feat(mcp): add dynamic operations and Agent access controls

[TheodoreSpeaks]

Summary

• Add standalone List operations and Run operation actions with one MCP Server input accepting a shared server or managed connection ID. Resolve server and operation references after workflow variable resolution, with generated fields for fixed operations and schema-validated JSON arguments for dynamic operations.
• Make Agent MCP Server (Advanced) a plain server/connection input with directly entered tool IDs. Allowlist, denylist, and all-permitted restrictions match exact MCP tool names on the resolved, authorized connection; the attachment has no catalog picker or Basic/Advanced field mode.
• Recheck saved restrictions, connection scope, credential access, and discovered schemas at execution. Preserve trusted policy provenance through MCP delegation without changing other operation scopes.
• Normalize existing workflows, copied bindings, and portable reference manifests, including interim server-scoped restrictions. No database migration or organization policy changes.

Type of Change

• New feature

Testing

• 951 MCP, Agent, delegation, execution, serialization, editor, registry, and workflow normalization/copying tests passed, plus 43 policy/API tests 236 import/export, reference, and Copilot regression tests, and 19 MCP query/OAuth tests.
• Verified the cache-key extraction reduces the affected page graph by four modules on both the CI merge and current staging, passing the existing graph limit.
• App/auth type checks, repository lint, boundary audits, block-registry checks, and generated artifact checks passed.
• Verified the Agent editor shows a plain runtime server reference and literal tool-ID tags, preserves the saved selection, and deduplicates direct entry.
• Previously verified live managed MCP connection lookup → List operations → Run operation using dynamic references. Live Agent/model execution has not been verified.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 10, 2026 4:43am UTC

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; no actionable correctness, security, or repository-rule violation remains.

Summary

• Adds standalone List operations and Run operation actions.
• Supports shared MCP server IDs and managed connection IDs.
• Applies allow, deny, and all-permitted operation policies to Agent attachments.
• Revalidates connection, credential, schema, and saved-policy access during execution.
• Updates editor controls, API contracts, documentation, generated artifacts, and regression coverage.

Diagram

sequenceDiagram
  participant W as Workflow/Agent
  participant D as Delegated MCP adapter
  participant A as Authorization
  participant C as MCP connection
  participant P as MCP provider

  W->>D: Resolve server and operation references
  D->>A: Verify signed workflow/block provenance
  A->>A: Load current workspace and credential access
  A->>A: Load saved operation policy
  D->>C: Resolve shared server or managed connection
  C->>P: Discover current operation schemas
  P-->>C: Authorized operations
  C-->>D: Filtered operations and schemas
  D->>A: Check exact operation name
  A-->>D: Permit or reject
  D->>P: Execute schema-validated arguments
  P-->>W: Operation result

Loading

_{Reviews (4) · Last reviewed commit: "chore(mcp): merge staging and reconcile ..."}

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@greptile