improvement(mcp): use literal tool IDs for Agent access controls

Author: TheodoreSpeaks

apps/docs/content/docs/agents/mcp.mdx

@@ -143,11 +143,15 @@ Choose an **Action**:
 - **List operations** discovers authorized operation names, descriptions, and input schemas without executing provider operations. Filter by name or description, set a page size from 1 to 100, and pass `nextCursor` into the next request while `hasMore` is true. An authorized list can be empty.
 - **Run operation** executes one exact operation name. Configured operations keep their generated argument fields. For an operation name resolved at runtime, supply a JSON arguments object; Sim validates it against the operation's discovered schema before execution.
 
-Server, managed connection, operation name, and arguments can use upstream block references. If you supply a managed connection separately, it must belong to the selected canonical server and be authorized for the workflow's workspace.
+**MCP Server** takes one shared-server ID or managed-connection ID. Sim resolves a managed connection's parent server internally and verifies workspace and credential access. Both actions accept the same ID; List operations returns that ID as `serverId`, alongside the discovered `operations` and pagination metadata.
+
+The standalone block's Basic fields select a configured connection and discovered operation. Advanced fields accept literal IDs/names or upstream references. A runtime server reference requires JSON arguments. Listing hides the operation and argument fields.
 
 ### Operations access
 
-The standalone MCP block and **MCP Server (Advanced)** Agent attachment share three access modes:
+The **MCP Server (Advanced)** Agent attachment takes a server/connection ID or upstream reference in a plain input. Its **Tool IDs** field accepts exact MCP tool names, such as `search_docs`, entered directly. These are the names returned by List operations, without a Sim server prefix. Neither field uses a server or operation catalog picker.
+
+Agent attachments have three access modes:
 
 | Mode | Behavior |
 | --- | --- |
@@ -157,11 +161,11 @@ The standalone MCP block and **MCP Server (Advanced)** Agent attachment share th
 
 New restricted configurations start with an empty explicit selection. Existing saved workflows retain their prior access through normalization, while current organization and credential authorization still apply.
 
-Operation restrictions are saved in workflow state, on the MCP block or Agent attachment. An operation must be available to the authorized credential and permitted by the saved restriction.
+Operation restrictions are saved in workflow state on the Agent attachment. Tool IDs are literal configuration, not upstream references or model arguments. An operation must be available to the resolved, authorized connection and permitted by the saved restriction. The standalone block runs its explicitly specified operation and has no separate access policy.
 
-Discovery filters the catalog shown to the editor and Agent. Execution checks the actual server, connection, and saved block restriction again before calling the provider. Missing or forbidden operations, unverifiable schemas, malformed arguments, and incorrect connection scopes fail the call. An Agent attachment with no permitted operations fails clearly.
+Discovery filters the tools exposed to the Agent. Execution checks the actual server, connection, and saved restriction again before calling the provider. Missing or forbidden operations, unverifiable schemas, malformed arguments, and incorrect connection scopes fail the call. An Agent attachment with no permitted operations fails clearly.
 
-Policies match exact MCP tool names on a canonical server. They do not inspect operation arguments: allowing a generic `execute_sql` operation does not limit which SQL it can execute.
+Policies match exact, case-sensitive MCP tool names on whichever authorized connection resolves at runtime. They do not inspect operation arguments: allowing a generic `execute_sql` operation does not limit which SQL it can execute.
 
