What you are approving
Signing in grants a token, and the server publishes exactly two scopes:
The server requires both. An unauthenticated request is answered with a challenge naming them together, so a grant of only
universal.workspace.read does not produce a working session. Connecting the server therefore grants write access, and a client that only ever reads is choosing to rather than being held to it. A well-behaved client confirms changes with you before applying them.
Access is still bounded by your own account. The scopes cannot reach a workspace you could not open yourself.
The mechanics
Dynamic registration is the reason most clients need nothing from you beyond the URL: the client registers itself, opens a browser, and takes it from there.
Every line above is published at
https://mcp.voiceflow.com/.well-known/oauth-protected-resource and
https://auth-api.voiceflow.com/.well-known/oauth-authorization-server. Both
are public, so you can check the current values yourself rather than taking
this page’s word for them.Signing out
Revoke access in Voiceflow to end every session at once. Removing the server from a single client only removes that client’s copy of the token, which is the right move when you are reconfiguring and the wrong one when a machine is lost.
Set up the Voiceflow MCP server
The URL, the transport, and how to tell the connection worked.