Tokens and scope
What can an MCP token see, and how do I revoke it?
An MCP token stands for one person in one workspace. Every tool call runs as that person, with their project memberships and dashboard access at the moment of the call.
What a token sees
| Sees | Does not see |
|---|---|
| Measures and dimensions of the metric models in projects the user is a member of, plus tenant-wide sources | Projects the user is not a member of, even for a workspace owner or admin |
| Published dashboards the user may view | Drafts, raw tables, SQL |
Writes only through draft_starter_pack, which saves a draft for review and installs nothing | Any other write |
Removing someone from a project narrows their tokens at the next call. Removing them from the workspace stops their tokens: a token whose user is gone resolves to nothing (401).
Lifetime and limits
| Property | Value |
|---|---|
| Format | vmcp_ plus 32 random bytes, base64url |
| Stored | SHA-256 hash and the first 12 characters (shown as Token); the token itself is shown once |
| Lifetime | 90 days from creation, not extended by use |
| Active tokens per person | 10; the eleventh is refused with You have 10 active MCP tokens. Revoke one to create another. |
| Requests per token | 60 a minute; then 429 with Retry-After: 60 |
| Failed sign-ins per client address | 30 a minute; then 429 for every request from that address |
| Last used | updated at most once a minute |
| Clean-up | revoked and expired tokens are deleted 30 days later |
Rate limits are shared across app instances through Valkey when REDIS_HOST is set; without
it, each instance counts on its own.
Plan and server checks on every request
| Condition | Response |
|---|---|
Server has no ANTHROPIC_API_KEY | 404 |
| Workspace plan does not include MCP (after a downgrade, for example) | 402, Your … plan does not include the MCP server. |
| Plan lookup unavailable | 503 |
Token unknown, revoked, expired, or not vmcp_ | 401 |
A downgrade stops every token in the workspace at its next use; nothing has to be revoked.
Who can list and revoke
| Role | Lists | Revokes |
|---|---|---|
| Member | own tokens | own tokens |
| Workspace admin or owner | every active token in the workspace, with its Owner | any token in the workspace |
Revoke in Integrations → MCP server: select Revoke on the token's row. It takes effect on the next request. Revoking stays allowed while a standalone workspace is read-only (no plan chosen); creating does not.
Isolation
The token lookup runs before a workspace is known, so mcp_tokens carries a second row policy,
token_lookup, that lets a request read only the row whose hash it presents
(app.mcp_token_hash). Everything after that runs under the normal per-workspace row security.
See Tenant isolation.