 ## When to Use MCP Tool vs Agent
 

apps/docs/openapi-v2-workflows.json

@@ -8227,25 +8227,12 @@
                     "maxItems": 1000,
                     "type": "array",
                     "items": {
-                      "type": "object",
-                      "properties": {
-                        "serverId": {
-                          "type": "string",
-                          "minLength": 1,
-                          "maxLength": 256,
-                          "description": "Canonical MCP server identity, independent of the selected credential."
-                        },
-                        "name": {
-                          "type": "string",
-                          "minLength": 1,
-                          "maxLength": 256,
-                          "description": "Exact operation name returned by MCP discovery."
-                        }
-                      },
-                      "required": ["serverId", "name"],
-                      "additionalProperties": false
+                      "type": "string",
+                      "minLength": 1,
+                      "maxLength": 256,
+                      "description": "Exact MCP tool name on the resolved connection, without a Sim server prefix."
                     },
-                    "description": "Allowed server-scoped operation identities; an empty list grants no access."
+                    "description": "Allowed exact MCP tool names; an empty list grants no access."
                   }
                 },
                 "required": ["mode", "operations"],
@@ -8263,25 +8250,12 @@
                     "maxItems": 1000,
                     "type": "array",
                     "items": {
-                      "type": "object",
-                      "properties": {
-                        "serverId": {
-                          "type": "string",
-                          "minLength": 1,
-                          "maxLength": 256,
-                          "description": "Canonical MCP server identity, independent of the selected credential."
-                        },
-                        "name": {
-                          "type": "string",
-                          "minLength": 1,
-                          "maxLength": 256,
-                          "description": "Exact operation name returned by MCP discovery."
-                        }
-                      },
-                      "required": ["serverId", "name"],
-                      "additionalProperties": false
+                      "type": "string",
+                      "minLength": 1,
+                      "maxLength": 256,
+                      "description": "Exact MCP tool name on the resolved connection, without a Sim server prefix."
                     },
-                    "description": "Denied server-scoped operation identities; an empty list allows otherwise permitted tools."
+                    "description": "Denied exact MCP tool names; an empty list allows otherwise permitted tools."
                   }
                 },
                 "required": ["mode", "operations"],

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/tool-input/tool-input.tsx

@@ -2,7 +2,6 @@ import type React from 'react'
 import { memo, useCallback, useEffect, useMemo, useRef, useState } from 'react'
 import {
   Badge,
-  ChipCombobox,
   Combobox,
   type ComboboxOption,
   type ComboboxOptionGroup,
@@ -18,7 +17,6 @@ import { createLogger } from '@sim/logger'
 import { useParams } from 'next/navigation'
 import { McpIcon, WorkflowIcon } from '@/components/icons'
 import { McpOperationPolicyEditor } from '@/components/mcp/operation-policy-editor'
-import { getMcpTargetOptions } from '@/components/mcp/target-options'
 import { getManagedMcpConnectorIcon } from '@/lib/credential-groups/managed-mcp-connector-icons'
 import { MCP_SERVER_ADVANCED_TOOL_TYPE } from '@/lib/mcp/shared'
 import {
@@ -463,7 +461,7 @@ export const ToolInput = memo(function ToolInput({
   const shouldFetchCustomTools = !isPreview || hasReferenceOnlyCustomTools
   const { data: customTools = [] } = useCustomTools(shouldFetchCustomTools ? workspaceId : '')
 
-  const { mcpTools, isLoading: mcpLoading, error: mcpToolsError } = useMcpTools(workspaceId)
+  const { mcpTools, isLoading: mcpLoading } = useMcpTools(workspaceId)
   const mcpToolNamesById = useMemo(() => {
     const names = new Map<string, string>()
     for (const t of mcpTools) {
@@ -472,11 +470,7 @@ export const ToolInput = memo(function ToolInput({
     return names
   }, [mcpTools])
 
