Fix an “MCP permission required” Error

MCP permission required means that MaskPilot checked the currently signed-in account and did not find permission to use AI automation. It is not an unknown tool name, and it does not by itself mean that the bearer token has expired. Identify the failing layer before changing access.

Separate the common errors first

Symptom	Failing stage	First action
connection refused	The caller cannot reach the local service	Check the desktop client, MCP switch, and local address
401 or invalid mcp token	The service received the request, but the token does not match	Update the caller with the current token
Unknown tool	The current client does not provide that tool name	Refresh the tool list
MCP permission required	The current account lacks AI automation access	Check the account and team-member permission
MCP account mismatch	MCP was enabled for a different account	Re-enable it for the current account and update the connection

If the health check or local address is unavailable, start with the local MCP connection checklist. Repeatedly resetting the token will not fix an explicit permission denial.

Restore access in order

1. Return to MaskPilot, confirm that the desktop client is still signed in, and identify the current account.
2. If the current account is a team member, ask the team owner to verify that this member may use AI automation.
3. Also confirm that the member can see the target browser profile and has the permission required for the requested operation. Seeing a tool in the MCP list does not grant access to every target resource.
4. After the permission change, refresh the MaskPilot MCP page and confirm that its status is available for connections.
5. Reload the caller’s MCP connection and tool list, then run a read-only query that exists in the current list.
6. Check the recent call record in MaskPilot for the tool name, time, and success or failure status. Do not submit a full log containing the token or business data.

See manage AI permissions and tokens for the boundary between permission checks and connection settings.

Rebind MCP after switching accounts

The local MaskPilot MCP configuration belongs to the account that enabled it. Switching to another account does not give the old connection the new account’s permissions. Even when both accounts may use AI automation, the current account must enable MCP again.

When the account changes, MaskPilot generates a different connection key for the new account. Then:

1. Copy the new token from the current account’s MCP page.
2. Update the environment variable or secure credential setting used by the caller.
3. Fully reload the caller so an old process does not keep using its cached token.
4. Reconnect and retrieve the tools actually provided by the current client.

The old token cannot continue to authenticate. If the caller now reports an invalid token, follow the invalid MCP token steps.

What happens when access is revoked

MaskPilot checks the current account and AI automation permission again before a tool performs its business operation. If a member loses permission, the account changes, or the sign-in is no longer valid, the requested operation does not continue and the local MCP entry point stops accepting the old connection.

The caller may therefore record MCP permission required first and later appear offline, fail to connect, or report an unauthorized response. These symptoms can come from the same permission change. Do not work around them by exposing the local port, sharing an owner’s token, or modifying the request.

After permission is restored, the same member should restore the connection from their own client. Never copy another member’s or owner’s token to the rejected account.

Verify the recovery

Recovery is complete only when all of these checks pass:

• The MaskPilot MCP page shows that the current account is available for connections.
• The caller has retrieved the tool list again instead of using a cached session.
• A read-only tool call succeeds and appears in the recent call record.
• Operations on a target profile still respect the member’s profile visibility and feature permissions.

If the caller uses a name that is absent from the current tool list, follow the unknown MCP tool checklist instead of granting broader member access.

The official MCP authorization specification also distinguishes invalid credentials from insufficient permissions and calls for least-privilege access. MaskPilot applies its own current-account checks over a local connection; an external service’s OAuth consent flow does not replace MaskPilot team permissions.