@nocobase/ai 2.3.0-beta.23 → 2.3.0-beta.24

package/lib/mcp-manager/errors.d.ts

@@ -0,0 +1,12 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+export declare class MCPToolPermissionError extends Error {
+    readonly code: 'INVALID_PERMISSION' | 'TOOL_NOT_FOUND_OR_AMBIGUOUS';
+    constructor(code: 'INVALID_PERMISSION' | 'TOOL_NOT_FOUND_OR_AMBIGUOUS');
+}

package/lib/mcp-manager/errors.js

@@ -0,0 +1,45 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var errors_exports = {};
+__export(errors_exports, {
+  MCPToolPermissionError: () => MCPToolPermissionError
+});
+module.exports = __toCommonJS(errors_exports);
+const _MCPToolPermissionError = class _MCPToolPermissionError extends Error {
+  constructor(code) {
+    super(code);
+    this.code = code;
+    this.name = "MCPToolPermissionError";
+  }
+};
+__name(_MCPToolPermissionError, "MCPToolPermissionError");
+let MCPToolPermissionError = _MCPToolPermissionError;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  MCPToolPermissionError
+});

package/lib/mcp-manager/index.d.ts

@@ -17,7 +17,6 @@ export declare class DefaultMCPManager implements MCPManager {
     private mode;
     private client;
     private toolsMap;
-    private toolsPermissionMap;
     private readonly userContextClientManager;
     constructor(app: any);
     init(): Promise<void>;
@@ -29,11 +28,11 @@ export declare class DefaultMCPManager implements MCPManager {
     rebuildClient(): Promise<void>;
     getClient(): MultiServerMCPClient | null;
     getMCPToolsProvider(): DynamicToolsProvider;
-    private registerToolsFromMap;
-    private ensureToolPermission;
+    private getActiveToolsMap;
+    private readToolPermissions;
+    private resolveToolPermission;
     listMCPTools(ctx?: Context): Promise<Record<string, MCPToolEntry[]>>;
-    private formatMCPTools;
-    updateMCPToolPermission(toolName: string, permission: Permission): Promise<void>;
+    updateMCPToolPermission(toolName: string, permission: Permission, ctx?: Context): Promise<void>;
     clearUserContextCache(): Promise<void>;
     testConnection(options: MCPOptions, ctx?: Context): Promise<MCPTestResult>;
     private buildMCPConnection;
@@ -47,3 +46,4 @@ export declare class DefaultMCPManager implements MCPManager {
 }
 export declare function defineMCP(options: MCPOptions): MCPOptions;
 export * from './types';
+export * from './errors';

