fix(mcp): preserve snapshots and protect managed app results

Author: waleedlatif1

apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/file-category.test.ts

@@ -7,7 +7,7 @@ vi.mock('@/lib/uploads/utils/validation', () => ({
 
 vi.mock('@/lib/uploads/utils/file-utils', () => fileUtilsMock)
 
-import { resolveFileCategory } from './file-category'
+import { resolveFileCategory } from '@/lib/uploads/utils/file-category'
 
 describe('resolveFileCategory — MIME priority', () => {
   it('text/plain MIME + .pdf extension → text-editable (MIME wins)', () => {

apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/file-viewer.tsx

@@ -5,6 +5,7 @@ import { Music } from '@sim/emcn/icons'
 import dynamic from 'next/dynamic'
 import type { FileDownloadSource } from '@/lib/uploads/client/download'
 import type { WorkspaceFileRecord } from '@/lib/uploads/contexts/workspace'
+import { resolveFileCategory } from '@/lib/uploads/utils/file-category'
 import { resolveMediaMimeType } from '@/lib/uploads/utils/file-utils'
 import {
   useWorkspaceFileBinary,
@@ -18,7 +19,6 @@ import {
 } from '@/hooks/use-file-content-source'
 import { CsvTablePreview } from './csv-table-preview'
 import { DocxPreview } from './docx-preview'
-import { resolveFileCategory } from './file-category'
 import { ImagePreview } from './image-preview'
 import type { PdfDocumentSource } from './pdf-viewer'
 import { PptxPreview } from './pptx-preview'

apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/index.ts

@@ -1,4 +1,4 @@
-export { resolveFileCategory } from './file-category'
+export { resolveFileCategory } from '@/lib/uploads/utils/file-category'
 export type { PreviewMode } from './file-viewer'
 export {
   FileViewer,

apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/mcp-result/mcp-result.tsx

@@ -3,6 +3,7 @@
 import { useRef, useState } from 'react'
 import { Chip, ChipLink } from '@sim/emcn'
 import { type McpPresentationReceipt, mcpPresentationAssetUrl } from '@/lib/mcp/presentation'
+import { resolveFileCategory } from '@/lib/uploads/utils/file-category'
 import { useChatSurface } from '@/app/workspace/[workspaceId]/home/components/chat-surface-context'
 import { McpApp } from '@/app/workspace/[workspaceId]/home/components/message-content/components/mcp-result/mcp-app'
 import { useOptionalMothershipResources } from '@/app/workspace/[workspaceId]/home/components/mothership-resources-context'
@@ -50,18 +51,20 @@ export function McpResult({ receipt }: McpResultProps) {
             key={`${item.identity}:${item.index}`}
             className='flex min-w-0 flex-col items-start gap-2'
           >
-            {item.kind === 'image' && (
-              <img
-                src={url}
-                alt={item.title}
-                loading='lazy'
-                className='max-h-[400px] max-w-full rounded-lg object-contain'
-              />
-            )}
-            {item.kind === 'audio' && (
-              // biome-ignore lint/a11y/useMediaCaption: MCP audio results do not include a caption track.
-              <audio src={url} controls preload='none' aria-label={item.title} />
-            )}
+            {item.kind === 'image' &&
+              resolveFileCategory(item.mimeType, '') === 'image-previewable' && (
+                <img
+                  src={url}
+                  alt={item.title}
+                  loading='lazy'
+                  className='max-h-[400px] max-w-full rounded-lg object-contain'
+                />
+              )}
+            {item.kind === 'audio' &&
+              resolveFileCategory(item.mimeType, '') === 'audio-previewable' && (
+                // biome-ignore lint/a11y/useMediaCaption: MCP audio results do not include a caption track.
+                <audio src={url} controls preload='none' aria-label={item.title} />
+              )}
             {resources ? (
               <Chip
                 variant='border'

apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-content/components/mcp-resource-content.tsx

