fix(mothership): authorize MCP calls as the chat subject

Author: Sg312

apps/sim/lib/internal/mcp/execute-tool.test.ts

@@ -73,6 +73,62 @@ describe('executeMcpTool', () => {
     })
   })
 
+  it.each(['', 'workflow-1'])(
+    'uses the authenticated chat subject for a Copilot call with workflowId %j',
+    async (workflowId) => {
+      const response = await executeMcpTool({
+        toolId: 'mcp-server-lookup',
+        input: { query: 'sim', _context: { userId: 'forged', workspaceId: 'foreign' } },
+        headers: new Headers(),
+        context: {
+          ...CONTEXT,
+          workflowId,
+          copilotToolExecution: true,
+          copilotInteractionMode: 'interactive',
+          chatId: 'chat-1',
+          toolCallId: 'call-1',
+        },
+        requestId: 'request-copilot',
+      })
+      expect(response.status).toBe(200)
+      expect(mocks.createPrincipal).not.toHaveBeenCalled()
+      expect(mocks.executeUseCase).toHaveBeenCalledWith({
+        principal: expect.objectContaining({
+          kind: 'delegated',
+          serviceId: 'copilot',
+          subjectUserId: 'user-1',
+          workspaceId: 'workspace-1',
+          audience: 'sim:mcp-servers',
+          delegationId: 'copilot-tool:call-1',
+          resourceScope: { chatId: 'chat-1' },
+        }),
+        input: expect.objectContaining({ arguments: { query: 'sim' } }),
+      })
+    }
+  )
+
+  it.each(['userId', 'toolCallId'] as const)(
+    'rejects incomplete trusted Copilot context without %s',
+    async (field) => {
+      const response = await executeMcpTool({
+        toolId: 'mcp-server-lookup',
+        input: { _context: { userId: 'forged', toolCallId: 'forged-call' } },
+        headers: new Headers(),
+        context: {
+          ...CONTEXT,
+          workflowId: '',
+          copilotToolExecution: true,
+          toolCallId: 'call-1',
+          [field]: undefined,
+        },
+        requestId: 'request-copilot',
+      })
+      expect(response.ok).toBe(false)
+      expect(mocks.executeUseCase).not.toHaveBeenCalled()
+      expect(mocks.createPrincipal).not.toHaveBeenCalled()
+    }
+  )
+
   it('parses direct block arguments and invokes the authorized use case', async () => {
     const response = await executeMcpTool({
       toolId: 'mcp-server-lookup',

apps/sim/lib/internal/mcp/execute-tool.ts

@@ -21,6 +21,11 @@ import { executeMcpToolUseCase, McpToolsNotAllowedError } from '@/lib/mcp/applic
 import { McpOauthRedirectRequired } from '@/lib/mcp/oauth'
 import { McpOauthAuthorizationRequiredError } from '@/lib/mcp/types'
 import { categorizeError, parseMcpToolId } from '@/lib/mcp/utils'
+import {
+  COPILOT_APPLICATION_DELEGATION_TTL_MS,
+  createCopilotApplicationPrincipal,
+  requireTrustedCopilotExecutionContext,
+} from '@/lib/mothership/auth/application-delegation'
 import {
   ResolvedSecretTraceProvenanceAccumulator,
   type ResolvedSecretTraceRegistry,
@@ -124,10 +129,17 @@ export const executeMcpTool: InternalToolOperationHandler = async (request) => {
 
   let provenance: ResolvedSecretTraceProvenanceAccumulator | undefined
   try {
-    const principal = await createExecutorPrincipalFromExecutionContext({
-      context: request.context,
-      audience: MCP_SERVER_DELEGATION_AUDIENCE,
-    })
+    /** Workspace chat tools act as their authenticated subject without requiring a workflow. */
+    const principal = request.context.copilotToolExecution
+      ? createCopilotApplicationPrincipal(requireTrustedCopilotExecutionContext(request.context), {
+          audience: MCP_SERVER_DELEGATION_AUDIENCE,
+          ttlMs: COPILOT_APPLICATION_DELEGATION_TTL_MS,
+          createDelegationId: (context) => `copilot-tool:${context.toolCallId}`,
+        })
+      : await createExecutorPrincipalFromExecutionContext({
+          context: request.context,
+          audience: MCP_SERVER_DELEGATION_AUDIENCE,
+        })
     request.signal?.throwIfAborted()
     const subject = resolvePrincipalSubject(principal)
     provenance =

