Can You Make the Adobe Analytics MCP Server Read-Only?

In the Adobe Analytics and Customer Journey Analytics MCP servers, the setting that keeps an AI agent read-only is not in the token the agent carries. On November 2, 2026, I asked both servers for their OAuth metadata without logging in: none of the three scopes they advertise says read or write. Read-only lives in Adobe Admin Console, in a permission item called "MCP Read-only Access" that both products’ release notes list as generally available on October 6, 2026. On October 20, Adobe corrected its own documentation about who that item governs: product administrators receive full MCP access automatically, and giving them the read-only item changes nothing.

This is an audit of Adobe’s public documentation, its Git history and the servers’ unauthenticated metadata, not a tenant test: I have not connected an agent to an Adobe organization. Anyone can repeat the requests. "Documented" and "advertised" below mean exactly that. Everything was verified at source on November 2, 2026.

Quick answer

Yes, for any user who is not a product administrator, as of November 2, 2026. The Adobe Analytics and Customer Journey Analytics (CJA) MCP servers each have an Admin Console permission item, MCP Read-only Access, that lets a user’s AI client find components and run reports but not create or update segments, calculated metrics, date ranges, Workspace projects or, in CJA, audiences. Both products’ release notes list it as generally available on October 6, 2026. It is assigned in a product profile and is not carried in the OAuth token, whose advertised scopes make no read/write distinction. Two limits come from Adobe’s documentation as corrected on October 20, 2026: product administrators automatically get full MCP access, and permissions combine across profiles, so any profile carrying MCP Full Access outweighs a read-only one. A read-only agent therefore needs an account that is not a product administrator and belongs to no Full Access profile.

When did Adobe add MCP Read-only Access, and what changed on October 20?

Adobe added MCP Read-only Access in early October 2026, generally available October 6 per the Adobe Analytics and CJA release notes, and corrected its product-administrator rule on October 20, 2026. Six dates mark that one change, each from its own source; none is "the day Adobe announced it".

The changelog dates record server releases: Adobe committed the Analytics entry with c15a5b1 on October 9, and the CJA entry got its October 8 date ten minutes later, in 73e2a82. The permissions page, before and after:

One gap remains: the corrected pages say nothing about a system administrator who is not a product administrator, beyond requiring an item of "Other users". Ask Adobe before assuming either way.

Adobe published this correction; I am reporting it. The superseded sentence had been in Adobe’s getting-started guide since April 17 and its FAQ since May 18. On October 26, the summary generated by an AI search tool still said, in substance, that the rule covers system and product administrators and that the FAQ calls the item MCP Access. Adobe’s analytics-mcp developer pages have said neither since October 20 and October 9 respectively, and one Experience League page that used the old name now redirects (the redirect is dated October 22). Two Experience League pages for the CX Coworker Gateway, dated September 18, 2026, still resolve and still say "MCP Access" (see the gateway note below).

Why doesn’t the OAuth token say read-only?

Because Adobe put the control somewhere else. Three unauthenticated requests show it:

curl -i -X POST https://aa-mcp.adobe.io/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
curl https://aa-mcp.adobe.io/.well-known/oauth-protected-resource/mcp
curl https://aa-mcp.adobe.io/.well-known/oauth-authorization-server

The first returns 401 with a WWW-Authenticate header pointing at the protected-resource document, as RFC 9728 describes. That document lists three scopes: openid, AdobeID and additional_info.projectedProductContext. cja-mcp.adobe.io returns the same shape. None of the scopes separates reading from writing.

That is not a flaw. Adobe’s catalogue states the model: "AI clients act on behalf of your Adobe user account using OAuth." The token says who you are; per Adobe’s documentation, your product profiles decide what you may do. In August, writing about what AI agents can do in your ad accounts and CRM, I said the tool list is the vendor’s promise and the scope is the actual permission. Here the scope is silent: neither a consent screen nor a token inspection nor a log that records scopes can tell you whether an agent can write.

That also answers question 6 of my RFP questions for a vendor’s MCP server for these two products: per Adobe’s documentation, read-only is set server-side, not in the client’s configuration.

Which tools does MCP Full Access unlock?

I counted the "Required permission" lines in both live tool references. Adobe Analytics lists 23 tools, four of which need MCP Full Access. CJA lists 27, of which five do. Every other tool accepts either item.

Neither reference lists a delete tool, although both release notes say Full Access keeps "tools that create, change, or delete components"; the FAQ answers "Not currently" to admin changes such as editing data views.

The row I would watch is upsertAudience. A CJA audience, per Adobe’s audience documentation (October 9, 2026), is something you "create and publish" to "Real-Time Customer Profile in Adobe Experience Platform for customer targeting and personalization". The reference does not say what the tool’s audiences do at creation, and I have not established it, but it is the one write whose output Adobe documents as publishable outside analytics.

