MCP tools not respecting OAuth scopes (Gmail) — fix implemented, need help validating

[agrim19]

While exploring MCPs (starting with Gmail), I noticed that tools don’t respect granted OAuth scopes.

Issue

If a user grants only partial scopes (e.g. metadata but not read):

• UI still shows all tools as available
• Calling restricted tools results in a generic MCP error

This makes it unclear which permissions are actually missing from the user’s side, or even that missing scopes is the issue in teh first place.

Proposed / implemented fix

• Keep all tools visible
• Disable tools based on granted scopes (with clear UI indication)
• Enforce the same restriction at the MCP level

Current status

Implementation is mostly done - I’m trying to validate it end-to-end locally.

Blocker

I’m having trouble getting the backend + DB fully running from the OSS repo.

The self-hosting guide seems geared towards full deployment, and I’m likely missing the minimal setup needed for local development.

Ask

Is there a recommended lightweight way to run the backend (especially DB setup) for local dev?

Happy to share the fix once I validate it.

[herber]

Hey, thanks for your interest! The easiest way to run a working instance is with our dev tools scripts. Curious where/how you wanted to implement that.

[agrim19]

Hi @herber, thanks for replying. Sharing a quick overview of what I did:

1. metorial repo (MCP layer):

• Define requiredScopes per tool
• Persist granted scopes from token
• Mark tools enabled/disabled + missingScopes at registration

2. metorial-platform (API + UI):

• Propagate this to API
• Show disabled state + missing scopes in explorer

Here is a quick demo for the same :
https://drive.google.com/file/d/1algB8uyLdY8rKpBOZR-L5p1h7hQUgs9D/view?usp=sharing

This fixes unclear permission failures and makes the UX much clearer.

An Obvious Tradeoff Though:
This would require defining requiredScopes per MCP (we can surely fallback for ones that don’t support it yet).

I will share PRs for this as well

[agrim19]

Raised PRs:
#251
https://github.com/metorial/subspace/pull/145
metorial/metorial#105

These change how MCP tools handle OAuth scopes (propagates scopes, disables unusable tools, and improves error visibility).

Since this depends on real OAuth + MCP infra, I couldn’t fully validate it locally. It would be good to run this on staging before merge.

Suggested checks:
Tools without required scopes are disabled
Clear errors shown for missing scopes
Tools work correctly once proper scopes are granted

Happy to add logs or debug hooks if needed.