Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.complyhat.ai/llms.txt

Use this file to discover all available pages before exploring further.

ComplyHat uses OAuth 2.1 with Dynamic Client Registration and enforces scopes on every tool call. When your host completes the OAuth flow, it requests the scopes it needs; ComplyHat rejects any tool call that lacks the required scope with 401 Unauthorized. Most hosts request all needed scopes at registration time, so you typically see a single consent screen listing every permission your host requires for the tools you plan to use.
See authentication for the full OAuth 2.1 flow — how your host discovers the authorization server, registers itself via Dynamic Client Registration, and exchanges an authorization code for a bearer token.

​
Scope reference

The Protected Resource Metadata document at https://complyhat.ai/.well-known/oauth-protected-resource advertises the following scopes.
ScopeWhat it grants
mcpCatch-all scope required by some hosts that do not parse fine-grained scopes. Grants access to the MCP endpoint but does not substitute for individual resource scopes during enforcement.
models:readList and inspect registered models. Required by models (list, get), model_cards (list, get), reports (list, get, get_pdf_url).
models:writeRegister and update models. Required by models (register, update), model_cards (create, update), reports (generate).
bias-test:readList bias tests, schedules, and results. Required by bias_tests (list, get, list_schedules).
bias-test:writeRun bias tests and create schedules. Required by bias_tests (run, create_schedule).
drift:readRead drift monitors, snapshots, and alerts. Required by drift (monitors_list, monitors_status, alerts_list_by_model, snapshots_list).
drift:writeCreate monitors and submit snapshots. Required by drift (monitors_create, snapshots_submit).
adversarial:readList and inspect adversarial findings. Required by adversarial (list_by_model, get).
adversarial:writeSubmit adversarial findings. Required by adversarial (submit).
explainability:readList explainability runs and read results. Required by explainability (list_by_model, get).
explainability:writeTrigger explainability runs. Required by explainability (run).
audit:readRead the audit event log. Required by audit_events (list, get).
audit:writeEmit audit events from the host agent. Required by audit_events (emit).
kg:readRead the per-tenant compliance wiki. Required by wiki (list, read, search, log_list).
kg:writeWrite to the per-tenant compliance wiki. Required by wiki (write, link, draft_from_finding, lint, archive).
frameworks:readRead framework status, gaps, obligations, and regulatory intelligence. Required by frameworks (status, gaps, check), obligations (list, get, list_by_model, assess), reg_intel (changes, deadlines, relevance, change_detail).

​
Tool-to-scope mapping

Use this table to determine which scopes to request for a given set of tools.
ModeRequired scope
list, getmodels:read
register, updatemodels:write
ModeRequired scope
list, getmodels:read
create, updatemodels:write
ModeRequired scope
list, get, get_pdf_urlmodels:read
generatemodels:write
ModeRequired scope
list, get, list_schedulesbias-test:read
run, create_schedulebias-test:write
ModeRequired scope
monitors_list, monitors_status, alerts_list_by_model, snapshots_listdrift:read
monitors_create, snapshots_submitdrift:write
ModeRequired scope
list_by_model, getadversarial:read
submitadversarial:write
ModeRequired scope
list_by_model, getexplainability:read
runexplainability:write
ModeRequired scope
list, getaudit:read
emitaudit:write
ModeRequired scope
list, read, search, log_listkg:read
write, link, draft_from_finding, lint, archivekg:write
ToolModeRequired scope
frameworksstatus, gaps, checkframeworks:read
obligationslist, get, list_by_model, assessframeworks:read
reg_intelchanges, deadlines, relevance, change_detailframeworks:read
ToolNotes
alertsUses the catch-all mcp scope. No fine-grained scope is required beyond a valid bearer token.
data_governanceUses the catch-all mcp scope.
guidanceUses the catch-all mcp scope. Returns read-only skill and agent markdown.

​
Requesting scopes

Most MCP hosts request all scopes they need at client registration time. For example, a host that calls all 14 entity tools would request: 
mcp models:read models:write bias-test:read bias-test:write drift:read drift:write
adversarial:read adversarial:write explainability:read explainability:write
audit:read audit:write kg:read kg:write frameworks:read
You can narrow the list to only what your workflow requires. A read-only audit review host, for instance, might request only models:read audit:read kg:read frameworks:read.
If your host requests fewer scopes than a tool requires, ComplyHat returns 401 Unauthorized on that tool call — even if the bearer token is otherwise valid. Request the scopes you need upfront rather than relying on the mcp catch-all for fine-grained tools.