Secureframe · OAuth Scopes

Secureframe OAuth Scopes

OAuth 2.0 probed

Secureframe uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

GRCComplianceSOC 2ISO 27001RiskCMMCFedRAMPSecurityAuditTrust
Scopes: 0 Flows: Method: probed

Scopes (0)

Secureframe implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.

A single scope named "mcp" grants the whole surface. There is no read-only scope, no per-resource scope and no way to grant an agent a subset — even though the provider labels 63 of its 112 tools read and 49 write. Effective permissions are whatever the authorizing user's RBAC role allows, which the agent cannot enumerate through the API.

📄 Provider scope reference: https://mcp.secureframe.com/mcp_docs

Source

OAuth Scopes

Raw ↑ 
specification: API Commons OAuth Scopes
specificationVersion: '0.1'
provider: Secureframe
providerId: secureframe
generated: '2026-08-27'
modified: '2026-08-27'
method: probed
source: https://mcp.secureframe.com/.well-known/oauth-authorization-server (200, 2026-08-27) + https://mcp.secureframe.com/mcp_docs
docs: https://mcp.secureframe.com/mcp_docs
description: 'Secureframe publishes OAuth scopes on ONE surface only: the hosted MCP server. The REST API at
  api.secureframe.com uses an API key/secret pair with no OAuth flow and no scopes at all — authorization there
  comes entirely from the RBAC role of the user the key belongs to.'
surfaces:
- surface: MCP server
  endpoint: https://mcp.secureframe.com/
  flow: OAuth 2.1 authorization_code + PKCE (S256), refresh_token
  authorization_server: https://mcp.secureframe.com
  dynamic_client_registration: true
  scopes_supported:
  - mcp
- surface: REST API
  endpoint: https://api.secureframe.com
  flow: none — apiKey in the Authorization header
  scopes_supported: []
  note: 'components.securitySchemes declares exactly one scheme, header_authorization (apiKey, in: header).
    No oauth2 or openIdConnect scheme exists.'
scopes:
- name: mcp
  description: Permission for an MCP client to use the Secureframe API as the authorizing user, inside one
    selected company.
  surface: MCP
  granted_by: the consent screen during the browser sign-in flow
  source: scopes_supported in the RFC 8414 metadata; described at https://mcp.secureframe.com/mcp_docs
granularity: coarse
note: A single scope named "mcp" grants the whole surface. There is no read-only scope, no per-resource scope
  and no way to grant an agent a subset — even though the provider labels 63 of its 112 tools read and 49 write.
  Effective permissions are whatever the authorizing user's RBAC role allows, which the agent cannot enumerate
  through the API.
token:
  access_token_lifetime: 1 hour
  refresh: silent; the refresh credential rotates on each use
  revocation_endpoint: https://mcp.secureframe.com/oauth/revoke
  introspection_endpoint: https://mcp.secureframe.com/oauth/introspect
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com

Work with this as data

Every scope set here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for oauth scopes

4 MCP tools reach this
  • find_scopesBrowse and filter every scope set in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This scope set 
curl "https://apis.io/api/v1/scopes/secureframe-scopes"
All oauth scopes 
curl "https://apis.io/api/v1/scopes?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.