package/lib/mcp-manager/index.js

@@ -37,7 +37,9 @@ var import_utils = require("@nocobase/utils");
 var import_mcp_adapters = require("@langchain/mcp-adapters");
 var import_options_renderer = require("./options-renderer");
 var import_user_context_client_manager = require("./user-context-client-manager");
+var import_errors = require("./errors");
 __reExport(mcp_manager_exports, require("./types"), module.exports);
+__reExport(mcp_manager_exports, require("./errors"), module.exports);
 const _DefaultMCPManager = class _DefaultMCPManager {
   constructor(app) {
     this.app = app;
@@ -53,7 +55,6 @@ const _DefaultMCPManager = class _DefaultMCPManager {
   mode = "memory";
   client = null;
   toolsMap = {};
-  toolsPermissionMap = {};
   userContextClientManager;
   async init() {
     if (this.mode === "memory") {
@@ -115,8 +116,8 @@ const _DefaultMCPManager = class _DefaultMCPManager {
       } catch (e) {
       }
       this.client = null;
-      this.toolsMap = {};
     }
+    this.toolsMap = {};
     const entries = await this.listMCP({ enabled: true, useUserContext: false });
     if (entries.length === 0) {
       return;
@@ -129,12 +130,6 @@ const _DefaultMCPManager = class _DefaultMCPManager {
     const toolsMap = await this.client.initializeConnections();
     for (const [serverName, tools] of Object.entries(toolsMap)) {
       this.toolsMap[serverName] = tools;
-      for (const tool of tools) {
-        const toolName = `mcp-${serverName}-${tool.name}`;
-        if (!(toolName in this.toolsPermissionMap)) {
-          this.toolsPermissionMap[toolName] = tool.name.startsWith("get") ? "ALLOW" : "ASK";
-        }
-      }
     }
   }
   getClient() {
@@ -142,82 +137,110 @@ const _DefaultMCPManager = class _DefaultMCPManager {
   }
   getMCPToolsProvider() {
     return async (register, filter) => {
-      for (const [serverName, tools] of Object.entries(this.toolsMap)) {
-        this.registerToolsFromMap(register, serverName, tools);
-      }
-      if (!(filter == null ? void 0 : filter.ctx)) {
-        return;
-      }
-      const userToolsMap = await this.userContextClientManager.getToolsMap(filter.ctx);
-      for (const [serverName, tools] of Object.entries(userToolsMap)) {
-        this.registerToolsFromMap(register, serverName, tools);
+      const toolsMap = await this.getActiveToolsMap(filter == null ? void 0 : filter.ctx);
+      const permissions = await this.readToolPermissions(Object.keys(toolsMap));
+      for (const [serverName, tools] of Object.entries(toolsMap)) {
+        for (const tool of tools) {
+          register.registerTools({
+            scope: "GENERAL",
+            from: "mcp",
+            defaultPermission: this.resolveToolPermission(permissions, serverName, tool.name),
+            introduction: { title: tool.name, about: tool.description },
+            definition: {
+              name: `mcp-${serverName}-${tool.name}`,
+              description: tool.description || `MCP tool: ${tool.name} from ${serverName}`,
+              schema: tool.schema
+            },
+            invoke: /* @__PURE__ */ __name(async (ctx, args) => {
+              const entry = await this.getMCP(serverName);
+              if (!(entry == null ? void 0 : entry.enabled)) {
+                throw new Error(ctx.t("MCP server is disabled or deleted", { ns: "@nocobase/plugin-ai" }));
+              }
+              try {
+                return await tool.invoke(args);
+              } catch (error) {
+                return {
+                  status: "error",
+                  content: error instanceof Error ? error.message : "Tool invocation failed"
+                };
+              }
+            }, "invoke")
+          });
+        }
       }
     };
   }
-  registerToolsFromMap(register, serverName, tools) {
-    for (const tool of tools) {
-      const toolName = `mcp-${serverName}-${tool.name}`;
-      this.ensureToolPermission(toolName, tool.name);
-      const toolOptions = {
-        scope: "GENERAL",
-        from: "mcp",
-        defaultPermission: this.toolsPermissionMap[toolName],
-        introduction: {
-          title: tool.name,
-          about: tool.description
-        },
-        definition: {
-          name: toolName,
-          description: tool.description || `MCP tool: ${tool.name} from ${serverName}`,
-          schema: tool.schema
-        },
-        invoke: /* @__PURE__ */ __name(async (_ctx, args) => {
-          try {
-            const result = await tool.invoke(args);
-            return result;
-          } catch (error) {
-            return {
-              status: "error",
-              content: (error == null ? void 0 : error.message) || "Tool invocation failed"
-            };
-          }
-        }, "invoke")
-      };
-      register.registerTools(toolOptions);
-    }
+  async getActiveToolsMap(ctx) {
+    const entries = await this.listMCP({ enabled: true });
+    const sharedServers = new Set(entries.filter((entry) => !entry.useUserContext).map((entry) => entry.name));
+    const userServers = new Set(entries.filter((entry) => entry.useUserContext).map((entry) => entry.name));
+    const userToolsMap = ctx ? await this.userContextClientManager.getToolsMap(ctx) : {};
+    return {
+      ...Object.fromEntries(Object.entries(this.toolsMap).filter(([name]) => sharedServers.has(name))),
+      ...Object.fromEntries(Object.entries(userToolsMap).filter(([name]) => userServers.has(name)))
+    };
   }
-  ensureToolPermission(toolName, rawToolName) {
-    if (!(toolName in this.toolsPermissionMap)) {
-      this.toolsPermissionMap[toolName] = rawToolName.startsWith("get") ? "ALLOW" : "ASK";
+  async readToolPermissions(serverNames) {
+    if (!serverNames.length) {
+      return /* @__PURE__ */ new Map();
     }
+    const records = await this.collectionManager.getCollection("aiMcpToolPermissions").model.findAll({
+      where: { serverName: { [import_database.Op.in]: serverNames } }
+    });
+    return new Map(
+      records.map((record) => [
+        JSON.stringify([record.get("serverName"), record.get("toolName")]),
+        record.get("permission") === "ALLOW" ? "ALLOW" : "ASK"
+      ])
+    );
   }
-  async listMCPTools(ctx) {
-    const toolsMap = {
-      ...this.toolsMap,
-      ...ctx ? await this.userContextClientManager.getToolsMap(ctx) : {}
-    };
-    return this.formatMCPTools(toolsMap);
+  resolveToolPermission(permissions, serverName, toolName) {
+    return permissions.get(JSON.stringify([serverName, toolName])) ?? (toolName.startsWith("get") ? "ALLOW" : "ASK");
   }
-  formatMCPTools(toolsMap) {
+  async listMCPTools(ctx) {
+    const toolsMap = await this.getActiveToolsMap(ctx);
+    const permissions = await this.readToolPermissions(Object.keys(toolsMap));
     return Object.fromEntries(
       Object.entries(toolsMap).map(([serverName, tools]) => [
         serverName,
-        tools.map((tool) => {
-          const toolName = `mcp-${serverName}-${tool.name}`;
-          this.ensureToolPermission(toolName, tool.name);
-          return {
-            name: toolName,
-            title: tool.name,
-            description: tool.description,
-            serverName,
-            permission: this.toolsPermissionMap[toolName] ?? "ASK"
-          };
-        })
+        tools.map((tool) => ({
+          name: `mcp-${serverName}-${tool.name}`,
+          title: tool.name,
+          description: tool.description,
+          serverName,
+          permission: this.resolveToolPermission(permissions, serverName, tool.name)
+        }))
       ])
     );
   }
-  async updateMCPToolPermission(toolName, permission) {
-    this.toolsPermissionMap[toolName] = permission;
+  async updateMCPToolPermission(toolName, permission, ctx) {
+    if (typeof toolName !== "string" || !toolName.trim() || !["ASK", "ALLOW"].includes(permission)) {
+      throw new import_errors.MCPToolPermissionError("INVALID_PERMISSION");
+    }
+    const matches = Object.values(await this.listMCPTools(ctx)).flat().filter((tool2) => tool2.name === toolName);
+    if (matches.length !== 1) {
+      throw new import_errors.MCPToolPermissionError("TOOL_NOT_FOUND_OR_AMBIGUOUS");
+    }
+    const tool = matches[0];
+    await this.sequelize.transaction({ type: import_database.Transaction.TYPES.IMMEDIATE }, async (transaction) => {
+      const server = await this.aiMcpClientsModel.findOne({
+        where: { name: tool.serverName, enabled: true },
+        transaction,
+        lock: transaction.LOCK.UPDATE
+      });
+      if (!server) {
+        throw new import_errors.MCPToolPermissionError("TOOL_NOT_FOUND_OR_AMBIGUOUS");
+      }
+      const permissionModel = this.collectionManager.getCollection("aiMcpToolPermissions").model;
+      await permissionModel.upsert(
+        { serverName: tool.serverName, toolName: tool.title, permission },
+        {
+          transaction,
+          // Sequelize expects physical column names here, including when underscored is enabled.
+          conflictFields: ["serverName", "toolName"].map((name) => permissionModel.getAttributes()[name].field || name)
+        }
+      );
+    });
   }
   async clearUserContextCache() {
     await this.userContextClientManager.clear();
@@ -386,5 +409,6 @@ __name(defineMCP, "defineMCP");
 0 && (module.exports = {
   DefaultMCPManager,
   defineMCP,
-  ...require("./types")
+  ...require("./types"),
+  ...require("./errors")
 });

