MGS9015: grant below the route's need
The token is valid, and it may not use this route. Every server route needs one
level on one scope (mcp=write, console=read, tokens=write), and the
token's grant is below it, so the server answered 403 forbidden.
[MGS9015] this route needs mcp=write and the token presented holds
console=write; mint one that reaches it with: magus config console token
create, or magus config mcp connector create
see: .../MGS9015.md
Why
A token holds a grant, one level per scope, and each route declares what it
needs. A console token is refused at /mcp, a connector token by the console,
a viewer by every console write, and every token but the operator's by token
management. The answer is 403 rather than 401 because the token is fine; it
only tells its holder that their own token is valid, which they already know.
An MCP tool call is held to mcp=write as well, over the server's /mcp and
over magus mcp's stdio, and a call below it gets this code as a tool error
naming the tool.
Resolution
Use a token whose grant covers the route. The message names the need:
mcp=write:magus config mcp connector createconsole=write:magus config console token createconsole=read:magus config console token create --viewertokens=write: only the operator token, used from your own shell