X_MCP_SCOPE_DENIED
Means
the connection's token does not carry the tool's scope
Typical cause
a read token calling a write tool. The fix used to name x token grant <scope>, which is planned and exits X_NOT_IMPLEMENTED
Fix
reconnect with a token whose scopes include the one cause names — the app's resolveToken(token) is what returns them — or drop that scope from defineAppMcp({ scopes }). Scopes belong to the token and are fixed for the life of a connection, so a grant takes effect on the next one