invalid_scope: read, write not supported (custom Cursor connector)

Question

Connecting the official Front MCP (https://mcp.frontapp.com/mcp) from Cursor as a custom remote server (confidential OAuth client, no DCR).

Redirect in use: http://localhost:8787/callback

Feature access: MCP only

Resource permissions: Read + Write + Send enabled on the app as a ceiling. Client requests scope=read+write only (no send on the token).

Authorize returns invalid_scope: The requested scope is not supported: read, write — immediately after the company-domain screen. The same OAuth state is reused across retries even after deleting and recreating the MCP server in Cursor.

app.frontapp.com/.well-known/oauth-authorization-server lists scopes_supported: ["feature:mcp"] only. Docs say MCP scopes are read, write, send.

Has anyone hit this in the beta? Happy to share more details privately with Front if you need them for a per-app fix.

Yoann Nussbaumer · Answer

Hi Javier,Thanks, that was it. Recreating the Cursor connector with a blank scope (or only `feature:mcp`) unblocked OAuth. Cursor had kept sending `read` + `write` even after we thought we'd changed it.One extra gotcha if it helps others: Cursor sometimes opens `mcp.frontapp.com/authorize`, which 404s (`No such route: GET /authorize`). The working URL is `app.frontapp.com/oauth/authorize` with the same query string.We're connected now. Separate question, also for the beta: `search_conversations` with `status=open` returns the company-wide status, not the teammate's personal Open view (the sidebar inbox after "archive for me"). That's the mailbox we actually work from. Is a personal Open filter on the roadmap?Thanks again.

Sign up

Use your Front credentials

Login to the community

Use your Front credentials