OAuth consent and per-app scopes

When a client connects, pumati.app shows a consent page with the client's name and where it returns (for Claude Code, Codex and Cursor a program on your own computer, for claude.ai and ChatGPT their own site). The request is valid for 15 minutes. You choose:

Scopes for each of your apps. An app you leave unticked is not listed and can't be used by this connection.
Whether it may create new apps, and the scopes those apps get. Creating needs write.
A spend limit in credits (spend limit).

Scopes

Scope	Allows
`read`	`list_apps`, `list_app_tests`, `get_test`, `wait_for_updates`, `list_feedback`, `get_feedback`: missions, results and feedback
`write`	`upsert_app` (rename), `register_build`, `create_test`, `create_comparison`, `update_test`, `record_resolution`, `create_retest`: drafts and records, nothing spent
`publish`	`publish_test`, `adjust_test`, `cancel_test`: reserve or return credits and start, change or stop recruiting. `review_feedback`: judge submissions (approving pays testers)

Write and publish always include read: an agent that changes something can see what it changed.

Token scopes

A client may also ask for fewer scopes in its OAuth request (read, write, publish). A call is allowed only when both the token and the app's grant have the scope; otherwise it is FORBIDDEN. A connection only ever sees its own apps: an app the grant doesn't name, and every mission and feedback in it, is NOT_FOUND, the same as one that doesn't exist.

Revoke

pumati.app/dev/mcp lists your connections with their apps, scopes and spend. Revoking takes effect on the next call (FORBIDDEN); every tool call reads the grant, so there is no cached access.