WORKING MACHINES TROUBLESHOOTING
Provider connection is missing a required scope
Tool discovery succeeds, but a specific provider action is unavailable or fails with a permission, forbidden, insufficient-scope, or authorization error.
Likely causes
- The provider connection was authorized before the action required a new scope.
- The account role cannot grant or use the requested provider capability.
- An administrator policy blocks the permission.
- The action is using a different connection from the one the user reviewed.
Check first
- Inspect the action contract and its required provider-native scopes.
- Confirm the selected connection identity and provider account.
- Check the account role and organization-level restrictions.
- Determine whether a narrower action can complete the task safely.
Resolution
- 01Reconnect the provider only if the additional permission is justified.
- 02Review the provider consent screen and approve the minimum required scope.
- 03Select the corrected named connection for the action.
- 04Escalate to the provider administrator when organizational policy blocks access.
Verify the fix
- The intended action is available on the intended connection.
- A bounded read succeeds before attempting a write.
- The execution record identifies the correct provider account and action.
What to include in a support report
Record the client name and version, the MCP endpoint hostname, the time of the failed attempt, and the exact error text. Include the affected provider and action when relevant, but remove authorization headers, cookies, OAuth codes, API keys, and provider data. This evidence distinguishes configuration, authorization, connection, and provider-permission failures without exposing credentials.