package/lib/mcp-manager/types.d.ts

@@ -18,7 +18,7 @@ export interface MCPManager extends MCPRegistration {
     getClient(): MultiServerMCPClient | null;
     getMCPToolsProvider(): DynamicToolsProvider;
     listMCPTools(ctx?: Context): Promise<Record<string, MCPToolEntry[]>>;
-    updateMCPToolPermission(toolName: string, permission: Permission): Promise<void>;
+    updateMCPToolPermission(toolName: string, permission: Permission, ctx?: Context): Promise<void>;
     clearUserContextCache(): Promise<void>;
 }
 export interface MCPRegistration {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/ai",
-  "version": "2.3.0-beta.23",
+  "version": "2.3.0-beta.24",
   "description": "",
   "license": "Apache-2.0",
   "main": "./lib/index.js",
@@ -17,10 +17,10 @@
     "@langchain/mcp-adapters": "1.1.3",
     "@langchain/ollama": "1.2.7",
     "@langchain/openai": "1.4.7",
-    "@nocobase/data-source-manager": "2.3.0-beta.23",
-    "@nocobase/logger": "2.3.0-beta.23",
-    "@nocobase/resourcer": "2.3.0-beta.23",
-    "@nocobase/utils": "2.3.0-beta.23",
+    "@nocobase/data-source-manager": "2.3.0-beta.24",
+    "@nocobase/logger": "2.3.0-beta.24",
+    "@nocobase/resourcer": "2.3.0-beta.24",
+    "@nocobase/utils": "2.3.0-beta.24",
     "d3-dsv": "2",
     "fast-glob": "^3.3.2",
     "flexsearch": "^0.8.2",
@@ -37,5 +37,5 @@
     "url": "git+https://github.com/nocobase/nocobase.git",
     "directory": "packages/ai"
   },
-  "gitHead": "53ad17b1117bae431d21cddaac7af7da484967fc"
+  "gitHead": "9780899cbaa5fc4657ac9ea16da2ac99978d748d"
 }

