Dustin Healy 87341c67c0 fix(mcp): carry apps flag through the request resolver and canonicalize resource-read auth ... resolveMCPAllowlists now returns appsEnabled from the merged tenant-scoped config, so a tenant/role/user override of mcpSettings.apps reaches the registry's per-request resolution and callTool attaches no UI resource for users whose tenant disabled apps. Authorize app-driven resource reads in the canonical (fully percent-decoded) space the server resolves and reject any relative path segment, so a percent-encoded traversal such as %2e%2e%2f can no longer match an advertised template. Exact resources/list matches are unaffected. Trim narrating comments across the MCP Apps changes so the code is self-documenting.		2026-06-29 00:52:58 -07:00
..
__tests__	🗄️ fix: Gate Request-Scoped MCP Servers Out of Persistent Tool Cache (#13672)	2026-06-13 11:26:49 -04:00
Artifacts	🪡 fix: Artifact Edit Saves (#13358)	2026-05-27 22:03:42 -07:00
Config	📨 feat: Custom Headers on Built-in Provider Endpoints (#13742)	2026-06-14 17:02:04 -04:00
Endpoints	💸 feat: Per-Agent Endpoint Token Config in Multi-Endpoint Billing (#13738)	2026-06-14 12:00:32 -04:00
Files	🌐 fix: Centralize Outbound Proxy Handling (#13726)	2026-06-14 10:47:49 -04:00
Runs
Skills	🧬 feat: Add GitHub Skill Sync (#13293)	2026-06-10 21:05:54 -04:00
start	🧬 chore: Align LibreChat With Agents LangChain Upgrade (#12922)	2026-05-03 12:46:01 -04:00
Threads	🪪 fix: Scope Message Conversation Access (#13183)	2026-05-18 17:34:30 -04:00
Tools	🗄️ fix: Gate Request-Scoped MCP Servers Out of Persistent Tool Cache (#13672)	2026-06-13 11:26:49 -04:00
ActionService.js	⏳ fix: Extend and Decouple MCP OAuth Flow Timeouts (#13622)	2026-06-09 17:50:02 -04:00
ActionService.spec.js	⚗️ feat: Agent Context Compaction/Summarization (#12287)	2026-03-21 14:28:56 -04:00
AssistantService.js
AuthService.js	🛂 fix: Normalize Verification Flow Error Responses (#13558)	2026-06-06 15:08:43 -04:00
AuthService.spec.js	🛂 fix: Normalize Verification Flow Error Responses (#13558)	2026-06-06 15:08:43 -04:00
cleanup.js	📦 refactor: Consolidate DB models, encapsulating Mongoose usage in data-schemas (#11830)	2026-03-21 14:28:53 -04:00
createRunBody.js
GraphApiService.js	🪪 feat: Optimized Entra ID Group Sync with Auto-Creation (#12606)	2026-04-13 08:50:52 -04:00
GraphApiService.spec.js
GraphTokenService.js	🔒 feat: Add On-Behalf-Of (OBO) token exchange support for MCP Servers (#13429)	2026-06-01 22:36:18 -04:00
initializeMCPs.js	fix(mcp): carry apps flag through the request resolver and canonicalize resource-read auth	2026-06-29 00:52:58 -07:00
initializeMCPs.spec.js	fix(mcp): harden MCP Apps host security and CJS compatibility	2026-06-28 21:56:28 -07:00
initializeOAuthReconnectManager.js
MCP.js	fix(mcp): proxy resource templates and fail closed on app config resolution	2026-06-25 14:42:14 -07:00
MCP.spec.js	🤫 refactor: Silent MCP OAuth Refresh on Mid-Session 401 (#13369)	2026-06-10 13:12:42 -04:00
MCPRequestContext.js	🪢 fix: Tie MCP Cleanup To Resumable Runs (#13769)	2026-06-15 15:26:03 -04:00
OboPolicyService.js	🔒 feat: Add On-Behalf-Of (OBO) token exchange support for MCP Servers (#13429)	2026-06-01 22:36:18 -04:00
OboTokenService.js	🔒 feat: Add On-Behalf-Of (OBO) token exchange support for MCP Servers (#13429)	2026-06-01 22:36:18 -04:00
OboTokenService.spec.js	🔒 feat: Add On-Behalf-Of (OBO) token exchange support for MCP Servers (#13429)	2026-06-01 22:36:18 -04:00
PermissionService.js	🪪 fix: Filter ACL Principal Details (#13524)	2026-06-05 19:06:41 -04:00
PermissionService.spec.js	🪪 fix: Filter ACL Principal Details (#13524)	2026-06-05 19:06:41 -04:00
PluginService.js
systemGrant.spec.js	📜 feat: Implement System Grants for Capability-Based Authorization (#11896)	2026-03-21 14:28:54 -04:00
ToolService.js	🪵 refactor: Bound Log Traversal And Remove Legacy api/config Logger (#13813)	2026-06-17 12:31:32 -04:00
twoFactorService.js	🔑 fix: Require OTP Verification for 2FA Re-Enrollment and Backup Code Regeneration (#12223)	2026-03-14 01:51:31 -04:00