Restart of LibreChat in Docker resets MCP_SERVERS:Create permissions from true to false

[greenmotion]

Every time our LibreChat docker container gets restarted, it resets the MCP_SERVERS:Create permissions on the User role from true to false.

I checked for any hardcoded values in librechat.yaml, and can confirm nothing is there.

When I re-enable MCP Server Creation through the Admin interface, it updates the MongoDB as expected, but upon the next restart, it is back to false. What am I missing?

Thank you!

Before restart:

LibreChat> db.roles.findOne({ name: "USER" }) { _id: ObjectId('6a7b7ba9a2160eb1151c0c6a'), name: 'USER', description: '', permissions: { BOOKMARKS: { USE: true }, PROMPTS: { USE: true, CREATE: true, SHARE: false, SHARE_PUBLIC: false }, MEMORIES: { USE: true, CREATE: true, UPDATE: true, READ: true, OPT_OUT: true }, AGENTS: { USE: true, CREATE: true, SHARE: false, SHARE_PUBLIC: false }, MULTI_CONVO: { USE: true }, TEMPORARY_CHAT: { USE: true }, RUN_CODE: { USE: true }, WEB_SEARCH: { USE: true }, PEOPLE_PICKER: { VIEW_USERS: true, VIEW_GROUPS: true, VIEW_ROLES: true }, MARKETPLACE: { USE: false }, FILE_SEARCH: { USE: true }, FILE_CITATIONS: { USE: true }, MCP_SERVERS: { USE: true, CREATE: true, SHARE: true, SHARE_PUBLIC: true, CONFIGURE_OBO: true }, REMOTE_AGENTS: { USE: false, CREATE: false, SHARE: false, SHARE_PUBLIC: false }, SKILLS: { USE: true, CREATE: true, SHARE: false, SHARE_PUBLIC: false }, SHARED_LINKS: { CREATE: true, SHARE: true, SHARE_PUBLIC: true }, SCHEDULES: { USE: true, CREATE: true } }, __v: 0 }

After restart:

LibreChat> db.roles.findOne({ name: "USER" }) { _id: ObjectId('6a7b7ba9a2160eb1151c0c6a'), name: 'USER', description: '', permissions: { BOOKMARKS: { USE: true }, PROMPTS: { USE: true, CREATE: true, SHARE: false, SHARE_PUBLIC: false }, MEMORIES: { USE: true, CREATE: true, UPDATE: true, READ: true, OPT_OUT: true }, AGENTS: { USE: true, CREATE: true, SHARE: false, SHARE_PUBLIC: false }, MULTI_CONVO: { USE: true }, TEMPORARY_CHAT: { USE: true }, RUN_CODE: { USE: true }, WEB_SEARCH: { USE: true }, PEOPLE_PICKER: { VIEW_USERS: true, VIEW_GROUPS: true, VIEW_ROLES: true }, MARKETPLACE: { USE: false }, FILE_SEARCH: { USE: true }, FILE_CITATIONS: { USE: true }, MCP_SERVERS: { USE: true, CREATE: false, SHARE: true, SHARE_PUBLIC: true, CONFIGURE_OBO: true }, REMOTE_AGENTS: { USE: false, CREATE: false, SHARE: false, SHARE_PUBLIC: false }, SKILLS: { USE: true, CREATE: true, SHARE: false, SHARE_PUBLIC: false }, SHARED_LINKS: { CREATE: true, SHARE: true, SHARE_PUBLIC: true }, SCHEDULES: { USE: true, CREATE: true } }, __v: 0 }

[Sagargupta16]

That reset is LibreChat itself, not your config. On every startup updateInterfacePermissions runs a block labelled "One-time migration: correct MCP_SERVERS.CREATE for USER role" in packages/api/src/app/permissions.ts. It fires when the USER role in Mongo has MCP_SERVERS.CREATE: true, the built-in default for USER is CREATE: false (roles.ts), and librechat.yaml does not set interface.mcpServers.create. All three hold for you, so each restart writes CREATE back to false. With DEBUG_LOGGING=true the log shows Role 'USER': Migrating MCP_SERVERS.CREATE from true to false (Zod default correction).

Set the key explicitly and the block is skipped:

interface:
  mcpServers:
    create: true

Only the keys you list under mcpServers are re-applied at start. share, public and configureObo keep whatever the admin panel set unless you add them too. The interface docs describe these keys as the way to seed the USER role from a file, which is what you need here.

The block has no "already ran" marker, so it is a per-boot check rather than a one-time migration. It came in with PR #12308. Worth an issue if you want the admin-panel value to win without the yaml line.

[greenmotion]

AAH! Okay, that explains it. Thank you!