@payloadcms/plugin-mcp 4.0.0-canary.0 → 4.0.0-canary.1

package/dist/utils/schemaConversion/sanitizeEntitySchema.spec.js

@@ -0,0 +1,158 @@
+import { describe, expect, it } from 'vitest';
+import { sanitizeEntitySchema } from './sanitizeEntitySchema.js';
+describe('sanitizeEntitySchema', ()=>{
+    it('keeps a Lexical node union strict (oneOf) while simplifying relationship values to IDs', ()=>{
+        // Shaped like the schema the MCP server prepares for a collection with a Lexical richText field:
+        // a `$defs` node union (a `oneOf` of node shapes) where a relationship node's `value` is either
+        // an ID or a `$ref` to the populated related collection.
+        const standalone = {
+            type: 'object',
+            $defs: {
+                LexicalNodes_ABCDEF12: {
+                    oneOf: [
+                        {
+                            type: 'object',
+                            additionalProperties: false,
+                            properties: {
+                                type: {
+                                    const: 'paragraph'
+                                }
+                            },
+                            required: [
+                                'type'
+                            ]
+                        },
+                        {
+                            type: 'object',
+                            additionalProperties: false,
+                            properties: {
+                                type: {
+                                    const: 'relationship'
+                                },
+                                value: {
+                                    oneOf: [
+                                        {
+                                            type: 'string'
+                                        },
+                                        {
+                                            $ref: '#/$defs/posts'
+                                        }
+                                    ]
+                                }
+                            },
+                            required: [
+                                'type'
+                            ]
+                        }
+                    ]
+                },
+                posts: {
+                    type: 'object',
+                    additionalProperties: false,
+                    properties: {
+                        id: {
+                            type: 'string'
+                        },
+                        title: {
+                            type: 'string'
+                        }
+                    }
+                }
+            },
+            properties: {
+                id: {
+                    type: 'string'
+                },
+                content: {
+                    type: 'object',
+                    properties: {
+                        root: {
+                            type: 'object',
+                            properties: {
+                                children: {
+                                    type: 'array',
+                                    items: {
+                                        $ref: '#/$defs/LexicalNodes_ABCDEF12'
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        };
+        expect(sanitizeEntitySchema(standalone)).toStrictEqual({
+            type: 'object',
+            $defs: {
+                // The node union is renamed to a short, readable `node`, and stays a strict discriminated
+                // `oneOf` - not loosened to `anyOf`...
+                node: {
+                    oneOf: [
+                        {
+                            type: 'object',
+                            additionalProperties: false,
+                            properties: {
+                                type: {
+                                    const: 'paragraph'
+                                }
+                            },
+                            required: [
+                                'type'
+                            ]
+                        },
+                        {
+                            type: 'object',
+                            additionalProperties: false,
+                            properties: {
+                                type: {
+                                    const: 'relationship'
+                                },
+                                // ...while the relationship `value` is simplified to a bare ID (the populated-doc `$ref` is dropped).
+                                value: {
+                                    type: 'string',
+                                    description: 'The ID of the related "posts" document.'
+                                }
+                            },
+                            required: [
+                                'type'
+                            ]
+                        }
+                    ]
+                },
+                posts: {
+                    type: 'object',
+                    additionalProperties: false,
+                    properties: {
+                        id: {
+                            type: 'string'
+                        },
+                        title: {
+                            type: 'string'
+                        }
+                    }
+                }
+            },
+            properties: {
+                // `id` is dropped - it's a Payload-managed field MCP clients never set.
+                content: {
+                    type: 'object',
+                    properties: {
+                        root: {
+                            type: 'object',
+                            properties: {
+                                children: {
+                                    type: 'array',
+                                    items: {
+                                        $ref: '#/$defs/node'
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        });
+    });
+});
+
+//# sourceMappingURL=sanitizeEntitySchema.spec.js.map

