MCP connections, authorization, and access scopes

Documentation / Agentic editing and connections

MCP provides tools to an assistant; authorization determines which requests Beeboo will accept. A visible write tool is not proof that the current connection can use it. Beeboo checks credentials, requested scopes, and access to the selected website.

Hosted OAuth connections

The hosted MCP resource is https://mcp.beeboo.app/mcp. Its public metadata advertises read and write scopes and the authorization server https://auth.beeboo.app. The authorization server publishes /oauth/authorize, /oauth/register, /oauth/token, and /oauth/revoke.

Sign-in uses an email code and a dedicated browser session. Consent grants a connection within the configured workspace, not a new account or access to every workspace. Each content operation still checks the current user's website permissions. Beeboo implements authorization-code exchange with PKCE S256, one-hour access tokens, and rotating 30-day refresh tokens. Clients should manage those tokens; users should not copy them into chat.

Choose the least access needed

Use read for inventories, content reviews, and revision inspection. Write operations require write and may have additional role or review requirements. A read/write connection does not remove super-admin restrictions on website creation or whole-site visibility.

The consent is account-based, not a guarantee of single-page confinement. Naming a page in a prompt narrows the request but is not a security scope. Verify the site, page ID, and language on every proposed mutation.

Disconnect safely

In Settings > Advanced > Agent Access Tokens > Connected apps, choose Disconnect for the relevant connection. Its codes, access tokens, and refresh-token generations are revoked; other connections and PATs remain unchanged. An already authorized request may finish. See saving and recovery if a completed change needs reversal.