apps/sim/lib/mcp/application/execute-tool.test.ts

@@ -1,7 +1,10 @@
 /**
  * @vitest-environment node
  */
-import type { WorkflowExecutionDelegatedPrincipal } from '@sim/auth/principal'
+import type {
+  BoundWorkflowExecutionDelegatedPrincipal,
+  SubjectDelegatedPrincipal,
+} from '@sim/auth/principal'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const mocks = vi.hoisted(() => ({
@@ -50,7 +53,7 @@ const SERVER = {
   workspaceId: WORKSPACE.workspaceId,
   enabled: true,
 }
-const PRINCIPAL: WorkflowExecutionDelegatedPrincipal = {
+const PRINCIPAL: BoundWorkflowExecutionDelegatedPrincipal = {
   kind: 'delegated',
   serviceId: 'executor',
   subjectUserId: 'user-1',
@@ -61,7 +64,7 @@ const PRINCIPAL: WorkflowExecutionDelegatedPrincipal = {
   expiresAt: new Date('2099-08-27T00:05:00.000Z'),
   delegationContext: { kind: 'workflow_execution', workflowId: 'workflow-1' },
 }
-const ACTORLESS_PRINCIPAL: WorkflowExecutionDelegatedPrincipal = {
+const ACTORLESS_PRINCIPAL: BoundWorkflowExecutionDelegatedPrincipal = {
   kind: 'delegated',
   serviceId: 'executor',
   workspaceId: WORKSPACE.workspaceId,
@@ -85,7 +88,18 @@ const ACTORLESS_PRINCIPAL: WorkflowExecutionDelegatedPrincipal = {
     },
   },
 }
-const COMPATIBILITY_ACTOR_PRINCIPAL: WorkflowExecutionDelegatedPrincipal = {
+const COPILOT_PRINCIPAL: SubjectDelegatedPrincipal = {
+  kind: 'delegated',
+  serviceId: 'copilot',
+  subjectUserId: 'chat-user',
+  workspaceId: WORKSPACE.workspaceId,
+  delegationId: 'copilot-tool:call-1',
+  audience: 'sim:mcp-servers',
+  issuedAt: new Date('2026-08-27T00:00:00.000Z'),
+  expiresAt: new Date('2099-08-27T00:05:00.000Z'),
+  resourceScope: { chatId: 'chat-1' },
+}
+const COMPATIBILITY_ACTOR_PRINCIPAL: BoundWorkflowExecutionDelegatedPrincipal = {
   ...ACTORLESS_PRINCIPAL,
   delegationContext: {
     ...ACTORLESS_PRINCIPAL.delegationContext,
@@ -119,6 +133,80 @@ describe('executeMcpToolUseCase', () => {
     mocks.executeTool.mockResolvedValue({ content: [{ type: 'text', text: 'done' }] })
   })
 
+  it.each(['read', 'write', 'admin'])(
+    'executes as the current Copilot subject with %s workspace permission',
+    async (permission) => {
+      mocks.resolvePermission.mockResolvedValue(permission)
+      await executeMcpToolUseCase.execute({
+        principal: COPILOT_PRINCIPAL,
+        input: {
+          workspaceId: WORKSPACE.workspaceId,
+          serverId: SERVER.id,
+          toolName: 'lookup',
+          arguments: { count: 1 },
+        },
+      })
+      expect(mocks.resolvePermission).toHaveBeenCalledWith(
+        'chat-user',
+        WORKSPACE.workspaceId,
+        null,
+        undefined,
+        { forUpdate: undefined }
+      )
+      expect(mocks.assertPermissionsAllowed).toHaveBeenCalledWith({
+        userId: 'chat-user',
+        workspaceId: WORKSPACE.workspaceId,
+        toolKind: 'mcp',
+      })
+      expect(mocks.executeTool).toHaveBeenCalledWith(
+        'chat-user',
+        SERVER.id,
+        { name: 'lookup', arguments: { count: 1 } },
+        WORKSPACE.workspaceId,
+        undefined,
+        undefined,
+        { signal: undefined, timeoutMs: undefined }
+      )
+    }
+  )
+
+  it.each([
+    { audience: 'sim:other' },
+    { workspaceId: 'foreign-workspace' },
+    { expiresAt: new Date(0) },
+  ])('rejects invalid Copilot delegation %j before discovery or execution', async (override) => {
+    await expect(
+      executeMcpToolUseCase.execute({
+        principal: { ...COPILOT_PRINCIPAL, ...override },
+        input: {
+          workspaceId: WORKSPACE.workspaceId,
+          serverId: SERVER.id,
+          toolName: 'lookup',
+          arguments: { count: 1 },
+        },
+      })
+    ).rejects.toMatchObject({ code: 'forbidden' })
+    expect(mocks.discoverServerTools).not.toHaveBeenCalled()
+    expect(mocks.executeTool).not.toHaveBeenCalled()
+  })
+
+  it('rechecks the Copilot subject after workspace membership is revoked', async () => {
+    mocks.resolvePermission.mockResolvedValue(null)
+    await expect(
+      executeMcpToolUseCase.execute({
+        principal: COPILOT_PRINCIPAL,
+        input: {
+          workspaceId: WORKSPACE.workspaceId,
+          serverId: SERVER.id,
+          toolName: 'lookup',
+          arguments: { count: 1 },
+        },
+      })
+    ).rejects.toMatchObject({ code: 'forbidden' })
+    expect(mocks.discoverServerTools).not.toHaveBeenCalled()
+    expect(mocks.executeTool).not.toHaveBeenCalled()
+  })
+
   it('authorizes, coerces the discovered schema, and preserves execution context', async () => {
     const provenance = vi.fn()
     const signal = new AbortController().signal

apps/sim/lib/mcp/application/operations.test.ts

@@ -13,13 +13,13 @@ describe('MCP server operation registry', () => {
     })
   })
 
-  it('admits only the executor delegation for tool execution', () => {
+  it('admits executor and Copilot delegations for tool execution', () => {
     expect(mcpServerOperations.executeTool).toMatchObject({
       id: 'mcp_servers.tools.execute',
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       principalKinds: ['delegated'],
-      delegatedServices: ['executor'],
+      delegatedServices: ['executor', 'copilot'],
     })
   })
 

apps/sim/lib/mcp/application/operations.ts

@@ -14,7 +14,7 @@ const DISCOVERY_PRINCIPAL_POLICY = {
 } as const
 const EXECUTION_PRINCIPAL_POLICY = {
   principalKinds: ['delegated'],
-  delegatedServices: ['executor'],
+  delegatedServices: ['executor', 'copilot'],
 } as const
 
 export const mcpServerOperations = {