package/src/__tests__/mcp-permissions.test.ts

@@ -0,0 +1,439 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import type { Context } from '@nocobase/actions';
+import { Transaction } from '@nocobase/database';
+import { createMockServer, type MockServer } from '@nocobase/test';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { DefaultMCPManager, MCPToolPermissionError } from '../mcp-manager';
+import { DefaultToolsManager } from '../tools-manager';
+import type { Permission } from '../tools-manager/types';
+
+const mocks = vi.hoisted(() => ({ failInitialize: false, invoke: vi.fn(async () => 'done') }));
+vi.mock('@langchain/mcp-adapters', () => ({
+  MultiServerMCPClient: class {
+    constructor(private connections: Record<string, unknown>) {}
+    async initializeConnections() {
+      if (mocks.failInitialize) throw new Error('initialize failed');
+      return Object.fromEntries(
+        Object.keys(this.connections).map((name) => [
+          name,
+          ['get-data', 'write-data'].map((toolName) => ({
+            name: toolName,
+            description: toolName,
+            schema: {},
+            invoke: mocks.invoke,
+          })),
+        ]),
+      );
+    }
+    async close() {}
+  },
+}));
+
+describe.each([false, true])('global MCP tool permissions (underscored: %s)', (underscored) => {
+  let app: MockServer;
+  let storage: string;
+  let manager: DefaultMCPManager;
+  const clients = () => app.db.getRepository('aiMcpClients');
+  const permissions = () => app.db.getRepository('aiMcpToolPermissions');
+  const permissionModel = () => app.db.getModel('aiMcpToolPermissions');
+  const ctx = (id: number) => ({ state: { currentUser: { id } }, t: (key: string) => key }) as unknown as Context;
+  const toolsManager = (mcp = manager) => {
+    const tools = new DefaultToolsManager();
+    tools.registerDynamicTools(mcp.getMCPToolsProvider());
+    return tools;
+  };
+
+  beforeAll(async () => {
+    storage = await mkdtemp(join(tmpdir(), 'mcp-permissions-'));
+    vi.stubEnv('STORAGE_PATH', storage);
+    if ((process.env.DB_DIALECT || 'sqlite') === 'sqlite') {
+      vi.stubEnv('DB_SCHEMA', 'public');
+    }
+    app = await createMockServer({
+      plugins: ['nocobase'],
+      acl: true,
+      database: { storage: join(storage, 'test.sqlite'), underscored },
+    });
+    await app.pm.enable('ai');
+  });
+
+  beforeEach(async () => {
+    vi.restoreAllMocks();
+    mocks.invoke.mockClear();
+    mocks.failInitialize = false;
+    await clients().destroy({ filter: { name: { $ne: null } } });
+    await clients().create({
+      values: { name: 'test-server', transport: 'http', url: 'http://localhost/mcp' },
+    });
+    manager = new DefaultMCPManager(app);
+    await manager.init();
+    app.aiManager.mcpManager = manager;
+  });
+
+  afterEach(async () => {
+    await manager?.getClient()?.close();
+    await manager?.clearUserContextCache();
+  });
+
+  afterAll(async () => {
+    await app?.destroy();
+    vi.unstubAllEnvs();
+    await rm(storage, { recursive: true, force: true });
+  });
+
+  it('does not persist defaults during discovery, listing, registration or rebuilding', async () => {
+    expect((await manager.listMCPTools())['test-server'].map((tool) => tool.permission)).toEqual(['ALLOW', 'ASK']);
+    expect((await toolsManager().listTools()).map((tool) => tool.defaultPermission)).toEqual(['ALLOW', 'ASK']);
+    await manager.rebuildClient();
+    expect(await permissions().count()).toBe(0);
+  });
+
+  it('creates the permission collection on upgrade without changing existing MCP configuration', async () => {
+    await permissionModel().drop();
+    await app.upgrade();
+    expect(await permissions().count()).toBe(0);
+    expect(await app.aiManager.mcpManager.getMCP('test-server')).toMatchObject({
+      enabled: true,
+      transport: 'http',
+      url: 'http://localhost/mcp',
+    });
+    const upgraded = app.aiManager.mcpManager;
+    await upgraded.rebuildClient();
+    const attributes = permissionModel().getAttributes();
+    const indexFields = ['serverName', 'toolName'].map((name) => attributes[name].field || name);
+    expect(await app.db.sequelize.getQueryInterface().showIndex(permissionModel().getTableName())).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          unique: true,
+          fields: indexFields.map((attribute) => expect.objectContaining({ attribute })),
+        }),
+      ]),
+    );
+    await upgraded.updateMCPToolPermission('mcp-test-server-get-data', 'ASK');
+    expect(await permissions().count()).toBe(1);
+  });
+
+  it('restores both reversed defaults on a new manager and preserves explicit values equal to defaults', async () => {
+    await manager.updateMCPToolPermission('mcp-test-server-get-data', 'ASK');
+    await manager.updateMCPToolPermission('mcp-test-server-write-data', 'ALLOW');
+    const restarted = new DefaultMCPManager(app);
+    await restarted.init();
+    expect((await restarted.listMCPTools())['test-server'].map((tool) => tool.permission)).toEqual(['ASK', 'ALLOW']);
+    expect((await toolsManager(restarted).listTools()).map((tool) => tool.defaultPermission)).toEqual(['ASK', 'ALLOW']);
+    await restarted.updateMCPToolPermission('mcp-test-server-get-data', 'ALLOW');
+    await restarted.updateMCPToolPermission('mcp-test-server-write-data', 'ASK');
+    expect(await permissions().count()).toBe(2);
+    expect((await manager.listMCPTools())['test-server'].map((tool) => tool.permission)).toEqual(['ALLOW', 'ASK']);
+    await restarted.getClient()?.close();
+  });
+
+  it('refreshes permissions across managers on every subsequent tool resolution', async () => {
+    const other = new DefaultMCPManager(app);
+    await other.init();
+    const tools = toolsManager(other);
+    expect((await tools.getTools('mcp-test-server-get-data')).defaultPermission).toBe('ALLOW');
+    await manager.updateMCPToolPermission('mcp-test-server-get-data', 'ASK');
+    expect((await tools.getTools('mcp-test-server-get-data')).defaultPermission).toBe('ASK');
+    expect((await other.listMCPTools())['test-server'][0].permission).toBe('ASK');
+    await other.getClient()?.close();
+  });
+
+  it('preserves permissions on disable and prevents stale tools from being listed or invoked', async () => {
+    await manager.updateMCPToolPermission('mcp-test-server-get-data', 'ASK');
+    const tools = toolsManager();
+    const oldTool = await tools.getTools('mcp-test-server-get-data');
+    await clients().update({ filterByTk: 'test-server', values: { enabled: false } });
+    expect(await manager.listMCPTools()).toEqual({});
+    expect(await tools.listTools()).toEqual([]);
+    await expect(oldTool.invoke(ctx(1), {}, { toolCallId: 'test', writer: vi.fn() })).rejects.toThrow(
+      'MCP server is disabled or deleted',
+    );
+    expect(mocks.invoke).not.toHaveBeenCalled();
+    expect(await permissions().count()).toBe(1);
+    await clients().update({ filterByTk: 'test-server', values: { enabled: true } });
+    await manager.rebuildClient();
+    expect((await manager.listMCPTools())['test-server'][0].permission).toBe('ASK');
