Open source · public release December 2026

See how much access your MCP server really uses.

Scopegauge compares the OAuth scopes an MCP server asks for with the scopes its tools exercise. It's the first step of every Agent Access Audit, and it will be free for anyone to run.

Tell me when it's out The study it powers

scopegauge · fernhill-crm-mcp

preview

requested at install: 11 scopes

search_contactsok
uses contacts.read
get_contact1 over
uses contacts.read, contacts.pii.read
add_note1 over
uses contacts.write
list_dealsok
uses deals.read
export_report1 over
uses export.all
sync_files1 over
uses files.read, files.write

Illustrative output · public release December 2026

What it does

Requested vs used, per tool.

Reads what's requested

Every scope the server asks for, from its metadata and consent flow.

Watches what's used

Which scopes each tool exercises while you use it in a test environment.

Flags what's never used

Scopes no tool touches, marked for removal.

JSON for CI

Machine-readable output, so scope creep can't quietly come back.

Runs locally

Nothing is sent to us or anyone else.

What it doesn't do

Used isn't the same as needed.

A tool can use a scope it shouldn't. Deciding the smallest set a tool needs, and testing the token, consent and injection paths around it, takes a person. That's what the Snapshot and the audit are for.

What the free check can't see

Scope Snapshot

Two days of signed-in testing on one MCP server or agent: is each tool held to its scope, is each token held to your server, and which three changes matter most.

$490≈€440≈£370≈CA$700≈A$700≈S$630≈AED 1,800₹25,000

Fixed price · billed in USD

Approximate, at 9 Oct 2026 rates · invoiced in USD

For clients in India · plus 18% GST

2 working days

Details

Our main service

Agent Access Audit

An independent, signed-in test of what your MCP server or AI agent can really do, measured against what it needs, with the token, consent and prompt-injection paths around it. You get the fixes, a retest and a letter your customers can verify.

$2,900≈€2,600≈£2,200≈CA$4,100≈A$4,200≈S$3,700≈AED 10,700₹1,50,000per server

Fixed price · billed in USD

Approximate, at 9 Oct 2026 rates · invoiced in USD

For clients in India · plus 18% GST

Up to 4 servers: $6,500≈€5,800≈£4,900≈CA$9,200≈A$9,300≈S$8,300≈AED 23,900₹3,40,000

7–10 working days

See what's included

Only run Scopegauge against servers you own or are authorized to test. When we use it for research we read public information only, and report anything we find privately first. See our disclosure policy.