Enable write access in Claude Code
Reconnect Claude Code with permission to create, change, run, and delete Salt resources.
Reconfigure an existing read-only Salt MCP connection when Claude Code needs to change Salt resources. Reconnecting alone keeps the configured read scope; you must replace the server entry before you authenticate again.
The write scope also includes read access, so your existing read operations continue to work.
Before you begin
You need:
- A working
salt-mcpconnection created with the Claude Code quickstart - Claude Code 2.1.196 or later
- Permission in Salt to perform the changes you plan to request
Write access lets the MCP client create, edit, run, and delete resources on your behalf. Grant it only to a client you trust, and review destructive operations before approving them.
Replace the read-only connection
Clear the saved authorization
Run:
claude mcp logout salt-mcpClaude Code removes the saved OAuth credentials for salt-mcp.
Remove the read-only server entry
Run:
claude mcp remove --scope user salt-mcpClaude Code removes salt-mcp from your user configuration.
Add the server with write access
Run:
claude mcp add-json --scope user salt-mcp \
'{"type":"http","url":"https://salt-api-prod.salt.ai/mcp","oauth":{"scopes":"write"}}'Claude Code registers salt-mcp again and pins the OAuth request to write. This scope also includes read access.
Start authentication
Run:
claude mcp login salt-mcpClaude Code opens the Salt authorization page in your browser. For a terminal without browser access, run claude mcp login salt-mcp --no-browser and open the URL that Claude Code prints.
Review the write permission
Check the account under Signed in as and the callback under Redirects to.
The permissions list shows "Modify your Salt account and run workflows on your behalf." Confirm that you recognize the client and callback before continuing.
The authorization page shows the scope that Claude Code requested; it does not offer a scope selector. If the write permission is missing, click Cancel and confirm that you added the server with "scopes":"write".
Grant access
Click Authorize.
Salt redirects to Claude Code's local callback, and salt-mcp shows as connected with the new authorization.
Refresh the active session
If Claude Code is already running, exit the session and start it again:
claudeEnter /mcp and confirm that salt-mcp shows as connected before continuing.
Retry the blocked operation
Return to Claude Code and review the operation that required write access again.
For a destructive operation, list the current resources again and verify each target name and ID. If the delete tool supports dry_run, call it with dry_run=true and inspect the result before you explicitly approve a call with dry_run=false.
The operation can proceed when your Salt account also has permission for the requested resource.
Return to read-only access
When you no longer need to change Salt resources, replace the connection with the read-only configuration.
Clear the write authorization
Run:
claude mcp logout salt-mcpClaude Code removes the saved write-scoped credentials. If this command fails, stop and resolve the error before continuing.
Remove the write-enabled server entry
Run:
claude mcp remove --scope user salt-mcpClaude Code removes salt-mcp from your user configuration.
Add the read-only server entry
Run:
claude mcp add-json --scope user salt-mcp \
'{"type":"http","url":"https://salt-api-prod.salt.ai/mcp","oauth":{"scopes":"read"}}'Claude Code registers salt-mcp and pins the OAuth request to read.
Authenticate with read access
Run:
claude mcp login salt-mcpReview the authorization request again. It shows the read permission and does not show the permission to modify your Salt account.
Refresh the active session
Exit any running Claude Code session and start it again:
claudeEnter /mcp and confirm that salt-mcp shows as connected.