+  });
+
+  it('deletes permissions atomically and does not inherit them on same-name recreation', async () => {
+    await manager.updateMCPToolPermission('mcp-test-server-get-data', 'ASK');
+    const transaction = await app.db.sequelize.transaction();
+    await clients().destroy({ filterByTk: 'test-server', transaction });
+    expect(await permissions().count({ transaction })).toBe(0);
+    await transaction.rollback();
+    expect(await clients().count()).toBe(1);
+    expect(await permissions().count()).toBe(1);
+    await clients().destroy({ filterByTk: 'test-server' });
+    expect(await permissions().count()).toBe(0);
+    expect(await manager.listMCPTools()).toEqual({});
+    await clients().create({ values: { name: 'test-server', transport: 'http' } });
+    await manager.rebuildClient();
+    expect((await manager.listMCPTools())['test-server'][0].permission).toBe('ALLOW');
+  });
+
+  it('enforces cascading deletion even for a bulk model delete without individual hooks', async () => {
+    await manager.updateMCPToolPermission('mcp-test-server-get-data', 'ASK');
+    await app.db.getModel('aiMcpClients').destroy({ where: { name: 'test-server' }, hooks: false });
+    expect(await permissions().count()).toBe(0);
+  });
+
+  it('keeps the unique constraint for repeated and concurrent saves without overwriting other tools', async () => {
+    await Promise.all([
+      manager.updateMCPToolPermission('mcp-test-server-get-data', 'ASK'),
+      manager.updateMCPToolPermission('mcp-test-server-write-data', 'ALLOW'),
+    ]);
+    await Promise.all([
+      manager.updateMCPToolPermission('mcp-test-server-get-data', 'ALLOW'),
+      manager.updateMCPToolPermission('mcp-test-server-get-data', 'ASK'),
+    ]);
+    expect(await permissions().count()).toBe(2);
+    const stored = await permissions().findOne({ filter: { serverName: 'test-server', toolName: 'write-data' } });
+    expect(stored.get('permission')).toBe('ALLOW');
+  });
+
+  it('fails closed on database reads and never changes effective permission after a failed save', async () => {
+    const writeError = new Error('write failed');
+    const save = vi.spyOn(permissionModel(), 'upsert').mockRejectedValue(writeError);
+    await expect(manager.updateMCPToolPermission('mcp-test-server-get-data', 'ASK')).rejects.toBe(writeError);
+    expect(await permissions().count()).toBe(0);
+    expect((await manager.listMCPTools())['test-server'][0].permission).toBe('ALLOW');
+    save.mockRestore();
+    vi.spyOn(permissionModel(), 'findAll').mockRejectedValue(new Error('read failed'));
+    await expect(manager.listMCPTools()).rejects.toThrow('read failed');
+    await expect(toolsManager().listTools()).rejects.toThrow('read failed');
+  });
+
+  it('rejects invalid values, unknown tools and ambiguous public names without splitting hyphens', async () => {
+    for (const permission of ['DENY', '', null, {}, ['ASK']]) {
+      await expect(
+        manager.updateMCPToolPermission('mcp-test-server-get-data', permission as Permission),
+      ).rejects.toMatchObject({ name: 'MCPToolPermissionError', code: 'INVALID_PERMISSION' });
+    }
+    await expect(manager.updateMCPToolPermission('mcp-unknown-get-data', 'ASK')).rejects.toMatchObject({
+      name: 'MCPToolPermissionError',
+      code: 'TOOL_NOT_FOUND_OR_AMBIGUOUS',
+    });
+    await clients().create({ values: { name: 'test', transport: 'http' } });
+    Reflect.set(manager, 'toolsMap', {
+      'test-server': [{ name: 'get-data' }],
+      test: [{ name: 'server-get-data' }],
+    });
+    await expect(manager.updateMCPToolPermission('mcp-test-server-get-data', 'ASK')).rejects.toMatchObject({
+      name: 'MCPToolPermissionError',
+      code: 'TOOL_NOT_FOUND_OR_AMBIGUOUS',
+    });
+    expect(await permissions().count()).toBe(0);
+  });
+
+  it('returns typed business errors without translating or assigning an HTTP status', async () => {
+    const context = ctx(1);
+    const requestTranslation = vi.spyOn(context, 't');
+    const appTranslation = vi.spyOn(app.i18n, 't');
+    for (const requestContext of [undefined, context]) {
+      const invalid = await manager.updateMCPToolPermission('', 'ASK', requestContext).catch((error: unknown) => error);
+      expect(invalid).toBeInstanceOf(MCPToolPermissionError);
+      expect(invalid).toHaveProperty('code', 'INVALID_PERMISSION');
+      expect(invalid).not.toHaveProperty('status');
+      const unknown = await manager
+        .updateMCPToolPermission('mcp-unknown-get-data', 'ASK', requestContext)
+        .catch((error: unknown) => error);
+      expect(unknown).toBeInstanceOf(MCPToolPermissionError);
+      expect(unknown).toHaveProperty('code', 'TOOL_NOT_FOUND_OR_AMBIGUOUS');
+      expect(unknown).not.toHaveProperty('status');
+    }
+    expect(requestTranslation).not.toHaveBeenCalled();
+    expect(appTranslation).not.toHaveBeenCalled();
+    expect(await permissions().count()).toBe(0);
+  });
+
+  it('returns a business error if the server disappears before the transactional lookup', async () => {
+    vi.spyOn(app.db.getModel('aiMcpClients'), 'findOne').mockResolvedValueOnce(null);
+    await expect(manager.updateMCPToolPermission('mcp-test-server-get-data', 'ASK')).rejects.toMatchObject({
+      name: 'MCPToolPermissionError',
+      code: 'TOOL_NOT_FOUND_OR_AMBIGUOUS',
+    });
+    expect(await permissions().count()).toBe(0);
+  });
+
+  it('shares global permissions between users and restores user-context tools after manager recreation', async () => {
+    await clients().update({ filterByTk: 'test-server', values: { useUserContext: true } });
+    await manager.updateMCPToolPermission('mcp-test-server-get-data', 'ASK', ctx(1));
+    expect((await manager.listMCPTools(ctx(2)))['test-server'][0].permission).toBe('ASK');
+    const restarted = new DefaultMCPManager(app);
+    await restarted.init();
+    expect((await toolsManager(restarted).listTools({ ctx: ctx(2) }))[0].defaultPermission).toBe('ASK');
+    await restarted.updateMCPToolPermission('mcp-test-server-write-data', 'ALLOW', ctx(2));
+    expect((await manager.listMCPTools(ctx(1)))['test-server'][1].permission).toBe('ALLOW');
+    await clients().update({ filterByTk: 'test-server', values: { enabled: false } });
+    expect(await manager.listMCPTools(ctx(1))).toEqual({});
+    await restarted.clearUserContextCache();
+  });
+
+  it('does not overwrite explicit permissions during file configuration sync or tool disappearance', async () => {
+    await manager.updateMCPToolPermission('mcp-test-server-get-data', 'ASK');
+    await manager.registerMCP({
+      'test-server': { transport: 'http', url: 'http://localhost/mcp', fromFile: true },
+    });
+    await manager.registerMCP({
+      'test-server': { transport: 'http', url: 'http://localhost/mcp', fromFile: true },
+    });
+    await manager.rebuildClient();
+    expect((await manager.listMCPTools())['test-server'][0].permission).toBe('ASK');
+    Reflect.set(manager, 'toolsMap', { 'test-server': [] });
+    await manager.listMCPTools();
