application configuration details                         |
  | Create a new Auth0 application                       | `auth0_create_application`       | `create:clients`          | Enables creating new applications that could be used for authentication flows                  |
  | Update an existing Auth0 application                 | `auth0_update_application`       | `update:clients`          | Can modify critical application settings, potentially disrupting authentication for users      |
  | Create a client grant for an application             | `auth0_create_application_grant` | `create:client_grants`    | Authorizes an application to access an API, enabling machine-to-machine authentication flows   |
  | Save application credentials to a file               | `auth0_save_credentials_to_file` | `read:client_credentials` | Allows reading application client credentials to save them to a local environment file         |
  | List all resource servers (APIs) in the Auth0 tenant | `auth0_list_resource_servers`    | `read:resource_servers`   | Exposes all API configurations and their scopes                                                |
  | Get details about a specific Auth0 resource server   | `auth0_create_resource_server`   | `create:resource_servers` | Reveals API configuration details including signing algorithms and token settings              |
  | Create a new Auth0 resource server (API)             | `auth0_get_resource_server`      | `read:resource_servers`   | Allows defining new APIs and scopes that could be used for access control                      |
  | Update an existing Auth0 resource server (API)       | `auth0_update_resource_server`   | `update:resource_servers` | Can modify API configurations, potentially affecting applications that rely on those APIs      |
  | List all actions in the Auth0 tenant                 | `auth0_list_actions`             | `read:actions`            | Reveals all custom code that runs during authentication flows                                  |
  | Get details about a specific Auth0 action            | `auth0_get_action`               | `read:actions`            | Exposes custom code and logic for authentication flows                                         |
  | Create a new Auth0 action                            | `auth0_create_action`            | `create:actions`          | Allows creation of custom code that can modify authentication flows and user data              |
  | Update an existing Auth0 action                      | `auth0_update_action`            | `update:actions`          | Can modify custom code that affects authentication security and behavior                       |
  | Deploy an Auth0 action                               | `auth0_deploy_action`            | `update:actions`          | Pushes custom code into production, potentially affecting all users' authentication experience |
  | List logs from the Auth0 tenant                      | `auth0_list_logs`                | `read:logs`               | Exposes detailed information about user activity, failed logins, and security events           |
  | Get a specific log entry by ID                       | `auth0_get_log`                  | `read:logs`               | Provides detailed data about specific authentication events, potentially including PII         |
  | List all forms in the Auth0 tenant                   | `auth0_list_forms`               | `read:forms`              | Reveals custom form configurations for login, registration, and password reset                 |
  | Get details about a specific Auth0 form              | `auth0_get_form`                 | `read:forms`              | Exposes detailed form configuration including field validation and design                      |
  | Create a new Auth0 form                              | `auth0_create_form`              | `create:forms`            | Allows creation of custom authentication forms that collect user data                          |
  | Update an existing Auth0 form                        | `auth0_update_form`              | `update:forms`            | Can modify user-facing forms, potentially affecting authentication experience                  |
</Accordion>