Skip to content

Commit 70e2157

Browse files
TheodoreSpeaksTheodoreSpeaks
committed
feat(mcp): add dynamic operations and workflow access controls
1 parent 57c1c7c commit 70e2157

95 files changed

Lines changed: 3670 additions & 732 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎apps/docs/content/docs/agents/mcp.mdx‎

Lines changed: 27 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -117,16 +117,16 @@ Once MCP servers are configured, their tools become available within your agent
117117
/>
118118
</div>
119119

120-
4. Select individual tools, or choose **Use all N tools** to add every tool from that server
120+
4. Select individual tools, or choose **Configure operations access** for a dynamic server attachment
121121
5. The agent can now access these tools during execution
122122

123123
<Callout type="info">
124124
If you haven't configured a server yet, click **Add MCP Server** at the top of the dropdown to open the setup modal without leaving the block.
125125
</Callout>
126126

127-
## Standalone MCP Tool Block
127+
## Standalone MCP Block
128128

129-
For more granular control, you can use the dedicated MCP Tool block to execute specific MCP tools:
129+
Use the MCP block to discover operations or run one operation with explicit inputs:
130130

131131
<div className="flex justify-center">
132132
<Image
@@ -138,7 +138,30 @@ For more granular control, you can use the dedicated MCP Tool block to execute s
138138
/>
139139
</div>
140140

141-
The MCP Tool block runs one configured tool with parameters you set explicitly, and its output is readable by later blocks like any other.
141+
Choose an **Action**:
142+
143+
- **List operations** discovers authorized operation names, descriptions, and input schemas without executing provider operations. Filter by name or description, set a page size from 1 to 100, and pass `nextCursor` into the next request while `hasMore` is true. An authorized list can be empty.
144+
- **Run operation** executes one exact operation name. Configured operations keep their generated argument fields. For an operation name resolved at runtime, supply a JSON arguments object; Sim validates it against the operation's discovered schema before execution.
145+
146+
Server, managed connection, operation name, and arguments can use upstream block references. If you supply a managed connection separately, it must belong to the selected canonical server and be authorized for the workflow's workspace.
147+
148+
### Operations access
149+
150+
The standalone MCP block and **MCP Server (Advanced)** Agent attachment share three access modes:
151+
152+
| Mode | Behavior |
153+
| --- | --- |
154+
| **Only selected** | Allows only selected exact operation names. An empty selection allows nothing. Newly discovered names stay excluded. |
155+
| **All except selected** | Denies selected exact names. An empty selection allows everything otherwise permitted. Denied names stay saved if they temporarily disappear. |
156+
| **All permitted** | Allows every operation available to the authorized credential. |
157+
158+
New restricted configurations start with an empty explicit selection. Existing saved workflows retain their prior access through normalization, while current organization and credential authorization still apply.
159+
160+
Operation restrictions are saved in workflow state, on the MCP block or Agent attachment. An operation must be available to the authorized credential and permitted by the saved restriction.
161+
162+
Discovery filters the catalog shown to the editor and Agent. Execution checks the actual server, connection, and saved block restriction again before calling the provider. Missing or forbidden operations, unverifiable schemas, malformed arguments, and incorrect connection scopes fail the call. An Agent attachment with no permitted operations fails clearly.
163+
164+
Policies match exact MCP tool names on a canonical server. They do not inspect operation arguments: allowing a generic `execute_sql` operation does not limit which SQL it can execute.
142165

