magus v0.4.3 is out. See what's new
¶ View markdown source · ✎ Suggest an edit
1 min read

MGS9015: grant below the route's need

The token is valid, and it may not use this route. Every server route needs one level on one surface (mcp=write, console=read, tokens=write), and the token's grant is below it, so the server answered 403 forbidden.

[MGS9015] this route needs mcp=write and the token presented holds
console=write; mint one that reaches it with: magus config console token
create, or magus config mcp connector create
  see: .../MGS9015.md

Why

A token holds a grant, one level per surface, and each route declares what it needs. A console token is refused at /mcp, a connector token by the console, a viewer by every console write, and every token but the operator's by token management. The answer is 403 rather than 401 because the token is fine; it only tells its holder that their own token is valid, which they already know.

An MCP tool call is held to mcp=write as well, over the server's /mcp and over magus mcp's stdio, and a call below it gets this code as a tool error naming the tool.

Resolution

Use a token whose grant covers the route. The message names the need:

  • mcp=write: magus config mcp connector create
  • console=write: magus config console token create
  • console=read: magus config console token create --viewer
  • tokens=write: only the operator token, used from your own shell

See also

MGS9015authtokengrantneed403
Last updated (95680f58)
Earlier changes on this page (2)

Full history ↗ · Blame source ↗

Glossary

Op

A single tool-native command a target composes (long form: operation); the middle of the work hierarchy (Spell to Op to Target). See operations.

Server

The background process a person starts with magus server start. It serves MCP, the console, background jobs and the warm knowledge graph, and adopts nested magus calls into one pool. See server.

Conventions

This page uses none of the site's convention markers. The full set is on the conventions page.