OAuth Scope Risk Analyzer

Know what you're actually granting before you click Allow.

OAuth consent screens list requested permission scopes in dense, technical identifiers that most people click through without reading closely — the difference between gmail.readonly and full gmail access, or between drive.file (files the app itself created) and unrestricted drive access to your entire cloud storage, is easy to miss but represents a dramatically different risk profile. This tool classifies pasted scope strings against a reference risk table, distinguishing read-only from read/write, and narrowly-scoped from broad or administrative access, in plain language.

• →Distinguishes read-only scopes from full read/write access across email, drive, calendar, and contacts
• →Flags the specific difference between file-scoped access (drive.file) and unrestricted full-drive access
• →Highlights administrative/organization-wide scopes as the highest-risk category
• →Built for developers reviewing their own app's requested scopes, or anyone auditing a third-party app before granting access
• →Watermarked by Cikal Studio Labs · Works on any device, no install required