# X_MCP_SCOPE_DENIED

## Means

the connection's token does not carry the tool's scope

## Typical cause

a read token calling a write tool. The fix used to name `x token grant <scope>`, which is **planned** and exits `X_NOT_IMPLEMENTED`

## Fix

reconnect with a token whose scopes include the one `cause` names — the app's `resolveToken(token)` is what returns them — or drop that scope from `defineAppMcp({ scopes })`. Scopes belong to the token and are fixed for the life of a connection, so a grant takes effect on the next one

[MCP and AI](/error-codes#mcp-and-ai)