package/dist/utils/schemaConversion/sanitizeEntitySchema.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/utils/schemaConversion/sanitizeEntitySchema.spec.ts"],"sourcesContent":["import { describe, expect, it } from 'vitest'\n\nimport type { JsonSchemaType } from '../../types.js'\n\nimport { sanitizeEntitySchema } from './sanitizeEntitySchema.js'\n\ndescribe('sanitizeEntitySchema', () => {\n  it('keeps a Lexical node union strict (oneOf) while simplifying relationship values to IDs', () => {\n    // Shaped like the schema the MCP server prepares for a collection with a Lexical richText field:\n    // a `$defs` node union (a `oneOf` of node shapes) where a relationship node's `value` is either\n    // an ID or a `$ref` to the populated related collection.\n    const standalone: JsonSchemaType = {\n      type: 'object',\n      $defs: {\n        LexicalNodes_ABCDEF12: {\n          oneOf: [\n            {\n              type: 'object',\n              additionalProperties: false,\n              properties: { type: { const: 'paragraph' } },\n              required: ['type'],\n            },\n            {\n              type: 'object',\n              additionalProperties: false,\n              properties: {\n                type: { const: 'relationship' },\n                value: { oneOf: [{ type: 'string' }, { $ref: '#/$defs/posts' }] },\n              },\n              required: ['type'],\n            },\n          ],\n        },\n        posts: {\n          type: 'object',\n          additionalProperties: false,\n          properties: { id: { type: 'string' }, title: { type: 'string' } },\n        },\n      },\n      properties: {\n        id: { type: 'string' },\n        content: {\n          type: 'object',\n          properties: {\n            root: {\n              type: 'object',\n              properties: {\n                children: { type: 'array', items: { $ref: '#/$defs/LexicalNodes_ABCDEF12' } },\n              },\n            },\n          },\n        },\n      },\n    }\n\n    expect(sanitizeEntitySchema(standalone)).toStrictEqual({\n      type: 'object',\n      $defs: {\n        // The node union is renamed to a short, readable `node`, and stays a strict discriminated\n        // `oneOf` - not loosened to `anyOf`...\n        node: {\n          oneOf: [\n            {\n              type: 'object',\n              additionalProperties: false,\n              properties: { type: { const: 'paragraph' } },\n              required: ['type'],\n            },\n            {\n              type: 'object',\n              additionalProperties: false,\n              properties: {\n                type: { const: 'relationship' },\n                // ...while the relationship `value` is simplified to a bare ID (the populated-doc `$ref` is dropped).\n                value: { type: 'string', description: 'The ID of the related \"posts\" document.' },\n              },\n              required: ['type'],\n            },\n          ],\n        },\n        posts: {\n          type: 'object',\n          additionalProperties: false,\n          properties: { id: { type: 'string' }, title: { type: 'string' } },\n        },\n      },\n      properties: {\n        // `id` is dropped - it's a Payload-managed field MCP clients never set.\n        content: {\n          type: 'object',\n          properties: {\n            root: {\n              type: 'object',\n              properties: {\n                children: { type: 'array', items: { $ref: '#/$defs/node' } },\n              },\n            },\n          },\n        },\n      },\n    })\n  })\n})\n"],"names":["describe","expect","it","sanitizeEntitySchema","standalone","type","$defs","LexicalNodes_ABCDEF12","oneOf","additionalProperties","properties","const","required","value","$ref","posts","id","title","content","root","children","items","toStrictEqual","node","description"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAI7C,SAASC,oBAAoB,QAAQ,4BAA2B;AAEhEH,SAAS,wBAAwB;IAC/BE,GAAG,0FAA0F;QAC3F,iGAAiG;QACjG,gGAAgG;QAChG,yDAAyD;QACzD,MAAME,aAA6B;YACjCC,MAAM;YACNC,OAAO;gBACLC,uBAAuB;oBACrBC,OAAO;wBACL;4BACEH,MAAM;4BACNI,sBAAsB;4BACtBC,YAAY;gCAAEL,MAAM;oCAAEM,OAAO;gCAAY;4BAAE;4BAC3CC,UAAU;gCAAC;6BAAO;wBACpB;wBACA;4BACEP,MAAM;4BACNI,sBAAsB;4BACtBC,YAAY;gCACVL,MAAM;oCAAEM,OAAO;gCAAe;gCAC9BE,OAAO;oCAAEL,OAAO;wCAAC;4CAAEH,MAAM;wCAAS;wCAAG;4CAAES,MAAM;wCAAgB;qCAAE;gCAAC;4BAClE;4BACAF,UAAU;gCAAC;6BAAO;wBACpB;qBACD;gBACH;gBACAG,OAAO;oBACLV,MAAM;oBACNI,sBAAsB;oBACtBC,YAAY;wBAAEM,IAAI;4BAAEX,MAAM;wBAAS;wBAAGY,OAAO;4BAAEZ,MAAM;wBAAS;oBAAE;gBAClE;YACF;YACAK,YAAY;gBACVM,IAAI;oBAAEX,MAAM;gBAAS;gBACrBa,SAAS;oBACPb,MAAM;oBACNK,YAAY;wBACVS,MAAM;4BACJd,MAAM;4BACNK,YAAY;gCACVU,UAAU;oCAAEf,MAAM;oCAASgB,OAAO;wCAAEP,MAAM;oCAAgC;gCAAE;4BAC9E;wBACF;oBACF;gBACF;YACF;QACF;QAEAb,OAAOE,qBAAqBC,aAAakB,aAAa,CAAC;YACrDjB,MAAM;YACNC,OAAO;gBACL,0FAA0F;gBAC1F,uCAAuC;gBACvCiB,MAAM;oBACJf,OAAO;wBACL;4BACEH,MAAM;4BACNI,sBAAsB;4BACtBC,YAAY;gCAAEL,MAAM;oCAAEM,OAAO;gCAAY;4BAAE;4BAC3CC,UAAU;gCAAC;6BAAO;wBACpB;wBACA;4BACEP,MAAM;4BACNI,sBAAsB;4BACtBC,YAAY;gCACVL,MAAM;oCAAEM,OAAO;gCAAe;gCAC9B,sGAAsG;gCACtGE,OAAO;oCAAER,MAAM;oCAAUmB,aAAa;gCAA0C;4BAClF;4BACAZ,UAAU;gCAAC;6BAAO;wBACpB;qBACD;gBACH;gBACAG,OAAO;oBACLV,MAAM;oBACNI,sBAAsB;oBACtBC,YAAY;wBAAEM,IAAI;4BAAEX,MAAM;wBAAS;wBAAGY,OAAO;4BAAEZ,MAAM;wBAAS;oBAAE;gBAClE;YACF;YACAK,YAAY;gBACV,wEAAwE;gBACxEQ,SAAS;oBACPb,MAAM;oBACNK,YAAY;wBACVS,MAAM;4BACJd,MAAM;4BACNK,YAAY;gCACVU,UAAU;oCAAEf,MAAM;oCAASgB,OAAO;wCAAEP,MAAM;oCAAe;gCAAE;4BAC7D;wBACF;oBACF;gBACF;YACF;QACF;IACF;AACF"}