+    expect(await permissions().count()).toBe(1);
+  });
+
+  it('batches permission reads rather than issuing one query per tool', async () => {
+    const read = vi.spyOn(permissionModel(), 'findAll');
+    await manager.listMCPTools();
+    expect(read).toHaveBeenCalledTimes(1);
+    read.mockClear();
+    await toolsManager().listTools();
+    expect(read).toHaveBeenCalledTimes(1);
+  });
+
+  it('does not save a permission when user-context tool discovery fails', async () => {
+    await clients().update({ filterByTk: 'test-server', values: { useUserContext: true } });
+    mocks.failInitialize = true;
+    await expect(manager.updateMCPToolPermission('mcp-test-server-get-data', 'ASK', ctx(1))).rejects.toMatchObject({
+      name: 'MCPToolPermissionError',
+      code: 'TOOL_NOT_FOUND_OR_AMBIGUOUS',
+    });
+    expect(await permissions().count()).toBe(0);
+  });
+
+  it('allows permissions for deployment-managed stdio tools without changing their connection', async () => {
+    await clients().update({
+      filterByTk: 'test-server',
+      values: { transport: 'stdio', command: 'trusted', fromFile: true },
+    });
+    const agent = await app.agent().login(1);
+    const response = await agent.resource('aiMcpClients').updateToolPermission({
+      values: { toolName: 'mcp-test-server-get-data', permission: 'ASK', command: 'untrusted' },
+    });
+    expect(response.status).toBe(200);
+    expect((await manager.getMCP('test-server')).command).toBe('trusted');
+    expect((await manager.listMCPTools())['test-server'][0].permission).toBe('ASK');
+  });
+
+  it('persists administrator API changes, protects ACL and does not change file-managed connection fields', async () => {
+    await clients().update({ filterByTk: 'test-server', values: { fromFile: true } });
+    const admin = await app.agent().login(1);
+    const resource = admin.resource('aiMcpClients');
+    const response = await resource.updateToolPermission({
+      values: {
+        toolName: 'mcp-test-server-get-data',
+        permission: 'ASK',
+        command: 'untrusted',
+        url: 'http://attacker.invalid',
+        fromFile: false,
+      },
+    });
+    expect(response.status).toBe(200);
+    expect(response.body.data).toEqual({ success: true });
+    const list = await resource.listTools();
+    expect(list.body.data['test-server'][0].permission).toBe('ASK');
+    expect(await clients().count()).toBe(1);
+    const server = await clients().findOne({ filterByTk: 'test-server' });
+    expect(server.get('fromFile')).toBe(true);
+    expect(server.get('url')).toBe('http://localhost/mcp');
+    expect(server.get('command')).toBeFalsy();
+
+    const user = await app.db.getRepository('users').create({ values: { username: 'mcp-permission-member' } });
+    const member = await app.agent().login(user.id);
+    const denied = await member.resource('aiMcpClients').updateToolPermission({
+      values: { toolName: 'mcp-test-server-get-data', permission: 'ALLOW' },
+    });
+    expect(denied.status).toBe(403);
+    const guest = await app
+      .agent()
+      .resource('aiMcpClients')
+      .updateToolPermission({
+        values: { toolName: 'mcp-test-server-get-data', permission: 'ALLOW' },
+      });
+    expect([401, 403]).toContain(guest.status);
+    const generic = await member.resource('aiMcpToolPermissions').create({
+      values: { serverName: 'test-server', toolName: 'write-data', permission: 'ALLOW' },
+    });
+    expect(generic.status).toBe(403);
+    expect((await manager.listMCPTools())['test-server'][0].permission).toBe('ASK');
+    expect(await permissions().count()).toBe(1);
+  });
+
+  it('rejects malformed API input and localizes errors without writing records', async () => {
+    const agent = await app.agent().login(1);
+    for (const values of [
+      {},
+      { toolName: '', permission: 'ALLOW' },
+      { toolName: '  ', permission: 'ALLOW' },
+      { toolName: {}, permission: 'ALLOW' },
+      { toolName: 'mcp-test-server-get-data', permission: 'DENY' },
+      { toolName: 'mcp-test-server-get-data', permission: ['ASK'] },
+    ]) {
+      expect((await agent.resource('aiMcpClients').updateToolPermission({ values })).status).toBe(400);
+    }
+    const unknown = await agent.resource('aiMcpClients').updateToolPermission({
+      values: { toolName: 'mcp-unknown-get-data', permission: 'ALLOW' },
+    });
+    expect(unknown.status).toBe(400);
+    expect(unknown.body.errors[0].message).toBe('MCP tool not found or ambiguous');
+    const prefix = (app.resourcer.options.prefix || '').replace(/\/$/, '');
+    const response = await agent.post(`${prefix}/aiMcpClients:updateToolPermission`).set('X-Locale', 'zh-CN').send({});
+    expect(response.status).toBe(400);
+    expect(response.body.errors[0].message).toBe('MCP 工具权限配置无效');
+    expect(await permissions().count()).toBe(0);
+  });
+
+  it.each([
+    ['INVALID_PERMISSION', 'MCP 工具权限配置无效'],
+    ['TOOL_NOT_FOUND_OR_AMBIGUOUS', 'MCP 工具不存在或标识不唯一'],
+  ] as const)('translates the %s manager business error into an HTTP 400', async (code, message) => {
+    vi.spyOn(manager, 'updateMCPToolPermission').mockRejectedValue(new MCPToolPermissionError(code));
+    const agent = await app.agent().login(1);
+    const prefix = (app.resourcer.options.prefix || '').replace(/\/$/, '');
+    const response = await agent
+      .post(`${prefix}/aiMcpClients:updateToolPermission`)
+      .set('X-Locale', 'zh-CN')
+      .send({ toolName: 'mcp-test-server-get-data', permission: 'ASK' });
+    expect(response.status).toBe(400);
+    expect(response.body.errors[0].message).toBe(message);
+    expect(await permissions().count()).toBe(0);
+  });
+
+  it('returns an API failure after a database write or commit failure instead of reporting success', async () => {
+    const agent = await app.agent().login(1);
+    const writeError = Object.assign(new Error('write failed'), { code: 'INVALID_PERMISSION' });
+    const save = vi.spyOn(permissionModel(), 'upsert').mockRejectedValue(writeError);
+    const response = await agent.resource('aiMcpClients').updateToolPermission({
+      values: { toolName: 'mcp-test-server-get-data', permission: 'ASK' },
+    });
+    expect(response.status).toBe(500);
+    save.mockRestore();
+    vi.spyOn(Transaction.prototype, 'commit').mockImplementationOnce(async function (this: Transaction) {
+      await this.rollback();
+      throw new Error('commit failed');
+    });
+    const commitFailure = await agent.resource('aiMcpClients').updateToolPermission({
+      values: { toolName: 'mcp-test-server-get-data', permission: 'ASK' },
+    });
+    expect(commitFailure.status).toBe(500);
+    expect(await permissions().count()).toBe(0);
+    expect((await manager.listMCPTools())['test-server'][0].permission).toBe('ALLOW');
+    vi.spyOn(permissionModel(), 'findAll').mockRejectedValue(new Error('read failed'));
+    const readFailure = await agent.resource('aiMcpClients').updateToolPermission({
+      values: { toolName: 'mcp-test-server-get-data', permission: 'ASK' },
+    });
+    expect(readFailure.status).toBe(500);
+  });
+});

