# Permissions

> The six OAuth scopes the Copyleaks MCP server can request, and what each one grants.

Most clients request what they need automatically; where a client lets you name them, ask for the narrowest set that covers your work. The sign-in page shows you what is being requested before you approve it.

| Scope | Grants | Effect |
|---|---|---|
| `scans:read` | Read scan results and reports | Read only |
| `scans:run` | Submit new scans | Consumes credits |
| `profiles:read` | Read scan profiles and settings | Read only |
| `profiles:write` | Create and modify scan profiles | Changes config |
| `account:read` | Read account details and credit balance | Read only |
| `offline_access` | Refresh the session without signing in again | Recommended |

Without `offline_access`, you'll sign in again each time the session expires.