mirror of
https://github.com/TautvydasDerzinskas/Thingport.git
synced 2026-10-21 14:12:25 -05:00
The API token read every GET endpoint. It now reads only the scopes its user allows (search, models, dashboard, activity, collections, tags, categories, authors, images, model files, imports, everything else), set beside the MCP tools in a sectioned Token permissions dialog. Existing and new tokens get every scope, so integrations such as Homarr and holm keep working; a refused request names the scope it needs.