How do you keep an agent read-only in Adobe Analytics and CJA?

Adobe documents this itself now. Its "Restrict write access" section, added on October 20, has three steps: make sure the user does not hold the product administrator role for that product, add the user to a profile containing MCP Read-only Access, and check all the user’s profiles for that product so none grants MCP Full Access. The procedure is Adobe’s, and I would follow it as written.

Four things I would add:

1. Run the union rule as an audit, not once. Profiles accumulate: someone added next quarter to a Full Access profile for another project becomes a writer, and their read-only profile does not say so. In Adobe Analytics, check each login company, since each product profile "applies to a single login company".
2. Give the agent its own identity. If the person who wants to connect Claude or ChatGPT is your Analytics product administrator, the read-only item cannot help; Adobe says so explicitly. Use the separate-admin-account pattern many identity teams already require: administer under one account, connect agents under another, and your logs gain an identity that means "agent". Privileged administration already sits in the governance phase of my martech stack planning guide; agent identities belong in the same review.
3. Do not forget the server-to-server account. Adobe’s OAuth guide describes connecting with "an OAuth server-to-server access token", and the permissions page says "Technical accounts used for OAuth server-to-server connections also need an MCP permission item." One FAQ sentence, live since May 18, disagrees: "User tokens are required; service tokens are not supported." Ask Adobe which is current before building on it.
4. Change what your audit records. My martech audit checklist tells you to note "the OAuth scopes granted" for every AI connector. For these two servers the scopes say nothing. Record the product profiles, whether the account holds the product administrator role, and whether any profile carries MCP Full Access.

A budget note: the FAQ says "MCP report calls count toward your existing monthly report request allowance", so there is no separate meter, and it does not say what else draws on that allowance. I compared vendors’ published metering models in what one AI agent action actually costs.

Do Adobe’s own agent skills call write tools?

Adobe publishes agent skills in github.com/adobe/skills, which installs as a Claude Code plugin marketplace (/plugin marketplace add adobe/skills). Its adobe-analytics and adobe-cja plugins point at aa-mcp.adobe.io and cja-mcp.adobe.io and hold eleven SKILL.md files between them. I read all eleven on October 26, and none had changed on November 2. Ten never call a write tool. The eleventh, aa-conversion-funnel-analysis, calls upsertSegment to create step segments when none exist, and the guards on that call are two lines of text in the skill, the first of which reads "Only create new segments with explicit user confirmation."

Asking before writing is good practice. But those lines are instructions to a model. Under a read-only profile, Adobe documents the outcome: "Creating or updating a component fails with a permission error." What the model decides does not enter into it. Under a product administrator’s account, the instructions and whatever approval prompt the client shows are all that stand between the model and a new segment owned by that administrator’s account, and both live on the client side. An instruction is advice; a permission is enforcement. And the people with the most access are the ones to whom only the advice applies.

Which Adobe MCP servers are read-only, and where is it set?

As of November 2, 2026, Adobe documents its Journey Optimizer and Real-Time CDP MCP servers as read-only betas, Adobe Analytics and CJA as an Admin Console permission item, Workfront as instance switches and Marketo Engage as the role of its API-only user. Target’s two pages differ; for AEM, Cloud Manager and the Marketing Agent server, Adobe states no read-only control I could find. I sent unauthenticated requests to all ten endpoints in Adobe’s catalogue on November 2, 2026, at 2:49 p.m. in Montréal (19:49 UTC, by the servers’ Date headers). All ten answered 401. Advertised metadata is not behaviour: nothing here shows what a server does after you sign in.

Four rows need a sentence each, and one route needs a note.

Target. Adobe’s catalogue (September 16) says "public beta: tools are read-only, write tools are planned for general availability". Target’s own MCP overview (September 28) says the server "exposes 62 tools across 11 categories", with "Editor role or higher" required for write operations and Approver for activation. If you count on the Observer role to keep an agent read-only, confirm with Adobe which page is current.

AEM. Adobe documents no meaning for those scope pairs, and the list moves: it advertised one pair fewer on October 26. Its knowledge-base article ka-42245 (September 15) records that a Content (read-only) MCP server "exposes write operations" through two fragment tools, fixed by removing them "from the allowlist". A read-only label on a tool list is a configuration, not a permission.

Workfront (mcp.prod.us-west-2.aws.wfk8s.com/mcp/v1/workfront) is the only one of the ten whose protected-resource document names a protocol revision ("mcp_protocol_version": "2025-11-25"), and the only one where read-only is an instance switch: an administrator controls "Read-only MCP tools (enabled by default) and Write MCP tools (disabled by default)".

