fix(mcp): restrict manual tool execution to admins

[reachjalil]

Summary

• require workspace admin authorization for manual external MCP tool execution
• keep tool-catalog inspection available to granted members while returning 403 for regular-member execution attempts
• show the manual runner control only to admins
• preserve an accessible label and tooltip on the compact runner control
• update the API description and focused authorization coverage

Root cause

The manual execution endpoint used member-level authorization, so any granted workspace member could invoke an external MCP tool. These tools can perform mutating or destructive actions in connected systems, making direct manual execution an administrative diagnostic capability. The dashboard also exposed the execution control to non-admin members even though the safer boundary is admin-only.

Security boundaries

• manual execution now requires the workspace admin role
• tenant-scoped connection lookup and connection-access grants remain enforced
• execution uses only the calling admins connected credential
• the route remains excluded from the agent-facing API catalog
• credentials, tool names, arguments, and results remain absent from Den logs
• the existing request-size cap and secret-safe diagnostics remain unchanged

Verification

• 30 focused Den API policy, Microsoft 365 route, MCP execution, and agent-catalog tests passed
• Den Web TypeScript validation passed
• Linux and macOS OpenWork test workflows passed
• i18n audit passed
• Den API, Den Web, and inference artifact builds and health checks passed
• Helm validation passed
• the branch contains one commit touching only the API route, its focused tests, and the matching dashboard control

Manual verification

The authorization behavior is covered directly by focused tests: admins can execute, regular members receive 403, tenant isolation remains intact, and per-member credentials remain caller-scoped. The admin-versus-member browser visibility path was not rerun manually.

Risk and rollback

Regular members can still inspect the tool catalogs granted to them, but they can no longer execute tools manually. Reverting the single commit restores the previous member-level execution behavior.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openwork-landing	Ready	Preview, Comment, Open in v0	Jul 14, 2026 8:23pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
openwork-diagnostics	Skipped		Jul 14, 2026 8:23pm

[vercel]

@reachjalil is attempting to deploy a commit to the Different AI Team on Vercel.

A member of the Team first needs to authorize it.