Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Clarify OAuth support for billing and token inventory under Full access

Open
  • Is something wrong?
#286 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
1-2 days
Newbie friendliness
22/100
Issue type
Documentation
Clarity
Needs clarification
Activity status
Active
Tech stack
typescript
Domain
api, authentication

Research direction

The question centers on the Full access preset and the scopeNames catalogue in src/auth/scopes.ts, and on whether the billing and API token reads are reachable through the hosted OAuth connection. Start by reading how that preset is defined and comparing it with the documented permission names. Done means a maintainer confirms which reads are supported or documents that Full access excludes them. Live account testing is not needed.

Written by the indexing model from the issue text.

Description

question

Observed on 2026-10-14 using the existing hosted Cloudflare Code Mode MCP connection at https://mcp.cloudflare.com/mcp.

Authentication succeeds through whoami, and GET /oauth/scopes succeeds with HTTP 200. The current available catalogue contains 397 scopes. Billing Read, API Tokens Read, and Account API Tokens Read are not present. Account API Tokens Write is present. This catalogue read is not a claim that every listed permission is actually granted to the current session.

One read-only request to each current documented API path, with the selected account passed explicitly where relevant, returned:

  • GET /accounts//tokens: 9109 Unauthorized to access requested resource.
  • GET /user/tokens: 9109 Unauthorized to access requested resource.
  • GET /accounts//billing/profile: 10000 Authentication error.

No token creation, token revocation, role change, OAuth client modification, billing mutation, or reconnect loop was performed. The public MCP scopes.ts defines the Full access preset as the server scopeNames catalogue. The public source version is not asserted to match the deployed service version.

Please clarify whether these three reads are supported through this hosted OAuth connection. If they are, please identify the supported grant/repair path. If they are intentionally unavailable, please document that Full access excludes these operations and whether a supported read-only OAuth alternative is planned. The account holder prefers to retain the existing connection and avoid manually creating another API token.

Documentation:
https://developers.cloudflare.com/billing/understand/billing-permissions/
https://developers.cloudflare.com/fundamentals/api/reference/permissions/
https://github.com/cloudflare/mcp/blob/main/src/auth/scopes.ts

Dominant language
TypeScript
Stars
946
Forks
131
Avg merge
1d 18h
Merged PRs (30d)
29

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from cloudflare/mcp

All issues in cloudflare/mcp

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.