> ## Documentation Index
> Fetch the complete documentation index at: https://docs.supercycle.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> How the Operators MCP authenticates, what each OAuth access level allows, and how writes are confirmed

The Operators MCP connects to your live Supercycle data and can read and write to your store. This page explains how access is granted, scoped, and revoked.

***

## Authentication

The Operators MCP uses OAuth:

* You sign in with your existing Shopify credentials
* There are no API keys to manage or rotate
* Access is scoped to your store, so no other merchant's data is reachable
* You revoke sessions from <Icon icon="shopify" iconType="solid" /> **[Integrations](https://admin.shopify.com/apps/supercycle/settings/integrations)**

***

## OAuth access levels

When you connect an AI client, the consent screen asks which access level to grant:

| Access level    | OAuth scope | What it allows                                             |
| --------------- | ----------- | ---------------------------------------------------------- |
| **Full access** | `mcp`       | Read and update cycles, returns, items, and customers      |
| **Read only**   | `mcp:read`  | Read cycles, returns, items, and customers, with no writes |

**Full access** is selected by default. Select **Read only** when you want an AI assistant to search and inspect data without changing anything.

If the client already asked for read-only access, the consent screen shows that level with no option to widen it.

Read-only connections can call the list and get tools, such as `list_cycles`, `get_cycle`, and `list_items`. The write tools, `update_cycle`, `update_item`, `update_outbound_fulfillment`, `update_inbound_receival`, `create_return`, `update_return`, `add_tag`, `remove_tag`, `add_comment`, `create_blocked_date`, and `delete_blocked_date`, return an **Insufficient scope** error. Reconnect and select **Full access** to use them.

Deactivating an OAuth client under **Integrations** blocks all of its tokens at once, including tokens already issued.

***

## Approval flows

The Operators MCP uses MCP safety annotations to protect your data:

* **Read operations.** Approved automatically, so searching and viewing cycles, inventory, charges, and customers is uninterrupted.
* **Write operations.** Ask for your confirmation before they create, update, or delete data.

Your AI client prompts you to approve each change before it reaches your store.

***

## Data access

* The Operators MCP only works within your store's data.
* You have the same data access as your Supercycle admin account.
* No data is shared with external systems unless you set up an integration yourself.
* Every operation goes through the Supercycle API with its standard rate limits and validation.

***

## Best practices

* **Review write operations.** Read the confirmation prompt before you approve a change from your AI client.
* **Revoke sessions when needed.** When a team member leaves or access should end, revoke their session from <Icon icon="shopify" iconType="solid" /> **[Integrations](https://admin.shopify.com/apps/supercycle/settings/integrations)**.