github_check_token_scopes

What github_check_token_scopes does on Sage MCP

AI agents call github_check_token_scopes to retrieve information from Sage MCP without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why github_check_token_scopes is rated Low

This tool retrieves information about the OAuth token's permissions and scopes. It is a non-destructive, read-only operation that queries existing data without creating, modifying, deleting, or executing any actions. The minimal blast radius if misused is reading token scope information, which could inform an attacker of available permissions but does not directly enable access or changes.

From the tool's definition Tool name 'github_check_token_scopes' and description 'Check the current OAuth token' indicate a read-only query of token metadata/scopes without modification or execution.

The rule that runs github_check_token_scopes safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Sage MCP, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For github_check_token_scopes, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "github_check_token_scopes": {}
  }
}

Questions about github_check_token_scopes