feat(mcp): add manual tool runner

[reachjalil]

Summary

• let granted members inspect the live tool catalog for external MCP connections from Your Connections
• add a manual JSON tool runner that uses Den-managed shared or per-member credentials
• return diagnostic references and durations while keeping credentials, arguments, results, and tool names out of Den logs
• require explicit confirmation for provider-marked destructive tools and cap request bodies at 1 MB

Why

Teams need to verify a configured MCP connection and individual tool independently of agent chat.

Security boundaries

• connection lookup is tenant-scoped
• org/team/member access grants and staged rollout gating are enforced
• per-member credentials are isolated to the calling member
• the execution route is excluded from the agent-facing API catalog
• no database migration or credential ownership change

Verification

• ./bin/openwork-hub run mcp mcp-tool-runner -- pnpm --filter @openwork-ee/den-api exec bun test test/mcp-connections-tools.test.ts test/mcp-agent-config-policy.test.ts — 24 passed, 0 failed
• ./bin/openwork-hub run mcp mcp-tool-runner -- pnpm --filter @openwork-ee/den-web typecheck — passed
• live Den Web journey — passed: signed in to an isolated demo org, configured https://diagnostic.openworklabs.com/mcp, opened Your Connections, ran lookup_incidents with manual JSON, and received Tool completed, a request reference, and the synthetic ServiceNow profile result
• live log inspection — passed: the manual call log contained only connection/org/member IDs, timing, and diagnostic reference; it did not include the tool name, arguments, result, or credential
• git diff --check upstream/dev...HEAD — passed

Known upstream baseline

test/route-access-policy.test.ts currently fails on 11 unchanged routes in src/routes/org/microsoft-365.ts. This branch does not modify that file, and the new manual execution route includes the required explicit orgMemberRoute() policy marker.

Scope notes

• this runner covers external MCP connections; native Google Workspace and Microsoft 365 provider connections continue to use their separate Den-native tool surfaces
• no fraimz/video artifact was requested

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openwork-landing	Ready	Preview, Comment, Open in v0	Jul 14, 2026 7:59pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
openwork-diagnostics	Skipped		Jul 14, 2026 7:59pm

[vercel]

@reachjalil is attempting to deploy a commit to the Different AI Team on Vercel.

A member of the Team first needs to authorize it.

[benjaminshafii]

Heads-up: #2760 renames the diagnostic MCP's ServiceNow-profile tool from lookup_incidents to synthetic_servicenow_lookup (in ee/apps/diagnostics, which serves diagnostic.openworklabs.com) so mock tools can't be confused with real ServiceNow tools during debugging. Once both land and the diagnostics app redeploys, the manual verification steps here should target synthetic_servicenow_lookup.