What a scoped API key is actually protecting
Because every netweft MCP tool is read-only over rows already stored — none of them writes, crawls or spends a credit — a scope cannot withhold a capability, only a subject. The useful one is billing: it is how a key handed to an outside integration is stopped from reading the workspace's balance and plan.