fix(mcp): list servers without Credential Group access

[TheodoreSpeaks]

Summary

The MCP Server dropdown failed with “An organization admin must allow this workspace to use Credential Groups” even when ordinary workspace MCP servers were available. The optional managed catalog now returns an empty result when Credential Groups are unavailable or the workspace has no allowed MCP connectors, so ordinary servers remain selectable.

The catalog evaluates the live organization policy before querying credential metadata and filters queries to permitted connectors. Managed credential execution retains its strict authorization checks. Availability lookup failures, missing or invalid policies, and other unexpected failures still propagate.

Type of Change

• Bug fix

Testing

• Reproduced the reported error with regression tests before applying the fix.
• 82 tests passed across the MCP catalog, query hooks, managed execution, credential authorization, availability, workspace policy, and policy repository suites.
• bun run check:api-validation and bun run check:api-validation:strict passed.
• bun run check:application-graph passed.
• bunx turbo run type-check --filter=@sim/app --filter=@sim/auth passed for both workspaces.
• Biome checks on all changed files and git diff --check passed.

Release

Base: staging. Merging to staging triggers its deployment pipeline after CI gates. No merge, auto-merge, or deployment has been performed or authorized by this task. Production would require separate approval.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 22, 2026 5:34pm UTC

[cubic-dev-ai]

No issues found across 4 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the optional catalog behavior is narrowly implemented without weakening managed credential execution or tenant scoping.

Summary

This PR makes the managed MCP catalog optional so unavailable Credential Groups do not prevent ordinary workspace MCP servers from being listed.

• Returns an empty managed catalog when Credential Groups are unavailable, unconfigured, or grant no managed MCP connectors.
• Evaluates the live organization resource policy and limits catalog queries to explicitly permitted connectors.
• Preserves strict managed-credential execution authorization and propagates unexpected dependency or policy failures.
• Adds regression coverage for ordinary-server listing, connector filtering, availability states, policy revocation, and error propagation.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[List MCP tool servers] --> B[List ordinary workspace servers]
  A --> C[Resolve managed MCP catalog]
  C --> D{Credential Groups available and configured?}
  D -- No --> E[Return empty managed catalog]
  D -- Yes --> F[Load live organization policy]
  F --> G[Determine permitted MCP connectors]
  G --> H{Any permitted connectors?}
  H -- No --> E
  H -- Yes --> I[Query managed credentials for permitted connectors]
  B --> J[Combine ordinary and managed servers]
  E --> J
  I --> J

Loading

_{Reviews (1) · Last reviewed commit: "fix(mcp): list servers without Credentia..."}