403 error when reading living person through MCP, but API works

[ogruenig]

When I try to read (get-record) a living person using the mcp server functionality, I get 403 errors
Doing the same get-record for dead persons works fine though.
Also when I do an API Test (swagger page) from the Webtrees UI with the same technical user, get-record works fine for both dead and living persons.
When I directly log into the Webtrees page with the same technical user, I can browse all persons just fine.

My technical user is newly created and has member authorization; I have changed it to editor, but same issue remain.
The client has scopes = ( api_read_privacy, mcp_read_privacy ). I have created a new access token, but that did not help.
Are there any hints / additional config to allow MCP read living persons?

[Jefferson49]

Thank you for using and testing the API and MCP! I appreciate getting feedback.

It was a deliberate decision not to provide any data of living people via MCP. If you connect an AI via MCP you have no control what happens with the data. A lot of countries have laws to protect data of living people.

Maybe, we can rethink this policy if there is sufficient experience with AI, MCP, and genealogy available. At the moment, I do not want to take any risk.

[ogruenig]

Thanks for the quick feedback - and for the great development!

Great, now I understand that the MCP interface filters out living persons' data intentionally.
I would suggest you add this in the documentation somewhere.

For my purpose however reading living people's data would be necessary - I have a small family tree, and a locally-hosted AI model + agent next to it, so there is limited risk.
Maybe you could make this configurable? Webtrees already offers a fine-grained and reliable auth system; if you don't trust it and add an additional filter on living persons, it would be great if you allow to switch that off.

For now, I can use your REST API directly to access the data. Thanks again for your efforts - great idea, I am sure this will be used more in the coming months, as it allows non-tech people easier access to genealogy data (as I see with my family).

[djrfree]

I am having a similar problem: "403 Insufficient permissions: Provided scope(s) insufficient to access MCP".
The "scopes" is present under "client credentials" on the "OAuth2 Server Settings" page, but missing for the access token. I have tried regenerating the access token.

[Jefferson49]

The "scopes" is present under "client credentials" on the "OAuth2 Server Settings" page, but missing for the access token. I have tried regenerating the access token.

Do you use the client credentials grants? Or did you create an access token for the client and used the access token for authorization with a bearer token?

If you create an access token, you need to add the required scopes also. If your created access token does not contain the required scopes, you can create a new access token (and maybe revoke the "wrong" token).

[djrfree]

I started over with create new keys, made sure I specified the scopes at each step, and that resulted in tokens with scopes that I could use. Thanks! I still have an issue with using the token in an MCP call from Claude Desktop, but that is a separate problem.