Authentication & Scopes
How MCP tokens, access levels, and permissions work.
Tokens
Every request to the MCP server must include a bearer token:
1Authorization: Bearer jr_mcp_...
Tokens are minted in Settings > MCP Server by workspace owners and admins. They are:
- •Workspace-scoped — a token only ever sees and touches the workspace it was created in
- •Hashed at rest — JotReview stores only a hash; the raw token is shown once at creation
- •Revocable — revoke a token at any time and it stops working immediately
- •Auditable — every change an agent makes is recorded in your activity feed, tagged as coming from MCP
Access levels
When you create a token you pick one of two access levels:
| Access level | Role | What it can do |
|---|---|---|
| Read only | Viewer | List and read requests, roadmap, changelog, comments, tags, and boards. No changes. |
| Read & write | Admin | Everything above, plus create, update, moderate, and delete. |
Choose Read only for reporting or analysis agents, and Read & write for agents that manage your backlog.
Scopes & roles
Under the hood, each token carries a set of scopes and a role ceiling. Every tool declares the scope and minimum role it needs, and the server denies the call if the token falls short.
| Scope | Grants |
|---|---|
| requests:read | List and read requests and the roadmap |
| requests:write | Create requests and change status, tags, or board |
| requests:moderate | Approve or reject requests |
| changelog:read | Read changelog entries |
| changelog:write | Create, update, publish, and delete entries |
| comments:read | Read comments |
| comments:write | Add comments and replies |
| tags:write | Create, rename, and delete tags |
| boards:write | Create, rename, and delete boards |
| workspace:read | Read workspace info |
A read-only token receives all the read scopes; a read & write token receives them all.
Security best practices
- •One token per agent — separate tokens let you revoke a single client without disrupting others
- •Prefer least privilege — give reporting agents a read-only token
- •Rotate periodically — revoke and recreate long-lived tokens on a schedule
- •Watch the activity feed — agent-driven changes appear there, tagged as MCP and attributed to the token's creator