-  const {
-    data: mcpServers = [],
-    isLoading: mcpServersLoading,
-    error: mcpServersError,
-  } = useMcpToolServers(workspaceId)
+  const { data: mcpServers = [], isLoading: mcpServersLoading } = useMcpToolServers(workspaceId)
   const { data: storedMcpTools = [] } = useStoredMcpTools(workspaceId)
   const forceRefreshMcpTools = useForceRefreshMcpTools().mutate
   const { navigateToSettings } = useSettingsNavigation()
@@ -1549,7 +1543,7 @@ export const ToolInput = memo(function ToolInput({
                 isAdvancedMcpServer
                   ? ADVANCED_MCP_SERVER_TOOL_SCHEMA
                   : (mcpToolSchema ?? undefined),
-                formatParameterLabel
+                isAdvancedMcpServer ? () => 'MCP Server' : formatParameterLabel
               )
             : (subBlocksResult?.subBlocks ?? []).filter(
                 (sb) =>
@@ -1817,21 +1811,7 @@ export const ToolInput = memo(function ToolInput({
                   {isAdvancedMcpServer && (
                     <McpOperationPolicyEditor
                       value={tool.operationPolicy}
-                      operations={mcpTools
-                        .filter(
-                          (candidate) =>
-                            !tool.params?.serverId ||
-                            String(tool.params.serverId).includes('<') ||
-                            String(tool.params.serverId).includes('{{') ||
-                            candidate.serverId === tool.params.serverId
-                        )
-                        .map((candidate) => ({
-                          ...candidate,
-                          serverId: candidate.canonicalServerId ?? candidate.serverId,
-                        }))}
                       disabled={disabled || isPreview}
-                      isLoading={mcpDataLoading}
-                      error={mcpToolsError ?? mcpServersError?.message ?? null}
                       onChange={(operationPolicy) =>
                         setStoreValue(
                           selectedTools.map((candidate, index) =>
@@ -1874,28 +1854,6 @@ export const ToolInput = memo(function ToolInput({
 
                   {(() => {
                     const renderSubBlock = (sb: BlockSubBlockConfig): React.ReactNode => {
-                      if (isAdvancedMcpServer) {
-                        const options = getMcpTargetOptions(mcpServers)
-                        const value = tool.params?.[sb.id] ?? ''
-                        return (
-                          <div key={sb.id} className='flex flex-col gap-[9px]'>
-                            <span className='text-[var(--text-muted)] text-small'>MCP Server</span>
-                            <ChipCombobox
-                              options={options}
-                              value={
-                                options.find((option) => option.value === value)?.label ?? value
-                              }
-                              selectedValue={value}
-                              editable
-                              disabled={disabled || isPreview}
-                              isLoading={mcpServersLoading}
-                              error={mcpServersError?.message ?? null}
-                              placeholder='Select or enter an upstream reference'
-                              onChange={(next) => handleParamChange(toolIndex, sb.id, next)}
-                            />
-                          </div>
-                        )
-                      }
                       const effectiveParamId = sb.id
                       const canonicalId = toolCanonicalIndex?.canonicalIdBySubBlockId[sb.id]
                       const canonicalGroup = canonicalId

apps/sim/components/mcp/index.ts

@@ -1,5 +1,2 @@
-export {
-  type McpOperationChoice,
-  McpOperationPolicyEditor,
-} from '@/components/mcp/operation-policy-editor'
+export { McpOperationPolicyEditor } from '@/components/mcp/operation-policy-editor'
 export { getMcpTargetOptions } from '@/components/mcp/target-options'

apps/sim/components/mcp/operation-policy-editor.test.tsx

@@ -1,78 +1,83 @@
 /** @vitest-environment node */
 import type { ComponentProps } from 'react'
-import type { ChipCombobox, ChipDropdown } from '@sim/emcn'
+import type { ChipDropdown, TagInput } from '@sim/emcn'
 import { renderToStaticMarkup } from 'react-dom/server'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { combobox, dropdown } = vi.hoisted(() => ({
-  combobox: vi.fn<(props: ComponentProps<typeof ChipCombobox>) => null>(() => null),
+const { tagInput, dropdown } = vi.hoisted(() => ({
+  tagInput: vi.fn<(props: ComponentProps<typeof TagInput>) => null>(() => null),
   dropdown: vi.fn<(props: ComponentProps<typeof ChipDropdown>) => null>(() => null),
 }))
-vi.mock('@sim/emcn', () => ({
-  ChipCombobox: combobox,
-  ChipDropdown: dropdown,
-  OverflowText: () => null,
-}))
+vi.mock('@sim/emcn', () => ({ TagInput: tagInput, ChipDropdown: dropdown }))
 
 import { McpOperationPolicyEditor } from '@/components/mcp/operation-policy-editor'
 
 describe('MCP operations access editor', () => {
   beforeEach(() => vi.clearAllMocks())
 
