# Permissions

> The six OAuth scopes the Copyleaks MCP server can request, and what each one grants.

Six scopes exist. Most clients request what they need automatically; where a client lets you name them, ask for the narrowest set that covers your work. The sign-in page shows you what is being requested before you approve it.

| Scope | Grants | Effect |
|---|---|---|
| `scans:read` | Read scan results and reports | Read only |
| `scans:run` | Submit new scans | Consumes credits |
| `profiles:read` | Read scan profiles and settings | Read only |
| `profiles:write` | Create and modify scan profiles | Changes config |
| `account:read` | Read account details and credit balance | Read only |
| `offline_access` | Refresh the session without signing in again | Recommended |

<Tip>
  Without `offline_access` there is no refresh token, so the client asks you to sign in again every time the access token expires. Include it unless you have a reason not to.
</Tip>