Marketo Engage has no OAuth discovery at all. Adobe’s setup page (October 27) has every client send static LaunchPoint credentials in X-Marketo-Client-Id, X-Marketo-Client-Secret and X-Marketo-Munchkin-Id headers; permissions are "inherited from the Marketo API-only user assigned to the customer’s LaunchPoint service". Adobe advises "a dedicated API user in Marketo with only the permissions required for your work"; I would use one per agent purpose, since everyone on the same credentials shares one identity in Marketo’s audit trail. Adobe rewrote the operations page on October 27. The version I read on October 26, dated October 7, listed eight delete_* operations beside "The AI system cannot use Delete or other destructive operations". The new one lists no operations and drops that sentence: the server "supports 182 operations", discovered through your AI assistant, and "Some operations that change or delete data require confirmation and additional access", without defining either. In a July 23, 2026 community thread where a user reported 14 listed tools missing, an Adobe Champion replied that "the following APIs have been intentionally left disabled due to their destructive nature", linking a May 20 Community Manager comment. Neither names the 14. I have not tested the generally available server.

The Coworker gateway. Adobe’s catalogue also lists Analytics and CJA as available "via CX Enterprise Coworker". The gateway endpoint, cx-coworker-gateway.adobe.io/mcp, answered my unauthenticated request on November 2 with 401 and a challenge, advertising openid, profile and email. Adobe’s gateway tool pages for Analytics and CJA (September 18, 2026) still say access "is controlled by the MCP Access permission". This post covers the direct aa-mcp and cja-mcp servers; whether the read-only item and the administrator rule apply the same way through the gateway is undocumented, so ask Adobe.

Since October 29, the same developer documentation also covers a server Adobe offers only through that gateway: Marketing Campaign Analytics, formerly Mix Modeler, at mca-mcp.adobe.io, "only available through Adobe CX Enterprise Coworker". Its tool reference lists 22 tools, among them create_scenario, trigger_scenario_evaluation and delete_scenario_plan, described as "Permanently delete a Marketing Campaign Analytics scenario" and called with confirm=true. None of the 22 has a "Required permission" line, and the permissions page still names only Adobe Analytics and CJA. The model supplies that argument itself, so, like the skill’s instruction above, it is a safeguard in the conversation, not a permission. On November 2, from my connection, the hostname resolved to a private address and did not answer, so I could not read its metadata.

My working take

The control is in the right place: a permission item checked on the server, as Adobe documents it, beats a read-only flag in a client’s configuration file. Adobe documented the exceptions and the procedure, eleven days after publishing the split page. I read the product-administrator exception as deliberate and defensible: administrators run the product, and an item that could lock them out would be worse.

The consequence is what gets missed. Nothing in the token or the consent screen says whether an agent can write; per Adobe’s documentation, the answer lies in the combination of profiles and roles in Admin Console. So the identity an agent runs under should be chosen for the agent, not borrowed from the most senior analyst who wanted to try it. My own site’s agent tools carry readOnlyHint: true; what keeps them safe is a path allowlist in the code, not the hint.

If I could ask Adobe for one change, it would be the pattern its AEM server’s scope names appear to follow (Adobe documents no meaning for them): a read scope on the token, so an administrator could connect an agent read-only without a second account, and the consent screen would say so.

What I do not know: how any of this behaves in a tenant; which of Adobe’s server-to-server statements is current; and whether the IMS setting that "blocks third-party app access by default", which the troubleshooting page refers to the Adobe account team, is the way to keep administrators’ agents off. Any of those would change this post, and I will date the change.

Frequently asked questions about read-only MCP access in Adobe Analytics

Does the Adobe Analytics MCP server have a read-only mode?

Yes, through a permission item, as of November 2, 2026. MCP Read-only Access, generally available on October 6, 2026 for Adobe Analytics and Customer Journey Analytics, allows finding components and running reports. It withholds upsertSegment, upsertCalculatedMetric, createDateRange and upsertProject, plus upsertAudience in CJA. An administrator assigns it in an Admin Console product profile; it is not a setting in the AI client.

Do Adobe Analytics product administrators need an MCP permission item?

No. Since Adobe’s documentation correction of October 20, 2026 (commit a486a37), Adobe Analytics and CJA product administrators "automatically receive full MCP access", and assigning them MCP Read-only Access does not restrict them. The superseded sentence, which said the requirement applied to administrators too, had been in Adobe’s documentation since April 17, 2026.

Which OAuth scopes does the Adobe Analytics MCP server request?

As advertised on November 2, 2026: openid, AdobeID and additional_info.projectedProductContext, and the same three for cja-mcp.adobe.io. None distinguishes reading from writing. Per Adobe’s documentation, product profiles and the product administrator role decide whether an agent can write, not the token.

