fix(mcp): scope operation provenance to MCP delegations

Author: TheodoreSpeaks

apps/sim/lib/internal/principals/executor.test.ts

@@ -81,16 +81,47 @@ describe('createExecutorPrincipalFromExecutionContext', () => {
     )
   })
 
-  it('binds MCP policy provenance from the trusted execution context', async () => {
+  it.each(['sim:mcp-servers', 'sim:managed-mcp-credentials'])(
+    'binds MCP policy provenance from the trusted execution context for %s',
+    async (audience) => {
+      const principal = await createExecutorPrincipalFromExecutionContext({
+        context: executionContext({
+          mcpBlockId: 'saved-block',
+          executorDelegationOrigin: { subjectUserId: 'user-origin', workflowId: 'workflow-origin' },
+        }),
+        audience,
+        resourceScope: { mcpServerId: 'server-1' },
+      })
+      expect(principal.resourceScope).toEqual({
+        mcpBlockId: 'saved-block',
+        mcpServerId: 'server-1',
+      })
+    }
+  )
+
+  it('keeps credential lookup unscoped when its block has MCP provenance metadata', async () => {
     const principal = await createExecutorPrincipalFromExecutionContext({
       context: executionContext({
-        mcpBlockId: 'saved-block',
+        mcpBlockId: 'credential-block',
         executorDelegationOrigin: { subjectUserId: 'user-origin', workflowId: 'workflow-origin' },
       }),
-      audience: 'sim:mcp-servers',
-      resourceScope: { mcpServerId: 'server-1' },
+      audience: 'sim:credential-groups',
+    })
+    expect(principal.resourceScope).toBeUndefined()
+    expect(principal.subjectUserId).toBe('user-origin')
+    expect(principal.delegationContext?.workflowId).toBe('workflow-origin')
+  })
+
+  it('preserves another operation’s resource scope without adding MCP policy metadata', async () => {
+    const principal = await createExecutorPrincipalFromExecutionContext({
+      context: executionContext({
+        mcpBlockId: 'agent-block',
+        executorDelegationOrigin: { subjectUserId: 'user-origin', workflowId: 'workflow-origin' },
+      }),
+      audience: 'sim:tables',
+      resourceScope: { tableId: 'table-1' },
     })
-    expect(principal.resourceScope).toEqual({ mcpBlockId: 'saved-block', mcpServerId: 'server-1' })
+    expect(principal.resourceScope).toEqual({ tableId: 'table-1' })
   })
 
   it('uses an explicit trusted execution deadline as the delegation expiry', async () => {

apps/sim/lib/internal/principals/executor.ts

@@ -1,8 +1,10 @@
 import { type DelegatedPrincipal, resolvePrincipalSubject } from '@sim/auth/principal'
 import { generateId } from '@sim/utils/id'
 import { bindInternalExecutorDelegation } from '@/lib/auth/internal-delegation'
+import { MANAGED_MCP_DELEGATION_AUDIENCE } from '@/lib/credentials/application/authorization'
 import { ExecutorDelegationOriginRequiredError } from '@/lib/internal/tool-operations/identity-faults'
 import type { InternalToolOperationContext } from '@/lib/internal/tool-operations/types'
+import { MCP_SERVER_DELEGATION_AUDIENCE } from '@/lib/mcp/application/authorization'
 import type { ExecutorDelegationOrigin } from '@/executor/types'
 
 const EXECUTOR_DELEGATION_TTL_MS = 5 * 60 * 1000
@@ -80,10 +82,14 @@ export async function createExecutorPrincipalFromExecutionContext({
 }: CreateExecutorPrincipalFromExecutionContextInput) {
   const origin = context.executorDelegationOrigin
   if (!origin) throw new ExecutorDelegationOriginRequiredError()
+  const isMcpAudience =
+    audience === MCP_SERVER_DELEGATION_AUDIENCE || audience === MANAGED_MCP_DELEGATION_AUDIENCE
   return createExecutorPrincipalFromDelegationOrigin(
     origin,
     audience,
-    context.mcpBlockId ? { ...resourceScope, mcpBlockId: context.mcpBlockId } : resourceScope,
+    isMcpAudience && context.mcpBlockId
+      ? { ...resourceScope, mcpBlockId: context.mcpBlockId }
+      : resourceScope,
     expiresAt,
     context.userId
   )