Add support for MCP scopes & tool permissions#1266
Conversation
jsourcebot
commented
Jun 3, 2026
jsourcebot
commented
- We now support the ability for an admin the set the scopes of a connector which allows proper support for servers like slack or GitHub.
- Scopes can be modified by the admin which will invalidate all existing tokens
- Admin can now configure per tool permissions for a given connector
- Per connector/user tools are cached on redis with 1h TTL. This means a user engaging in a chat does not have to live refetch all the tools for all the connectors they have access to on every question they ask.
…te react query cache instead
…user, 1h time out
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@jsourcebot your pull request is missing a changelog! |
| @@ -0,0 +1,43 @@ | |||
| /* | |||
There was a problem hiding this comment.
do we want to collapse this into the existing migration file?
| serverId: string, | ||
| tools: { toolName: string; permission: McpServerToolPermission }[], | ||
| ) => { | ||
| const parsed = updateMcpServerToolPermissionsSchema.safeParse({ serverId, tools }); |
There was a problem hiding this comment.
why do we need to parse the inputs here? Presumably since this is a server action, they are already well typed?
| async function getCachedListTools(cacheKey: string): Promise<ListToolsResult | undefined> { | ||
| try { | ||
| const cached = await redis.get(cacheKey); | ||
| return cached ? JSON.parse(cached) as ListToolsResult : undefined; |
There was a problem hiding this comment.
could there be a case where the ListToolsResult type can change? Do we need to do some schema validation here?
| /// Lifetime tool call counters for an MCP server. | ||
| model McpServerToolCallCount { | ||
| /// OAuth scope configuration for an MCP server. | ||
| model McpServerScope { |
There was a problem hiding this comment.
rename to McpServerOauthScope
2 participants
