>_
.issue.db
/highway
Dashboard
Issues
Memory
Lessons
Audit Log
New Issue
Edit Issue #1027
Update issue details
Title *
Description
Found during #1001: GET/POST /api/v1/mcp/servers and DELETE /api/v1/mcp/servers/<name> (api/mcp_registry.py) check only g.tenant_id. Any member of a tenant, including a viewer, can register a server (and its bearer token) or remove one. EARS: If the caller lacks the manage permission for integrations/secrets in the tenant, then the MCP server routes shall return 403 before any DB work.
Priority
Low
Medium
High
Critical
Status
Open
In Progress
Closed
Won't Do
Due Date (YYYY-MM-DD)
Tags (comma separated)
Related Issues (IDs)
Enter IDs of issues related to this one. They will be linked as 'related'.
Update Issue
Cancel