package/src/__tests__/mcp-user-context.test.ts

@@ -55,6 +55,11 @@ import { UserContextMCPClientManager } from '../mcp-manager/user-context-client-
 
 describe('user-bound MCP clients', () => {
   const createApp = () => ({
+    mainDataSource: {
+      collectionManager: {
+        getCollection: () => ({ model: { findAll: vi.fn().mockResolvedValue([]) } }),
+      },
+    },
     environment: {
       getVariables: () => ({
         MCP_HOST: 'mcp.example.test',

package/src/__tests__/mcp.test.ts

@@ -34,6 +34,8 @@ describe('MCP loader test cases', () => {
   beforeEach(async () => {
     storage = await mkdtemp(join(tmpdir(), 'mcp-persistence-'));
     vi.stubEnv('STORAGE_PATH', storage);
+    // SQLite fixtures must not inherit a PostgreSQL schema from the CI matrix.
+    vi.stubEnv('DB_SCHEMA', 'public');
     filePath = join(storage, 'ai', 'mcp', 'servers.json');
     await mkdir(join(storage, 'ai', 'mcp'), { recursive: true });
     app = await createMockServer({
@@ -165,6 +167,7 @@ describe('MCP loader test cases', () => {
   });
 
   it('should expose cached mcp tools and allow updating permissions', async () => {
+    await app.db.getRepository('aiMcpClients').create({ values: { name: 'weather', transport: 'http' } });
     Reflect.set(mcpManager, 'toolsMap', {
       weather: [
         {

package/src/mcp-manager/errors.ts

@@ -0,0 +1,15 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+export class MCPToolPermissionError extends Error {
+  constructor(readonly code: 'INVALID_PERMISSION' | 'TOOL_NOT_FOUND_OR_AMBIGUOUS') {
+    super(code);
+    this.name = 'MCPToolPermissionError';
+  }
+}

package/src/mcp-manager/index.ts

@@ -8,15 +8,16 @@
  */
 
 import { SequelizeCollectionManager } from '@nocobase/data-source-manager';
-import { Op } from '@nocobase/database';
+import { Op, Transaction } from '@nocobase/database';
 import { Registry } from '@nocobase/utils';
 import { MultiServerMCPClient, StdioConnection, StreamableHTTPConnection } from '@langchain/mcp-adapters';
 import { StructuredToolInterface } from '@langchain/core/tools';
 import { MCPEntry, MCPFilter, MCPManager, MCPOptions, MCPTestResult, MCPToolEntry } from './types';
-import type { DynamicToolsProvider, Permission, ToolsRegistration, ToolsOptions } from '../tools-manager/types';
+import type { DynamicToolsProvider, Permission, ToolsRegistration } from '../tools-manager/types';
 import type { Context } from '@nocobase/actions';
 import { normalizeMCPOptions, renderMCPOptions } from './options-renderer';
 import { UserContextMCPClientManager } from './user-context-client-manager';
+import { MCPToolPermissionError } from './errors';
 
 export class DefaultMCPManager implements MCPManager {
   private readonly mcpRegistry = new Registry<MCPEntry>({ override: true });
@@ -24,7 +25,6 @@ export class DefaultMCPManager implements MCPManager {
   private mode = 'memory';
   private client: MultiServerMCPClient | null = null;
   private toolsMap: Record<string, StructuredToolInterface[]> = {};
-  private toolsPermissionMap: Record<string, Permission> = {};
   private readonly userContextClientManager: UserContextMCPClientManager;
 
   constructor(private readonly app: any) {
@@ -102,8 +102,8 @@ export class DefaultMCPManager implements MCPManager {
         // Ignore close errors
       }
       this.client = null;
-      this.toolsMap = {};
     }
+    this.toolsMap = {};
 
     // Get all enabled MCP entries
     const entries = await this.listMCP({ enabled: true, useUserContext: false });
@@ -125,12 +125,6 @@ export class DefaultMCPManager implements MCPManager {
     // Cache tools for each server
     for (const [serverName, tools] of Object.entries(toolsMap)) {
       this.toolsMap[serverName] = tools as StructuredToolInterface[];
-      for (const tool of tools as StructuredToolInterface[]) {
-        const toolName = `mcp-${serverName}-${tool.name}`;
-        if (!(toolName in this.toolsPermissionMap)) {
-          this.toolsPermissionMap[toolName] = tool.name.startsWith('get') ? 'ALLOW' : 'ASK';
-        }
-      }
     }
   }
 
@@ -140,95 +134,123 @@ export class DefaultMCPManager implements MCPManager {
 
   getMCPToolsProvider(): DynamicToolsProvider {
     return async (register: ToolsRegistration, filter): Promise<void> => {
-      // Use cached tools from rebuildClient
-      for (const [serverName, tools] of Object.entries(this.toolsMap)) {
-        this.registerToolsFromMap(register, serverName, tools);
-      }
-
-      if (!filter?.ctx) {
-        return;
-      }
-
-      const userToolsMap = await this.userContextClientManager.getToolsMap(filter.ctx);
-      for (const [serverName, tools] of Object.entries(userToolsMap)) {
-        this.registerToolsFromMap(register, serverName, tools);
+      const toolsMap = await this.getActiveToolsMap(filter?.ctx);
+      const permissions = await this.readToolPermissions(Object.keys(toolsMap));
+      for (const [serverName, tools] of Object.entries(toolsMap)) {
+        for (const tool of tools) {
+          register.registerTools({
+            scope: 'GENERAL',
+            from: 'mcp',
+            defaultPermission: this.resolveToolPermission(permissions, serverName, tool.name),
+            introduction: { title: tool.name, about: tool.description },
+            definition: {
+              name: `mcp-${serverName}-${tool.name}`,
+              description: tool.description || `MCP tool: ${tool.name} from ${serverName}`,
+              schema: tool.schema,
+            },
+            invoke: async (ctx: Context, args: Parameters<typeof tool.invoke>[0]) => {
+              const entry = await this.getMCP(serverName);
+              if (!entry?.enabled) {
+                throw new Error(ctx.t('MCP server is disabled or deleted', { ns: '@nocobase/plugin-ai' }));
+              }
+              try {
+                return await tool.invoke(args);
+              } catch (error: unknown) {
+                return {
+                  status: 'error' as const,
+                  content: error instanceof Error ? error.message : 'Tool invocation failed',
+                };
+              }
+            },
+          });
+        }
       }
     };
   }
 
