🔏 fix: Enforce MCP Server Authorization on Agent Tool Persistence

[danny-avila]

Summary

Closes an authorization bypass where agent create, update, duplicate, and revert paths accepted arbitrary MCP tool strings without verifying the requesting user's access to the referenced MCP servers. A crafted identifier like anything_mcp_<targetServer> would persist targetServer into the agent's mcpServerNames array, granting consumeOnly access via hasAccessViaAgent() to a server the user was never authorized to use.

• Adds filterAuthorizedTools() that validates each MCP tool string against the user's accessible server configs via getMCPServersRegistry().getAllServerConfigs(userId) before persisting; non-MCP tools continue to be validated against the global tool cache and systemTools as before.
• Wraps registry access in a try/catch so instances without MCP configured gracefully reject all MCP tool strings instead of propagating an uninitialized singleton error as a 500.
• Implements single-pass lazy-fetch: the registry is queried at most once per call, only upon encountering the first MCP tool string, with undefined as the unfetched sentinel.
• Guards updateAgentHandler by diffing incoming tools against existingAgent.tools — only newly added MCP tools are validated, preserving tools already on the agent that a collaborating editor may not have direct access to.
• Guards revertAgentVersionHandler: filters unauthorized MCP tools from the restored version snapshot and re-persists via updateAgent when tools are stripped, ensuring the response reflects the committed DB state.
• Emits logger.warn for every rejected MCP tool (including tool name, server name, and user ID) and on registry unavailability, establishing an audit trail for adversarial input patterns.
• Exports filterAuthorizedTools from module.exports for direct unit testing without handler overhead.

Change Type

• Bug fix (non-breaking change which fixes an issue)

Testing

19 new tests in api/server/controllers/agents/filterAuthorizedTools.spec.js using MongoMemoryServer with the real Agent model and schema — no mocks for DB logic.

Unit tests for filterAuthorizedTools (9 cases):

• Authorized MCP tools kept, unauthorized stripped
• System tools bypass registry entirely
• No MCP tools in payload skips registry call
• Registry uninitialized falls back to {}, returns only non-MCP tools, no 500
• Mixed authorized/unauthorized/system tools produce correct filtered order
• Empty array, null/undefined entries handled without throws
• Correct userId forwarded to getAllServerConfigs
• Registry called exactly once regardless of MCP tool count (lazy-fetch guard)

Handler integration tests (10 cases across 4 paths):

• createAgentHandler: unauthorized MCP tools stripped from response and DB; no 500 on uninitialized registry; mcpServerNames persisted only for authorized servers
• updateAgentHandler: existing MCP tools preserved when editor lacks direct access; newly added unauthorized tools stripped; newly added authorized tools accepted; registry not queried when no new MCP tools present
• duplicateAgentHandler: unauthorized MCP tools stripped from cloned agent response and DB; mcpServerNames on duplicate contains only authorized servers
• revertAgentVersionHandler: unauthorized tools stripped after revert, DB state confirmed via Agent.findOne; authorized tools survive revert

Test Configuration

cd api && npx jest filterAuthorizedTools.spec --testTimeout=30000

All 19 new tests pass. All 49 existing v1.spec.js tests pass.

Checklist

• My code adheres to this project's style guidelines
• I have performed a self-review of my own code
• I have commented in any complex areas of my code
• My changes do not introduce new warnings
• I have written tests demonstrating that my changes are effective or that my feature works
• Local unit tests pass with my changes

[Copilot]

Pull request overview

Fixes an authorization gap in the agent create/update/duplicate controller paths where arbitrary MCP tool identifiers could be persisted without verifying the user is allowed to reference the embedded MCP server name, potentially granting unintended MCP “consumeOnly” access via stored mcpServerNames.

Changes:

• Introduces filterAuthorizedTools() to validate tool identifiers, including MCP tool strings against getMCPServersRegistry().getAllServerConfigs(userId).
• Applies the filtering on agent create, update, and duplicate flows before persisting tools.
• Adds MCP registry access to the agents controller.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.