diff --git a/scripts/test-mcp.mjs b/scripts/test-mcp.mjs
index bb08a7e1..d053d473 100644
--- a/scripts/test-mcp.mjs
+++ b/scripts/test-mcp.mjs
@@ -80,19 +80,34 @@ sqlite.run(
   ["nb_other", "ws_other", "Private", 10],
 );
 
-const token = "edgeever_mcp_test_token";
-const tokenHash = new Bun.CryptoHasher("sha256").update(token).digest("hex");
+// Simulate a token created before migration 0007 began retaining token plaintext.
+// Upgraded rows have a valid hash and their original granular scopes, while
+// token_value remains NULL and therefore cannot be copied again from the UI.
+const legacyToken = "edgeever_mcp_test_token";
+const legacyTokenHash = new Bun.CryptoHasher("sha256").update(legacyToken).digest("hex");
+const legacyScopes = [
+  "read:notebooks",
+  "write:notebooks",
+  "read:memos",
+  "write:memos",
+  "read:resources",
+  "read:tags",
+];
 sqlite.run(
-  "INSERT INTO api_tokens (id, workspace_id, name, token_hash, token_value, scopes_json) VALUES (?, ?, ?, ?, ?, ?)",
+  "INSERT INTO api_tokens (id, workspace_id, name, token_hash, scopes_json) VALUES (?, ?, ?, ?, ?)",
   [
     "tok_test",
     "ws_default",
-    "MCP regression",
-    tokenHash,
-    token,
-    JSON.stringify(["read:notebooks", "write:notebooks", "read:memos", "write:memos", "read:resources", "read:tags"]),
+    "MCP Token 1",
+    legacyTokenHash,
+    JSON.stringify(legacyScopes),
   ],
 );
+const storedLegacyToken = sqlite
+  .query("SELECT token_value, scopes_json FROM api_tokens WHERE id = ?")
+  .get("tok_test");
+assert.equal(storedLegacyToken.token_value, null);
+assert.deepEqual(JSON.parse(storedLegacyToken.scopes_json), legacyScopes);
 
 const env = {
   DB: new SqliteD1Database(sqlite),
@@ -105,7 +120,7 @@ const fetchMcp = (payload, options = {}) =>
     new Request("https://edgeever.test/mcp", {
       method: options.method ?? "POST",
       headers: {
-        ...(options.auth === false ? {} : { Authorization: `Bearer ${token}` }),
+        ...(options.auth === false ? {} : { Authorization: `Bearer ${legacyToken}` }),
         Accept: "application/json, text/event-stream",
         "Content-Type": "application/json",
         ...(options.headers ?? {}),