-  private registerToolsFromMap(
-    register: ToolsRegistration,
-    serverName: string,
-    tools: StructuredToolInterface[],
-  ): void {
-    for (const tool of tools) {
-      const toolName = `mcp-${serverName}-${tool.name}`;
-      this.ensureToolPermission(toolName, tool.name);
-      const toolOptions: ToolsOptions = {
-        scope: 'GENERAL',
-        from: 'mcp',
-        defaultPermission: this.toolsPermissionMap[toolName],
-        introduction: {
-          title: tool.name,
-          about: tool.description,
-        },
-        definition: {
-          name: toolName,
-          description: tool.description || `MCP tool: ${tool.name} from ${serverName}`,
-          schema: tool.schema,
-        },
-        invoke: async (_ctx: Context, args: any) => {
-          try {
-            const result = await tool.invoke(args);
-            return result;
-          } catch (error: any) {
-            return {
-              status: 'error' as const,
-              content: error?.message || 'Tool invocation failed',
-            };
-          }
-        },
-      };
-      register.registerTools(toolOptions);
-    }
+  private async getActiveToolsMap(ctx?: Context): Promise<Record<string, StructuredToolInterface[]>> {
+    // Connection caches are not configuration authorities, including on other application instances.
+    const entries = await this.listMCP({ enabled: true });
+    const sharedServers = new Set(entries.filter((entry) => !entry.useUserContext).map((entry) => entry.name));
+    const userServers = new Set(entries.filter((entry) => entry.useUserContext).map((entry) => entry.name));
+    const userToolsMap = ctx ? await this.userContextClientManager.getToolsMap(ctx) : {};
+    return {
+      ...Object.fromEntries(Object.entries(this.toolsMap).filter(([name]) => sharedServers.has(name))),
+      ...Object.fromEntries(Object.entries(userToolsMap).filter(([name]) => userServers.has(name))),
+    };
   }
 
-  private ensureToolPermission(toolName: string, rawToolName: string) {
-    if (!(toolName in this.toolsPermissionMap)) {
-      this.toolsPermissionMap[toolName] = rawToolName.startsWith('get') ? 'ALLOW' : 'ASK';
+  private async readToolPermissions(serverNames: string[]): Promise<Map<string, Permission>> {
+    if (!serverNames.length) {
+      return new Map();
     }
+    const records = await this.collectionManager.getCollection('aiMcpToolPermissions').model.findAll({
+      where: { serverName: { [Op.in]: serverNames } },
+    });
+    return new Map(
+      records.map((record) => [
+        JSON.stringify([record.get('serverName'), record.get('toolName')]),
+        record.get('permission') === 'ALLOW' ? 'ALLOW' : 'ASK',
+      ]),
+    );
   }
 
-  async listMCPTools(ctx?: Context): Promise<Record<string, MCPToolEntry[]>> {
-    const toolsMap = {
-      ...this.toolsMap,
-      ...(ctx ? await this.userContextClientManager.getToolsMap(ctx) : {}),
-    };
-
-    return this.formatMCPTools(toolsMap);
+  private resolveToolPermission(
+    permissions: Map<string, Permission>,
+    serverName: string,
+    toolName: string,
+  ): Permission {
+    return permissions.get(JSON.stringify([serverName, toolName])) ?? (toolName.startsWith('get') ? 'ALLOW' : 'ASK');
   }
 
-  private formatMCPTools(toolsMap: Record<string, StructuredToolInterface[]>): Record<string, MCPToolEntry[]> {
+  async listMCPTools(ctx?: Context): Promise<Record<string, MCPToolEntry[]>> {
+    const toolsMap = await this.getActiveToolsMap(ctx);
+    const permissions = await this.readToolPermissions(Object.keys(toolsMap));
     return Object.fromEntries(
       Object.entries(toolsMap).map(([serverName, tools]) => [
         serverName,
-        tools.map((tool) => {
-          const toolName = `mcp-${serverName}-${tool.name}`;
-          this.ensureToolPermission(toolName, tool.name);
-          return {
-            name: toolName,
-            title: tool.name,
-            description: tool.description,
-            serverName,
-            permission: this.toolsPermissionMap[toolName] ?? 'ASK',
-          };
-        }),
+        tools.map((tool) => ({
+          name: `mcp-${serverName}-${tool.name}`,
+          title: tool.name,
+          description: tool.description,
+          serverName,
+          permission: this.resolveToolPermission(permissions, serverName, tool.name),
+        })),
       ]),
     );
   }
 
-  async updateMCPToolPermission(toolName: string, permission: Permission): Promise<void> {
-    this.toolsPermissionMap[toolName] = permission;
+  async updateMCPToolPermission(toolName: string, permission: Permission, ctx?: Context): Promise<void> {
+    if (typeof toolName !== 'string' || !toolName.trim() || !['ASK', 'ALLOW'].includes(permission)) {
+      throw new MCPToolPermissionError('INVALID_PERMISSION');
+    }
+    // Resolve from metadata, never by splitting the public name: both identifiers may contain hyphens.
+    const matches = Object.values(await this.listMCPTools(ctx))
+      .flat()
+      .filter((tool) => tool.name === toolName);
+    if (matches.length !== 1) {
+      throw new MCPToolPermissionError('TOOL_NOT_FOUND_OR_AMBIGUOUS');
+    }
+    const tool = matches[0];
+    await this.sequelize.transaction({ type: Transaction.TYPES.IMMEDIATE }, async (transaction) => {
+      const server = await this.aiMcpClientsModel.findOne({
+        where: { name: tool.serverName, enabled: true },
+        transaction,
+        lock: transaction.LOCK.UPDATE,
+      });
+      if (!server) {
+        throw new MCPToolPermissionError('TOOL_NOT_FOUND_OR_AMBIGUOUS');
+      }
+      const permissionModel = this.collectionManager.getCollection('aiMcpToolPermissions').model;
+      await permissionModel.upsert(
+        { serverName: tool.serverName, toolName: tool.title, permission },
+        {
+          transaction,
+          // Sequelize expects physical column names here, including when underscored is enabled.
+          conflictFields: ['serverName', 'toolName'].map((name) => permissionModel.getAttributes()[name].field || name),
+        },
+      );
+    });
   }
 
   async clearUserContextCache(): Promise<void> {
@@ -424,3 +446,4 @@ export function defineMCP(options: MCPOptions) {
 }
 
 export * from './types';
+export * from './errors';

package/src/mcp-manager/types.ts

@@ -20,7 +20,7 @@ export interface MCPManager extends MCPRegistration {
   getClient(): MultiServerMCPClient | null;
   getMCPToolsProvider(): DynamicToolsProvider;
   listMCPTools(ctx?: Context): Promise<Record<string, MCPToolEntry[]>>;
-  updateMCPToolPermission(toolName: string, permission: Permission): Promise<void>;
+  updateMCPToolPermission(toolName: string, permission: Permission, ctx?: Context): Promise<void>;
   clearUserContextCache(): Promise<void>;
 }