Can an AI agent create a CJA audience with upsertAudience?

Only with MCP Full Access or as a CJA product administrator, as documented on November 2, 2026. The upsertAudience tool creates or updates a CJA audience, and Adobe documents CJA audiences as publishable to Real-Time Customer Profile in Adobe Experience Platform for targeting and personalization. That is the strongest reason to keep CJA agent accounts on MCP Read-only Access.

What does the Omni.Tools.MCPAccess error mean?

Adobe’s troubleshooting page lists Omni.Tools.MCPAccess, with "Authorization failed" and "403 forbidden", under "Authorization with the MCP server failed. You can check your credentials and permissions." The possible cause given, as read on November 2, 2026: "Your account does not have MCP access for the selected product or organization." Confirm the right IMS organization is active, reconnect, and ask an administrator for access; the permissions page warns that "permission changes might not take effect immediately".

---

Disclosure: I am co-facilitating the Agentic Marketing Garage, Montreal, an Adobe User Groups event, on November 18, 2026. This post uses only public documentation and unauthenticated requests, and nobody at Adobe or at my employer reviewed it.

Sources I used

Verified at source: November 2, 2026.

• Adobe: "Set up permissions", Analytics MCP documentation, live version from commit a486a37, October 20, 2026
• Adobe: Analytics MCP frequently asked questions, October 20, 2026
• Adobe: Analytics MCP troubleshooting, October 20, 2026
• Adobe: "Use OAuth to connect", server-to-server requirements, October 9, 2026
• Adobe: Adobe Analytics MCP server tool reference, 23 tools, October 20, 2026
• Adobe: Customer Journey Analytics MCP server tool reference, 27 tools, October 20, 2026
• Adobe: Adobe Analytics MCP server changelog, October 5, 2026 entry
• Adobe: Customer Journey Analytics MCP server changelog, October 8 and October 19, 2026 entries
• Adobe: Marketing Campaign Analytics MCP server overview, Coworker only, October 29, 2026
• Adobe: Marketing Campaign Analytics MCP server tool reference, 22 tools, October 29, 2026
• GitHub, AdobeDocs/analytics-mcp: commit b22c35f, "Add permission condition", April 17, 2026
• GitHub, AdobeDocs/analytics-mcp: commit c15a5b1, "Permissions split", October 9, 2026
• GitHub, AdobeDocs/analytics-mcp: commit 73e2a82, "Changelog updates", October 9, 2026
• GitHub, AdobeDocs/analytics-mcp: commit a486a37, "AN-504019: Product administrator corrections", October 20, 2026
• Adobe: Adobe Analytics release notes, October 2026, last update October 29, 2026
• Adobe: Customer Journey Analytics release notes, October 2026, last update October 29, 2026
• Adobe: CJA audience publishing overview, October 9, 2026
• Adobe: MCP servers catalogue, CX Enterprise, September 16, 2026
• Adobe: Journey Optimizer MCP server (Beta), October 6, 2026
• Adobe: Real-Time CDP, work with MCP clients (Beta), October 21, 2026
• Adobe: Target MCP server overview (Beta), 62 tools, September 28, 2026
• Adobe: Target MCP server overview at the earlier path, 52 tools, April 21, 2026
• Adobe: "AEM as a Cloud Service: Prevent write operations on Content (read-only) MCP Server", KB ka-42245, September 15, 2026
• Adobe: Adobe Analytics tools in the CX Coworker Gateway, September 18, 2026
• Adobe: Customer Journey Analytics tools in the CX Coworker Gateway, September 18, 2026
• Adobe: configure the Workfront MCP server, October 27, 2026
• Adobe: Marketo Engage MCP server, October 27, 2026
• Adobe: Marketo Engage MCP operations, 182 operations, October 27, 2026
• Adobe Experience League Community: "14 MCP Tools Listed on Adobe’s Official Docs — But Not Available in the MCP Server!", July 23, 2026
• Adobe Experience League Community: "Marketo’s MCP vs REST API", Community Manager comment of May 20, 2026
• GitHub, adobe/skills: "Adobe Skills for AI Coding Agents" (README), read November 2, 2026
• GitHub, adobe/skills: aa-conversion-funnel-analysis SKILL.md, unchanged since May 29, 2026
• Adobe Analytics MCP protected-resource metadata, fetched November 2, 2026
• Adobe Analytics MCP authorization-server metadata, fetched November 2, 2026
• CJA MCP protected-resource metadata, fetched November 2, 2026
• CX Coworker gateway protected-resource metadata, fetched November 2, 2026
• IETF: RFC 9728, OAuth 2.0 Protected Resource Metadata, April 2025