@@ -5,7 +5,7 @@ import { getErrorMessage } from '@sim/utils/errors'
 import { mcpPresentationAssetUrl } from '@/lib/mcp/presentation'
 import type { MothershipResource } from '@/lib/mothership/resources/types'
 import type { WorkspaceFileRecord } from '@/lib/uploads/contexts/workspace'
-import { resolveFileCategory } from '@/app/workspace/[workspaceId]/files/components/file-viewer/file-category'
+import { resolveFileCategory } from '@/lib/uploads/utils/file-category'
 import { FileViewer } from '@/app/workspace/[workspaceId]/files/components/file-viewer/file-viewer'
 import { useMcpPresentationMetadata } from '@/hooks/queries/mcp-presentations'
 import type { FileContentSource } from '@/hooks/use-file-content-source'
@@ -41,7 +41,7 @@ function McpArtifactPreview({ chatId, presentationId, index }: McpArtifactPrevie
     ['application/json', 'application/xml'].includes(item.mimeType)
   const previewable =
     plainText ||
-    item.kind === 'image' ||
+    (item.kind === 'image' && resolveFileCategory(item.mimeType, '') === 'image-previewable') ||
     (item.kind === 'audio' && resolveFileCategory(item.mimeType, '') === 'audio-previewable') ||
     item.mimeType === 'application/pdf'
   if (!previewable)

apps/sim/lib/credential-groups/application/authorization.ts

@@ -19,10 +19,7 @@ import {
   isOrganizationCredentialType,
   type OrganizationCredentialType,
 } from '@/lib/credential-groups/credential-types'
-import type {
-  CredentialGroupCredentialListContext,
-  ManagedCredentialGroupBinding,
-} from '@/lib/credential-groups/credentials'
+import type { CredentialGroupCredentialListContext } from '@/lib/credential-groups/credentials'
 import {
   isManagedCredentialGroupBindingLive,
   loadCredentialGroupEnrollmentAccessForSubject,
@@ -108,26 +105,21 @@ export function requireCredentialGroupWorkflowActor(principal: Principal): Princ
 }
 
 /**
- * Authorizes a person using their own Credential Group credential from Chat.
- * The copilot delegation names the signed-in user and no workflow, so only the
+ * Authorizes a person using their own Credential Group credential from Chat or an App.
+ * The session or copilot delegation names the signed-in user and no workflow, so only the
  * actor statement is evaluated: the credential must be the one collected under
  * that user's own live enrollment. Nothing the model passes can widen this;
  * the acting user is the delegation's subject, not a tool argument.
  */
 async function requireCredentialGroupActorCredentialAccess(
-  principal: Extract<Principal, { kind: 'delegated' }>,
+  principal: Principal,
   context: CredentialGroupAuthorizationContext & { credentialGroupEnrollmentId: string },
-  binding: ManagedCredentialGroupBinding | null,
   resourcePolicy: ResourcePolicyBindingFor<'credential_group'>
 ): Promise<void> {
   const subject = resolvePrincipalSubject(principal)
   if (subject?.kind !== 'sim_user' || !subject.userId) {
     throw new OrchestrationError('forbidden', 'Credential Group actor access required')
   }
-  /** Chat mints OAuth credentials only; a credential with no OAuth binding is not its to use. */
-  if (!binding) {
-    throw new OrchestrationError('forbidden', 'Credential Group credential access denied')
-  }
   if (context.organizationId) {
     const actorAccess = await loadCredentialGroupEnrollmentAccessForSubject(
       context.credentialGroupId,
@@ -174,7 +166,11 @@ export async function requireCredentialGroupCredentialAccess(
   },
   resourcePolicy: ResourcePolicyBindingFor<'credential_group'>
 ): Promise<void> {
-  if (principal.kind === 'delegated' && principal.serviceId === 'copilot') {
+  const managedMcp = context.credentialType.startsWith('mcp:')
+  const actorAccess =
+    (principal.kind === 'session' && managedMcp) ||
+    (principal.kind === 'delegated' && principal.serviceId === 'copilot')
+  if (actorAccess) {
     const subject = resolvePrincipalSubject(principal)
     if (subject?.kind !== 'sim_user' || !subject.userId) {
       throw new OrchestrationError('forbidden', 'Credential Group actor access required')
@@ -192,6 +188,9 @@ export async function requireCredentialGroupCredentialAccess(
   if (binding && !isManagedCredentialGroupBindingLive(binding)) {
     throw new OrchestrationError('forbidden', 'Credential Group credential access denied')
   }
+  if (actorAccess && !managedMcp && !binding) {
+    throw new OrchestrationError('forbidden', 'Credential Group credential access denied')
+  }
   if (context.organizationId) {
     if (!isOrganizationCredentialType(context.credentialType))
       throw new Error('Organization credential access requires a canonical credential type')
@@ -200,8 +199,8 @@ export async function requireCredentialGroupCredentialAccess(
       context.credentialType
     )
   }
-  if (principal.kind === 'delegated' && principal.serviceId === 'copilot') {
-    return requireCredentialGroupActorCredentialAccess(principal, context, binding, resourcePolicy)
+  if (actorAccess) {
+    return requireCredentialGroupActorCredentialAccess(principal, context, resourcePolicy)
   }
   if (!context.organizationId) {
     throw new OrchestrationError(

