Write and read tools share a scope
A scope that covers write/destructive tools also covers read tools.
What it means
Patchbay tokenises each tool name on separators (_, -, space, /) and classifies tokens as "write" (create, update, delete, send, pay, charge, transfer, execute, run, post, put, patch, destroy, remove, insert, write, add, set, kill, stop, start, deploy, publish) or "read" (get, list, read, search, find, query, fetch, lookup, describe, show, inspect, view). If a scope maps to both a write tool and a read tool, revoking write access also revokes reads, which is almost never what the user wanted. Confidence is medium: the regex is a heuristic and will mislabel some tool names (post_user = "user who posted", not "HTTP POST a user").
How to fix
Split the shared scope into separate read and write scopes. Example: instead of user:all for both get_user and delete_user, use user:read and user:write.
Run the check against your own server:
npx -y @patchbay-nebius/agent audit <url-or-directory>No install: scan an MCP server in the browser and get a shareable report.
Disagree with this finding on your server? Open an issue with the --json output. False-positive reports are the most useful feedback.