package/dist/utils/whereSchema.d.ts

@@ -0,0 +1,9 @@
+import type { Where } from 'payload';
+import { z } from 'zod';
+/**
+ * - Validates the `where` input of collection tools against Payload's `Where` shape
+ * - Field keys map to operator objects restricted to `validOperators`
+ * - `and` / `or` nest recursively
+ */
+export declare const whereSchema: z.ZodType<Where>;
+//# sourceMappingURL=whereSchema.d.ts.map

package/dist/utils/whereSchema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"whereSchema.d.ts","sourceRoot":"","sources":["../../src/utils/whereSchema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAGpC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAMvB;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CASqD,CAAA"}

package/dist/utils/whereSchema.js

@@ -0,0 +1,13 @@
+import { validOperators } from 'payload/shared';
+import { z } from 'zod';
+const whereFieldSchema = z.partialRecord(z.enum(validOperators), z.unknown()).describe('Field query operators');
+/**
+ * - Validates the `where` input of collection tools against Payload's `Where` shape
+ * - Field keys map to operator objects restricted to `validOperators`
+ * - `and` / `or` nest recursively
+ */ export const whereSchema = z.lazy(()=>z.object({
+        and: z.array(whereSchema).optional(),
+        or: z.array(whereSchema).optional()
+    }).catchall(whereFieldSchema)).describe('Where clause using field names with Payload query operators, plus and/or groups');
+
+//# sourceMappingURL=whereSchema.js.map

