What is an MCP token, and how do I scope it?
The credential your AI client shows the CRM. Scoped well, it limits the tools, records and channels one agent can touch.
Want to see it first? Book a demo
The short answer
- An MCP token is the credential an MCP client such as Claude, ChatGPT or Cursor shows an MCP server, and the server uses it to decide which tools and records that client may reach.
- You limit MCP access by scoping the token on three axes: which records it can see, which channels it acts through, and which actions it may take.
- Issue one MCP token per agent per job, so every call in the audit log points at one actor and one revoke stops one agent.
- SalesCrew scopes each MCP token by channel, Upwork profile and area, the same three axes as a user role, and you revoke it in Settings or with the mcp_token_revoke tool.
Why some MCP access feels all-or-nothing
An MCP server has two jobs when your client connects. It checks the client is who it says it is, and it decides what that client may do. A server that only does the first job gives any valid token the full rights of the user behind it. That's where the "MCP is all or nothing" complaint comes from.
A scoped token fixes it. The token maps to a narrower set of tools and records than the person who created it holds. If it leaks, the damage stops at its scope. If an agent misbehaves, you revoke one token and every other connection keeps running.
How CRM MCP servers limit access
Read on each vendor's own MCP documentation.
| CRM | What limits an AI client | Source |
|---|---|---|
| Close | Three scopes: mcp.read, mcp.write_safe, mcp.write_destructive | help.close.com/docs/mcp-server |
| HubSpot | The signed-in user's permissions; each create or update needs your confirmation | developers.hubspot.com/mcp |
| Attio | OAuth, scoped to what the signed-in user can already access | docs.attio.com/mcp/overview |
| Pipedrive | OAuth, limited to data your Pipedrive user may view and edit | pipedrive.com/en/features/mcp-server |
| monday | Only actions the connected user may already take in the UI | monday.com/w/mcp |
| SalesCrew (our product) | Per-user token scoped by channel, Upwork profile and area; external sends wait in one approval queue | Disclosure: SalesCrew is our product. |
Vendor facts checked September 2026. MCP products change often, so read the vendor page before you rely on a row.
Scope a new MCP token in five steps
- 1
Name the job
Write one line: what this agent does and for whom. "Triage replies in the sales inbox" is a job. "Help with the CRM" isn't.
- 2
Pick the records
Limit the token to the objects that job needs, such as deals and contacts in one pipeline. Leave billing and user records out.
- 3
Pick the channels
Name the mailbox, LinkedIn queue or Upwork profile the agent works through. Never grant every connected channel by default.
- 4
Pick the actions
Start on read. Add write for the action classes the job needs, and keep sends behind a person's approval.
- 5
Log and review
Check the audit log after the first week. Revoke tokens that no longer match a live job.
How SalesCrew scopes an MCP token
SalesCrew gives every user their own MCP token, cut on the same three axes as their role: channel, Upwork profile and area. A token for your inbox agent can reach one mailbox's threads and nothing in billing. You issue and revoke tokens in Settings, or through the mcp_token_issue and mcp_token_revoke tools.
Scope isn't the only control. Any external send a token's agent proposes waits in one approval queue by default, and every call is written to the audit log with the user, token or agent that made it. So even a correctly scoped token can't email a prospect until you approve it. The SalesCrew MCP server covers 140+ tools, and every tier includes it, from $299 a month with unlimited seats.
A token in a shared file is a leaked token
Questions
- Is MCP access all or nothing?
- No, not on a server that scopes its tokens. MCP access is all or nothing only when the server treats any valid credential as the full user. Close splits access into read, write and destructive scopes, and a SalesCrew token is limited by channel, Upwork profile and area. Check which model your CRM uses before you connect an agent.
- Is an MCP token the same thing as an API key?
- An MCP token and an API key are both credentials sent with a request. The MCP token authenticates a client to an MCP server, and on a well-built server it also carries a scope. That scope decides which tools and records the client can reach, which a plain API key often doesn't.
- When should I revoke an MCP token?
- Revoke an MCP token the moment its activity looks wrong: a spike in calls, calls to tools outside its job, or calls at odd hours. Revoke it too when a pilot ends or the person who set it up leaves. Issuing a fresh token takes a minute, so there's little cost to acting early.
- How many MCP tokens should one team have?
- One MCP token per agent per job. A team of 5 running a triage agent and a research agent would hold at least 2 agent tokens, plus one per person who uses Claude or ChatGPT on the CRM. Separate tokens are what make the audit log point at one actor.