MCP sign-in and permissions
How RPScripts' MCP server signs you in with OAuth, which permissions each tool needs, and how credits, downloads and your data are protected.
Public tools need no account. Three tools act for you: list_purchases, get_download_url and generate_script. For those, your MCP client signs you in to RPScripts with OAuth 2.1, the standard MCP authorization flow.
How sign-in works
- The client calls a private tool and RPScripts answers that it needs authorization.
- The client opens the RPScripts login page in your browser. Sign in with your email code or Discord, as on the website.
- RPScripts shows which app asks for which permissions. Choose Allow access or Deny.
- The client receives an access token that only works for
https://rpscripts.net/mcpand repeats the call.
Your login code or Discord session never passes through the client. Clients identify themselves with a Client ID Metadata Document or register automatically; RPScripts does not review them, so only approve a request you just started yourself.
Permissions
| Scope | Allows | Used by |
|---|---|---|
purchases:read | See the products you own and their files | list_purchases |
downloads:create | Create download links for products you own | get_download_url |
ai:generate | Use your AI credits for generations | generate_script |
offline_access | Stay connected without asking again | all |
If a client calls a tool whose permission you did not grant, RPScripts asks for exactly that permission again.
Safeguards
- Ownership: every purchase and download is checked against your active purchases at the moment of the call, with the same holds and daily limit as the website.
- Credits:
generate_scriptonly spends credits when the call saysconfirm_credit_use: true, which your assistant may only send after you agreed.max_creditscaps a run (default 9 credits, about three scripts), and a run never spends more than your balance. - Tokens: access tokens are signed, bound to the RPScripts MCP endpoint and expire after 15 minutes; clients renew them with a refresh token. Deleting your RPScripts account stops them at once.
- No cookies: the MCP endpoint only accepts bearer tokens, never your browser session.
- Your data: code and configs you send to the checking tools are processed and discarded; secrets in a
server.cfgare never repeated in an answer.
To disconnect an app for good, write to support@rpscripts.net.