package/dist/utils/whereSchema.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utils/whereSchema.ts"],"sourcesContent":["import type { Where } from 'payload'\n\nimport { validOperators } from 'payload/shared'\nimport { z } from 'zod'\n\nconst whereFieldSchema = z\n  .partialRecord(z.enum(validOperators), z.unknown())\n  .describe('Field query operators')\n\n/**\n * - Validates the `where` input of collection tools against Payload's `Where` shape\n * - Field keys map to operator objects restricted to `validOperators`\n * - `and` / `or` nest recursively\n */\nexport const whereSchema: z.ZodType<Where> = z\n  .lazy(() =>\n    z\n      .object({\n        and: z.array(whereSchema).optional(),\n        or: z.array(whereSchema).optional(),\n      })\n      .catchall(whereFieldSchema),\n  )\n  .describe('Where clause using field names with Payload query operators, plus and/or groups')\n"],"names":["validOperators","z","whereFieldSchema","partialRecord","enum","unknown","describe","whereSchema","lazy","object","and","array","optional","or","catchall"],"mappings":"AAEA,SAASA,cAAc,QAAQ,iBAAgB;AAC/C,SAASC,CAAC,QAAQ,MAAK;AAEvB,MAAMC,mBAAmBD,EACtBE,aAAa,CAACF,EAAEG,IAAI,CAACJ,iBAAiBC,EAAEI,OAAO,IAC/CC,QAAQ,CAAC;AAEZ;;;;CAIC,GACD,OAAO,MAAMC,cAAgCN,EAC1CO,IAAI,CAAC,IACJP,EACGQ,MAAM,CAAC;QACNC,KAAKT,EAAEU,KAAK,CAACJ,aAAaK,QAAQ;QAClCC,IAAIZ,EAAEU,KAAK,CAACJ,aAAaK,QAAQ;IACnC,GACCE,QAAQ,CAACZ,mBAEbI,QAAQ,CAAC,mFAAkF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payloadcms/plugin-mcp",
-  "version": "4.0.0-canary.0",
+  "version": "4.0.0-canary.1",
   "description": "MCP (Model Context Protocol) capabilities with Payload",
   "keywords": [
     "plugin",
@@ -62,13 +62,13 @@
     "@types/react": "19.2.14",
     "react": "^19.0.1 || ^19.1.2 || ^19.2.1",
     "@payloadcms/eslint-config": "3.28.0",
-    "payload": "4.0.0-canary.0",
-    "@payloadcms/ui": "4.0.0-canary.0"
+    "@payloadcms/ui": "4.0.0-canary.1",
+    "payload": "4.0.0-canary.1"
   },
   "peerDependencies": {
     "react": "^19.0.1 || ^19.1.2 || ^19.2.1",
-    "@payloadcms/ui": "4.0.0-canary.0",
-    "payload": "4.0.0-canary.0"
+    "@payloadcms/ui": "4.0.0-canary.1",
+    "payload": "4.0.0-canary.1"
   },
   "//deps_notes": {
     "zod": "zod is a hard dependency of @modelcontextprotocol/server, thus we can safely use it without it impacting bundle size. Make extra sure the zod version here matches exactly what's defined in the dependencies of @modelcontextprotocol/server to avoid duplicate versions being installed.",

package/src/collection/getAccessField.ts

@@ -47,8 +47,8 @@ const sanitizeClientPluginConfig = (
     ...(item.type === 'collectionTool' ? { collectionSlug: item.collectionSlug } : {}),
     ...(item.type === 'globalTool' ? { globalSlug: item.globalSlug } : {}),
     type: item.type,
+    configKey: item.configKey,
     description: itemDescription(item),
-    key: item.key,
     label: item.label,
   })),
 })

package/src/collection/index.ts

@@ -55,6 +55,7 @@ export const getAPIKeysCollection = ({
       plural: 'API Keys',
       singular: 'API Key',
     },
+    versions: false,
   }
 
   return pluginConfig.overrideApiKeyCollection

package/src/components/AccessField/index.client.tsx

@@ -68,14 +68,15 @@ export const AccessField: React.FC<Props> = ({ path, pluginConfig }) => {
     }
   }
 
-  const isScopedAllowed = (scope: ScopeKey, slug: string, key: string): boolean =>
-    access[scope]?.[slug]?.[key] !== false
+  const isScopedAllowed = (scope: ScopeKey, slug: string, configKey: string): boolean =>
+    access[scope]?.[slug]?.[configKey] !== false
 