-  it('keeps absent deny entries while browsing the authorized catalog', () => {
+  it('accepts exact names without a catalog and preserves absent deny entries', () => {
     const onChange = vi.fn()
     renderToStaticMarkup(
       <McpOperationPolicyEditor
-        value={{
-          mode: 'deny',
-          operations: [{ serverId: 'server-1', name: 'temporarily_missing' }],
-        }}
-        operations={[{ serverId: 'server-1', name: 'read', description: 'Read documents' }]}
+        value={{ mode: 'deny', operations: ['temporarily_missing'] }}
         onChange={onChange}
       />
     )
-    const props = combobox.mock.calls[0][0]
-    expect(props.multiSelectValues).toEqual(['["server-1","temporarily_missing"]'])
-    expect(props.options.map((option) => option.label)).toEqual(['read', 'temporarily_missing'])
-    props.onMultiSelectChange?.(['["server-1","temporarily_missing"]', '["server-1","read"]'])
+    const props = tagInput.mock.calls[0][0]
+    expect(props.items).toEqual([{ value: 'temporarily_missing', isValid: true }])
+    expect(props.onAdd('read')).toBe(true)
     expect(onChange).toHaveBeenCalledWith({
       mode: 'deny',
-      operations: [
-        { serverId: 'server-1', name: 'temporarily_missing' },
-        { serverId: 'server-1', name: 'read' },
-      ],
+      operations: ['temporarily_missing', 'read'],
     })
   })
 
-  it('starts explicit selection with no operations and allows clearing the selection', () => {
+  it('adds multiple literal names in one update and deduplicates them', () => {
     const onChange = vi.fn()
     renderToStaticMarkup(
       <McpOperationPolicyEditor
-        value={{ mode: 'allow', operations: [] }}
-        operations={[{ serverId: 'server-1', name: 'read' }]}
+        value={{ mode: 'allow', operations: ['read'] }}
         onChange={onChange}
       />
     )
-    expect(combobox.mock.calls[0][0].multiSelectValues).toEqual([])
-    combobox.mock.calls[0][0].onMultiSelectChange?.([])
-    expect(onChange).toHaveBeenCalledWith({ mode: 'allow', operations: [] })
+    tagInput.mock.calls[0][0].onAddMany?.(['read', ' write ', 'write'])
+    expect(onChange).toHaveBeenCalledWith({ mode: 'allow', operations: ['read', 'write'] })
   })
 
-  it('shows all three modes and honors readonly chrome', () => {
+  it('allows removing the last entry without switching to unrestricted access', () => {
+    const onChange = vi.fn()
     renderToStaticMarkup(
       <McpOperationPolicyEditor
-        value={{ mode: 'all' }}
-        operations={[]}
-        onChange={vi.fn()}
-        disabled
+        value={{ mode: 'allow', operations: ['read'] }}
+        onChange={onChange}
       />
     )
+    tagInput.mock.calls[0][0].onRemove('read', 0, true)
+    expect(onChange).toHaveBeenCalledWith({ mode: 'allow', operations: [] })
+  })
+
+  it.each(['<upstream.tool>', '{{tool}}', '', 'x'.repeat(257)])(
+    'refuses invalid tool ID %s',
+    (name) => {
+      const onChange = vi.fn()
+      renderToStaticMarkup(
+        <McpOperationPolicyEditor value={{ mode: 'allow', operations: [] }} onChange={onChange} />
+      )
+      expect(tagInput.mock.calls[0][0].onAdd(name)).toBe(false)
+      expect(onChange).not.toHaveBeenCalled()
+    }
+  )
+
+  it('shows all three modes and hides tool IDs for all permitted', () => {
+    renderToStaticMarkup(
+      <McpOperationPolicyEditor value={{ mode: 'all' }} onChange={vi.fn()} disabled />
+    )
     expect(dropdown.mock.calls[0][0].options.map((option) => option.label)).toEqual([
       'Only selected',
       'All except selected',
       'All permitted',
     ])
     expect(dropdown.mock.calls[0][0].disabled).toBe(true)
-    expect(combobox).not.toHaveBeenCalled()
+    expect(tagInput).not.toHaveBeenCalled()
   })
 })