Tokens, scopes, and security
How sign-in (OAuth) connections and pat-isms tokens work: what each can do, scopes, disconnect, expiry, and hard limits.
英文内容
An MCP client acts as your user in one of two ways: you sign in and approve it (OAuth, the default), or you give it a personal access token limited by the scopes you selected.
Sign-in (OAuth)
When you add https://account.ismscopilot.com/v1/account/mcp to a client with no header, the client asks you to sign in to ISMS Copilot. The consent page shows the address the results go to and the name the app gave itself. Approve only if you started the connection from your own AI tool.
One Approve grants one fixed set:
| Can | Scopes |
|---|---|
| Read your account, workspaces, documents (metadata), memories and companies | account:read, workspaces:read, documents:read, memories:read, company_context:read |
| Ask ISMS Copilot questions and read replies | conversations:create |
| Create, update and link companies to workspaces, edit memories, and create workspaces | company_context:write, memories:write, workspaces:write |
A sign-in connection can never create, list or revoke API keys, and can never check or buy API credits. Those stay token-only. Its replies never carry upgrade or purchase fields such as upgrade_url or extra_usage_buyable.
Changes a signed-in app makes are labeled in ISMS Copilot with the name the app registered: Added by OAuth app: <name> on memories, Updated by OAuth app: <name> on a company and workspaces. The name is chosen by the app itself, so treat it as a hint, not proof. A later change from the web app or a token replaces the label.
Disconnect: Settings → Connected apps, under Connected agents. The next call from that app is refused, and its refresh token stops working. To reconnect, sign in and approve again.
Personal access tokens (fallback)
Use a token for a client that cannot sign in, for CI and headless machines, or when you want a narrower set of scopes than the sign-in grants.
Prefix and lifecycle
| Step | Behaviour |
|---|---|
| Create | Settings → Connected apps → Create token |
| Display | Full secret shown once; starts with pat-isms- |
| Store | Client config only; never commit to git |
| Revoke | Same Settings page; takes effect immediately |
| Expiry | Optional at creation |
Scopes (typical)
Exact labels in the UI may vary slightly; the intent is:
Account
| Capability | Read | Write / act |
|---|---|---|
| Account info | yes | no |
| Workspaces | list (workspaces:read) | create personal workspaces with create_workspace (workspaces:write) |
| Documents | list metadata only (no get-by-ID tool) | no |
| Memories | yes | create / edit when granted |
| Companies | list_companies, get_company, get_company_context (company_context:read) | create_company, update_company, delete_company, link_company_to_workspace, unlink_workspace_company, set_company_context (company_context:write), up to your plan's company limit |
| Conversations | n/a | start and send when granted |
Model API (Connected apps group)
| Scope | Purpose |
|---|---|
api_keys:read | List sk-isms key metadata (no secrets) |
api_keys:write | Create / revoke sk-isms keys via MCP |
api_credits:read | Read prepaid API credit balance |
api_credits:checkout | Create a Stripe Checkout URL for top-up (a human pays in the browser) |
These scopes do not let a pat-isms call inference. The agent still uses a separate sk-isms key for api.ismscopilot.com. See Set up from Claude Code or Grok.
Grant the minimum set for the agent’s job. A read-only workspace token cannot start conversations.
Hard limits (by design)
- Workspace creation is personal-only and budgeted. An agent-created workspace is not shared with your team, does not inherit your organization's Advanced Data Protection, and is capped at 10 new workspaces per 24 hours (every creation counts, including web-app ones and the starter workspace of a fresh account). Set persona, instructions, and team sharing in the web app.
- Companies are named and plan-limited. A company links to zero or more workspaces; updating a company (
update_company, orset_company_contextwith aworkspace_id) replaces the fields you pass (name, sector, scale, HQ country, privacy role, data types, hosting region, tech stack, notes) and updates every workspace linked to it at once.link_company_to_workspaceandunlink_workspace_companymove a workspace's link without touching the company's fields.set_company_contextwith noworkspace_idreplaces your account-level default instead. The number of companies you can create is capped by your plan. - Beyond is available when the agent passes
mode: "beyond"(Fast is the default). Paid plans, 10 runs per UTC day (50 on Unlimited). See Using Beyond mode. - Advanced Data Protection cannot be toggled via the token. The agent can report status; you change it in Settings → Data Protection.
- Rate limits apply (on the order of ~120 requests/minute per token; concurrent conversations are capped per account). If you hit limits, back off and retry.
pat-ismsalone does not run model-API completions. Model API tools mintsk-ismsand open credit checkout; Embed partner billing stays separate.
Security checklist
- Name tokens by device or purpose (
claude-laptop,cursor-ci). - Prefer short expiry for temporary machines.
- Revoke when a laptop is lost or a CI secret rotates.
- Never put
pat-isms-…in public repos, screenshots, or support tickets.
Usage counts against your normal chat subscription and plan limits, not against API prepaid credits. Your agent still reads each returned reply as input, so the reply text also counts toward the calling tool's own context and usage.