-  const isFlatAllowed = (scope: FlatKey, key: string): boolean => access[scope]?.[key] !== false
+  const isFlatAllowed = (scope: FlatKey, configKey: string): boolean =>
+    access[scope]?.[configKey] !== false
 
-  const toggleScoped = (scope: ScopeKey, slug: string, key: string, allow: boolean) => {
+  const toggleScoped = (scope: ScopeKey, slug: string, configKey: string, allow: boolean) => {
     if (allow) {
-      const slugBucket = without(access[scope]?.[slug], key)
+      const slugBucket = without(access[scope]?.[slug], configKey)
       const scopeBucket = slugBucket
         ? setKey(access[scope], slug, slugBucket)
         : without(access[scope], slug)
@@ -85,18 +86,18 @@ export const AccessField: React.FC<Props> = ({ path, pluginConfig }) => {
         setKey(
           access,
           scope,
-          setKey(access[scope], slug, setKey(access[scope]?.[slug], key, false)),
+          setKey(access[scope], slug, setKey(access[scope]?.[slug], configKey, false)),
         ),
       )
     }
   }
 
-  const toggleFlat = (scope: FlatKey, key: string, allow: boolean) => {
+  const toggleFlat = (scope: FlatKey, configKey: string, allow: boolean) => {
     if (allow) {
-      const bucket = without(access[scope], key)
+      const bucket = without(access[scope], configKey)
       setValue(bucket ? setKey(access, scope, bucket) : (without(access, scope) ?? {}))
     } else {
-      setValue(setKey(access, scope, setKey(access[scope], key, false)))
+      setValue(setKey(access, scope, setKey(access[scope], configKey, false)))
     }
   }
 