143166
## When to Use MCP Tool vs Agent
144167

‎apps/docs/openapi-v2-workflows.json‎

Lines changed: 186 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8130,6 +8130,95 @@
81308130
"AgentMcpTool": {
81318131
"type": "object",
81328132
"properties": {
8133+
"operationPolicy": {
8134+
"oneOf": [
8135+
{
8136+
"type": "object",
8137+
"properties": {
8138+
"mode": {
8139+
"type": "string",
8140+
"const": "all",
8141+
"description": "Allow all operations available to the authorized credential."
8142+
}
8143+
},
8144+
"required": ["mode"],
8145+
"additionalProperties": false
8146+
},
8147+
{
8148+
"type": "object",
8149+
"properties": {
8150+
"mode": {
8151+
"type": "string",
8152+
"const": "allow",
8153+
"description": "Allow only the selected exact operations."
8154+
},
8155+
"operations": {
8156+
"maxItems": 1000,
8157+
"type": "array",
8158+
"items": {
8159+
"type": "object",
8160+
"properties": {
8161+
"serverId": {
8162+
"type": "string",
8163+
"minLength": 1,
8164+
"maxLength": 256,
8165+
"description": "Canonical MCP server identity, independent of the selected credential."
8166+
},
8167+
"name": {
8168+
"type": "string",
8169+
"minLength": 1,
8170+
"maxLength": 256,
8171+
"description": "Exact operation name returned by MCP discovery."
8172+
}
8173+
},
8174+
"required": ["serverId", "name"],
8175+
"additionalProperties": false
8176+
},
8177+
"description": "Allowed server-scoped operation identities; an empty list grants no access."
8178+
}
8179+
},
8180+
"required": ["mode", "operations"],
8181+
"additionalProperties": false
8182+
},
8183+
{
8184+
"type": "object",
8185+
"properties": {
8186+
"mode": {
8187+
"type": "string",
8188+
"const": "deny",
8189+
"description": "Exclude the selected exact operations."
8190+
},
8191+
"operations": {
8192+
"maxItems": 1000,
8193+
"type": "array",
8194+
"items": {
8195+
"type": "object",
8196+
"properties": {
8197+
"serverId": {
8198+
"type": "string",
8199+
"minLength": 1,
8200+
"maxLength": 256,
8201+
"description": "Canonical MCP server identity, independent of the selected credential."
8202+
},
8203+
"name": {
8204+
"type": "string",
8205+
"minLength": 1,
8206+
"maxLength": 256,
8207+
"description": "Exact operation name returned by MCP discovery."
8208+
}
8209+
},
8210+
"required": ["serverId", "name"],
8211+
"additionalProperties": false
8212+
},
8213+
"description": "Denied server-scoped operation identities; an empty list allows otherwise permitted tools."
8214+
}
8215+
},
8216+
"required": ["mode", "operations"],
8217+
"additionalProperties": false
8218+
}
8219+
],
8220+
"description": "Saved workflow operation restrictions that can only narrow authorized credential access."
8221+
},
81338222
"type": {
81348223
"type": "string",
81358224
"const": "mcp",
@@ -8201,9 +8290,104 @@
82018290
"const": "mcp-server-advanced",
82028291
"description": "Server-wide MCP binding discriminator."
82038292
},
8293+
"operationPolicy": {
8294+
"oneOf": [
8295+
{
8296+
"type": "object",
8297+
"properties": {
8298+
"mode": {
8299+
"type": "string",
8300+
"const": "all",
8301+
"description": "Allow all operations available to the authorized credential."
8302+
}
8303+
},
8304+
"required": ["mode"],
8305+
"additionalProperties": false
8306+
},
8307+
{
8308+
"type": "object",
8309+
"properties": {
8310+
"mode": {
8311+
"type": "string",
8312+
"const": "allow",
8313+
"description": "Allow only the selected exact operations."
8314+
},
8315+
"operations": {
8316+
"maxItems": 1000,
8317+
"type": "array",
8318+
"items": {
8319+
"type": "object",
8320+
"properties": {
8321+
"serverId": {
8322+
"type": "string",
8323+
"minLength": 1,
8324+
"maxLength": 256,
8325+
"description": "Canonical MCP server identity, independent of the selected credential."
8326+
},
8327+
"name": {
8328+
"type": "string",
8329+
"minLength": 1,
8330+
"maxLength": 256,
8331+
"description": "Exact operation name returned by MCP discovery."
8332+
}
8333+
},
8334+
"required": ["serverId", "name"],
8335+
"additionalProperties": false
8336+
},
8337+
"description": "Allowed server-scoped operation identities; an empty list grants no access."
8338+
}
8339+
},
8340+
"required": ["mode", "operations"],
8341+
"additionalProperties": false
8342+
},
8343+
{
8344+
"type": "object",
8345+
"properties": {
8346+
"mode": {
8347+
"type": "string",
8348+
"const": "deny",
8349+
"description": "Exclude the selected exact operations."
8350+
},
8351+
"operations": {
8352+
"maxItems": 1000,
8353+
"type": "array",
8354+
"items": {
8355+
"type": "object",
8356+
"properties": {
8357+
"serverId": {
8358+
"type": "string",
8359+
"minLength": 1,
8360+
"maxLength": 256,
8361+
"description": "Canonical MCP server identity, independent of the selected credential."
8362+
},
8363+
"name": {
8364+
"type": "string",
8365+
"minLength": 1,
8366+
"maxLength": 256,
8367+
"description": "Exact operation name returned by MCP discovery."
8368+
}
8369+
},
8370+
"required": ["serverId", "name"],
8371+
"additionalProperties": false
8372+
},
8373+
"description": "Denied server-scoped operation identities; an empty list allows otherwise permitted tools."
8374+
}
8375+
},
8376+
"required": ["mode", "operations"],
8377+
"additionalProperties": false
8378+
}
8379+
],
8380+
"description": "Saved workflow operation restrictions that can only narrow authorized credential access."
8381+
},
82048382
"params": {
82058383
"type": "object",
82068384
"properties": {
8385+
"connectionId": {
8386+
"description": "Optional managed connection ID or upstream reference bound to the canonical server.",
8387+
"type": "string",
8388+
"minLength": 1,
8389+
"maxLength": 128
8390+
},
82078391
"serverId": {
82088392
"type": "string",
82098393
"minLength": 1,
@@ -8213,7 +8397,7 @@
82138397
},
82148398
"required": ["serverId"],
82158399
"additionalProperties": false,
8216-
"description": "Server identity for discovering and invoking every available MCP tool."
8400+
"description": "Server and optional connection identity for authorized operation discovery and execution."
82178401
},
82188402
"usageControl": {
82198403
"type": "string",
@@ -8226,7 +8410,7 @@
82268410
"description": "Forward-compatible MCP server metadata preserved by the workflow editor."
82278411
},
82288412
"title": "Agent MCP server (advanced)",
8229-
"description": "All tools available to the executing subject from one MCP server.",
8413+
"description": "Dynamically discovered operations permitted by the authorized credential and saved block policy.",
82308414
"examples": [
82318415
{
82328416
"type": "mcp-server-advanced",

0 commit comments

Comments
 (0)