improvement(api): share the API key workspace policy messages and align MCP discover

[waleedlatif1]

Summary

• Extracts the two workspace API-key policy messages into lib/api-key/policy-messages.ts and adopts them across the routes and tests that previously inlined the same strings
• /api/mcp/discover now lists only workspaces whose setting permits the presented key type, so a listed server URL is always one that credential can actually use

Type of Change

• Improvement

Testing

Unit tests added for discover; MCP, workflows, v1, jobs and api-key suites pass

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 8, 2026 8:44pm

[cursor]

PR Summary

Medium Risk
Touches API-key authorization messaging and MCP discover visibility for personal keys; behavior is tightened for consistency with existing serve/execute gates, not a new policy surface.

Overview
Introduces lib/api-key/policy-messages.ts with shared WORKSPACE_KEY_SCOPE_DENIED and PERSONAL_KEY_DENIED strings, and replaces duplicated inline 403 messages across jobs, workflows (execute, cancel, by-id, middleware), v1 middleware, and MCP serve routes (tests updated to assert the constants).

/api/mcp/discover now loads isPublic and workspace.allowPersonalApiKeys and, for personal API keys only, filters out private servers on workspaces that disallow personal keys—while still listing public servers. Session and workspace keys see the unfiltered list, matching what /api/mcp/serve/[serverId] will accept.

^{Reviewed by Cursor Bugbot for commit ebeb600. Configure here.}

[greptile-apps]

Greptile Summary

The PR centralizes workspace API-key policy messages and aligns MCP discovery with MCP serve authorization.

• Extracts shared 403 policy messages and adopts them across API routes and tests.
• Filters private MCP servers from personal-key discovery when their workspace disables personal keys.
• Preserves discoverability of public MCP servers because they bypass the workspace API-key policy.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains; the previously reported discovery mismatch is fixed because public servers remain visible while only private servers denied by the workspace personal-key policy are filtered.

Important Files Changed

Filename	Overview
apps/sim/app/api/mcp/discover/route.ts	The server-level visibility predicate now matches MCP serve authorization for public and private servers accessed with personal API keys.
apps/sim/app/api/mcp/discover/route.test.ts	Adds regression coverage for blocked private servers, public-server preservation, sessions, and workspace keys.
apps/sim/app/api/mcp/serve/[serverId]/route.ts	Replaces the inline personal-key denial message without changing authorization behavior.
apps/sim/lib/api-key/policy-messages.ts	Defines the two shared API-key workspace-policy messages used consistently by affected routes.

_{Reviews (2): Last reviewed commit: "fix(mcp): keep public servers listed for..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit ebeb600. Configure here.}