@@ -106,7 +107,7 @@ export const AccessField: React.FC<Props> = ({ path, pluginConfig }) => {
       setValue(scopeBucket ? setKey(access, scope, scopeBucket) : (without(access, scope) ?? {}))
     } else {
       const slugBucket = leaves.reduce<Record<string, boolean>>(
-        (acc, leaf) => ({ ...acc, [leaf.key]: false }),
+        (acc, leaf) => ({ ...acc, [leaf.configKey]: false }),
         {},
       )
       setValue(setKey(access, scope, setKey(access[scope], slug, slugBucket)))
@@ -118,7 +119,7 @@ export const AccessField: React.FC<Props> = ({ path, pluginConfig }) => {
       setValue(without(access, scope) ?? {})
     } else {
       const bucket = leaves.reduce<Record<string, boolean>>(
-        (acc, leaf) => ({ ...acc, [leaf.key]: false }),
+        (acc, leaf) => ({ ...acc, [leaf.configKey]: false }),
         {},
       )
       setValue(setKey(access, scope, bucket))
@@ -154,13 +155,13 @@ export const AccessField: React.FC<Props> = ({ path, pluginConfig }) => {
               >
                 <ul className={`${baseClass}__list`}>
                   {leaves.map((leaf) => (
-                    <li key={leaf.key}>
+                    <li key={leaf.configKey}>
                       <CheckboxInput
-                        checked={isScopedAllowed('collections', slug, leaf.key)}
-                        id={`${path}.collections.${slug}.${leaf.key}`}
+                        checked={isScopedAllowed('collections', slug, leaf.configKey)}
+                        id={`${path}.collections.${slug}.${leaf.configKey}`}
                         label={leaf.label}
                         onToggle={(e) =>
-                          toggleScoped('collections', slug, leaf.key, e.target.checked)
+                          toggleScoped('collections', slug, leaf.configKey, e.target.checked)
                         }
                         tooltip={leaf.description}
                       />
@@ -197,12 +198,14 @@ export const AccessField: React.FC<Props> = ({ path, pluginConfig }) => {
               >
                 <ul className={`${baseClass}__list`}>
                   {leaves.map((leaf) => (
-                    <li key={leaf.key}>
+                    <li key={leaf.configKey}>
                       <CheckboxInput
-                        checked={isScopedAllowed('globals', slug, leaf.key)}
-                        id={`${path}.globals.${slug}.${leaf.key}`}
+                        checked={isScopedAllowed('globals', slug, leaf.configKey)}
+                        id={`${path}.globals.${slug}.${leaf.configKey}`}
                         label={leaf.label}
-                        onToggle={(e) => toggleScoped('globals', slug, leaf.key, e.target.checked)}
+                        onToggle={(e) =>
+                          toggleScoped('globals', slug, leaf.configKey, e.target.checked)
+                        }
                         tooltip={leaf.description}
                       />
                     </li>
@@ -234,12 +237,12 @@ export const AccessField: React.FC<Props> = ({ path, pluginConfig }) => {
             >
               <ul className={`${baseClass}__list`}>
                 {tools.map((leaf) => (
-                  <li key={leaf.key}>
+                  <li key={leaf.configKey}>
                     <CheckboxInput
-                      checked={isFlatAllowed('tools', leaf.key)}
-                      id={`${path}.tools.${leaf.key}`}
+                      checked={isFlatAllowed('tools', leaf.configKey)}
+                      id={`${path}.tools.${leaf.configKey}`}
                       label={leaf.label}
-                      onToggle={(e) => toggleFlat('tools', leaf.key, e.target.checked)}
+                      onToggle={(e) => toggleFlat('tools', leaf.configKey, e.target.checked)}
                       tooltip={leaf.description}
                     />
                   </li>
@@ -259,12 +262,12 @@ export const AccessField: React.FC<Props> = ({ path, pluginConfig }) => {
             >
               <ul className={`${baseClass}__list`}>
                 {prompts.map((leaf) => (
-                  <li key={leaf.key}>
+                  <li key={leaf.configKey}>
                     <CheckboxInput
-                      checked={isFlatAllowed('prompts', leaf.key)}
-                      id={`${path}.prompts.${leaf.key}`}
+                      checked={isFlatAllowed('prompts', leaf.configKey)}
+                      id={`${path}.prompts.${leaf.configKey}`}
                       label={leaf.label}
-                      onToggle={(e) => toggleFlat('prompts', leaf.key, e.target.checked)}
+                      onToggle={(e) => toggleFlat('prompts', leaf.configKey, e.target.checked)}
                       tooltip={leaf.description}
                     />
                   </li>
@@ -286,12 +289,12 @@ export const AccessField: React.FC<Props> = ({ path, pluginConfig }) => {
             >
               <ul className={`${baseClass}__list`}>
                 {resources.map((leaf) => (
-                  <li key={leaf.key}>
+                  <li key={leaf.configKey}>
                     <CheckboxInput
-                      checked={isFlatAllowed('resources', leaf.key)}
-                      id={`${path}.resources.${leaf.key}`}
+                      checked={isFlatAllowed('resources', leaf.configKey)}
+                      id={`${path}.resources.${leaf.configKey}`}
                       label={leaf.label}
-                      onToggle={(e) => toggleFlat('resources', leaf.key, e.target.checked)}
+                      onToggle={(e) => toggleFlat('resources', leaf.configKey, e.target.checked)}
                       tooltip={leaf.description}
                     />
                   </li>

package/src/endpoint/access.ts

@@ -25,15 +25,15 @@ export const getAuthorizedMCP: (args: { req: PayloadRequest }) => Promise<Author
     items: pluginConfig.items.filter((item) => {
       switch (item.type) {
         case 'collectionTool':
-          return apiKeyDoc.access.collections?.[item.collectionSlug]?.[item.key] !== false
+          return apiKeyDoc.access.collections?.[item.collectionSlug]?.[item.configKey] !== false
         case 'globalTool':
-          return apiKeyDoc.access.globals?.[item.globalSlug]?.[item.key] !== false
+          return apiKeyDoc.access.globals?.[item.globalSlug]?.[item.configKey] !== false
         case 'prompt':
-          return apiKeyDoc.access.prompts?.[item.key] !== false
+          return apiKeyDoc.access.prompts?.[item.configKey] !== false
         case 'resource':
-          return apiKeyDoc.access.resources?.[item.key] !== false
+          return apiKeyDoc.access.resources?.[item.configKey] !== false
         case 'tool':
-          return apiKeyDoc.access.tools?.[item.key] !== false
+          return apiKeyDoc.access.tools?.[item.configKey] !== false
       }
     }),
     overrideAccess: