MCP scopes: what each permission grants
A key only ever sees the tools its scopes allow - everything else doesn't exist for it. Your legacy integration key (Zapier, Make) is a separate class: MCP-scoped keys cannot access the legacy send path, and one key can never hold both. The 175 tools sit in 37 permission groups: when you connect an app by signing in, you start from read-only analyst, assistant without sends or assistant with sends, and an org manager can narrow any connected app to the Support, Sales or Reporting preset or to chosen groups.
Read
| Scope | Grants |
|---|---|
read_conversations | Conversations, message history, follow-up queue |
read_contacts | Contact directory search and detail |
read_campaigns | Campaign lists and status |
read_signals | Business signals |
read_tasks | Tasks and projects |
read_labels | Label definitions |
read_groups | Group conversations (if the org allows groups at all) |
read_team | Team member names, roles and active status |
read_media | Media content: capped inline images, voice transcripts |
read_calendar | Calendar events |
read_status | Status updates and who viewed them |
read_newsletters | WhatsApp channels: the ones you follow, search, and their posts |
read_presence | Online and last-seen presence of a contact |
read_commerce | Product catalog and orders |
read_profile | Your WhatsApp profile and business profile |
Act (internal)
| Scope | Grants |
|---|---|
manage_labels | Add / remove labels, create new labels |
mcp_manage_contacts | Create contacts and update contact fields; notes are append-only (the AI can never delete what a human wrote) |
manage_tasks | Create, update and complete tasks |
manage_signals | Update signal status |
manage_chats | Close, reopen, archive, mute, mark read |
assign_conversations | Assign conversations to team members |
manage_digests | Define and update chat digests, start or cancel period report builds (commits future AI spend, so it is a separate grant) |
manage_calendar | Create and update calendar events |
manage_newsletters | Follow and unfollow WhatsApp channels |
submit_feedback | File a feedback ticket with the Spun team |
Compute
| Scope | Grants |
|---|---|
ai_compute | AI reply drafts and semantic search (draws on your org’s AI budget) |
Send and outward changes
| Scope | Grants |
|---|---|
mcp_send_message | Submit text sends into your org’s send flow |
send_media | Submit media sends (uploads are single-use, org- and key-bound) |
schedule_message | Schedule and cancel future sends |
forward_messages | Forward messages (each forward waits for approval by default) |
manage_groups | Create groups, add or remove participants, manage admins, settings and invite links, leave groups (changes wait for approval by default) |
manage_status | Post text and media status updates (approval by default) |
manage_profile | Update your WhatsApp profile (approval by default) |
mcp_autonomous_send | Execute sends without approval - only if the org posture is autonomous; high-friction grant |
Knowledge base and bots
| Scope | Grants |
|---|---|
read_knowledge, manage_knowledge | Your own knowledge base: list, read and search articles and suggestions; with manage, add, edit, retag and delete articles and review suggestions. Changes apply at once. |
read_bots, manage_bots | Your bots and auto-reply rules: read them and the conversations a bot handled; with manage, create and edit bots and rules. Turning a bot on needs a manager's approval. |