Scope the inbox issue lookups to one workspace

[imshashank]

Follow-up to #244. These two changes were reviewed and written as part of that work but were left out of the merge: the commit existed locally and was never pushed, so #244 merged the state before it. This lands them.

Scope the batch resolvers

list_notifications resolves each row's issue in two batched lookups, and neither was scoped to the caller's workspace. They relied on the invariant that a notification and its entity are written together with the same organization, which does hold, so this was never a cross-workspace leak.

It is still wrong. The comparable resolver in issues.ts runs downstream of getIssue, which has already applied the org and policy checks; these run on raw notification rows with no check at all, and they return the issue's current title. So an account removed from a team still resolves fresh titles for its old notifications, which get_issue would refuse. Both tables carry organization_id, so the predicate is two lines.

Make the type-filter test real

The existing test asserted over an array that was always empty: nothing in the fixture ever produced a second notification type, so [].every(...) passed trivially and the filter was never exercised. It now creates an assigned issue so a differently-typed notification exists, and asserts both that the filtered type comes back and that the other one does not.

Greptile Summary

The PR scopes notification issue and comment resolution to the caller’s workspace and strengthens the notification type-filter test.

• Adds organization predicates to batched comment and issue lookups.
• Passes the authenticated principal’s organization into both resolvers.
• Creates a second notification type and verifies filtered and unfiltered results explicitly.

Confidence Score: 5/5

The PR appears safe to merge with no actionable correctness, security, or test-reliability issues identified.

The new predicates align with existing non-null organization relationships and notification scoping, while the revised test synchronously creates and meaningfully distinguishes both notification types.

Important Files Changed

Filename	Overview
packages/mcp-server/src/tools/inbox.ts	Correctly adds workspace scoping to both batched entity lookups without changing valid notification resolution.
packages/mcp-server/tests/tools/inbox.test.ts	Makes type-filter coverage non-vacuous by creating an assignment notification and checking both inclusion and exclusion.

_{Reviews (1): Last reviewed commit: "fix(mcp): scope the inbox issue lookups ..." | Re-trigger Greptile}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
orbit	Ready	Preview	Aug 8, 2026 7:31pm

[coderabbitai]

Warning

Review limit reached

@imshashank, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 40 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: ec88e3c5-e0a1-4839-bbb1-e411ec47df7b

📥 Commits

Reviewing files that changed from the base of the PR and between 373ca37 and 1c1ac35.

📒 Files selected for processing (2)

• packages/mcp-server/src/tools/inbox.ts
• packages/mcp-server/tests/tools/inbox.test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}