apps/sim/lib/credentials/application/discover-managed-mcp-tools.ts

@@ -1,5 +1,5 @@
 import { AuditAction, AuditResourceType } from '@sim/audit'
-import { resolvePrincipalSubject } from '@sim/auth/principal'
+import { resolvePrincipalSubject, resolvePrincipalSubjectUserId } from '@sim/auth/principal'
 import { defineAuthorizedWorkspaceUseCase } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { requireCredentialGroupCredentialAccess } from '@/lib/credential-groups/application/authorization'
@@ -16,12 +16,14 @@ import { snapshotMcpTool } from '@/lib/mcp/presentation-metadata'
 import { mcpService } from '@/lib/mcp/service'
 import { compileMcpToolSchema } from '@/lib/mcp/tool-schema'
 import { assertWorkspaceCapability } from '@/lib/permission-groups/capability-assertions'
+import type { ResolvedSecretTraceProvenanceV1 } from '@/executor/utils/resolved-secret-trace-registry'
 
 export interface DiscoverManagedMcpToolsInput {
   workspaceId: string
   credentialId: string
   assertedServerId?: string
   signal?: AbortSignal
+  onResolvedSecretTraceProvenance?: (provenance: ResolvedSecretTraceProvenanceV1) => void
 }
 
 export const discoverManagedMcpToolsUseCase = defineAuthorizedWorkspaceUseCase({
@@ -50,6 +52,7 @@ export const discoverManagedMcpToolsUseCase = defineAuthorizedWorkspaceUseCase({
   },
   async execute({ principal, input, context }) {
     input.signal?.throwIfAborted()
+    const userId = resolvePrincipalSubjectUserId(principal)
     const runtime = await loadManagedMcpRuntimeCredential(context.credentialId, context.workspaceId)
     if (
       runtime.mcpServerId !== context.mcpServerId ||
@@ -70,7 +73,11 @@ export const discoverManagedMcpToolsUseCase = defineAuthorizedWorkspaceUseCase({
         loadProvider: () => loadManagedMcpAuthProvider(runtime.credentialId, runtime.workspaceId),
       },
       input.signal,
-      { requireComplete: true }
+      {
+        requireComplete: true,
+        provenanceScope: userId ? { userId, workspaceId: context.workspaceId } : undefined,
+        onResolvedSecretTraceProvenance: input.onResolvedSecretTraceProvenance,
+      }
     )
     await saveManagedMcpToolSnapshot(
       runtime.credentialId,

apps/sim/lib/internal/mcp/execute-tool.ts

@@ -206,6 +206,10 @@ export const executeMcpTool: InternalToolOperationHandler = async (request) => {
       getRemainingExecutionMs(request.signal)
     )
     const commonInput = {
+      onResolvedSecretTraceProvenance: provenance
+        ? (value: Parameters<ResolvedSecretTraceProvenanceAccumulator['record']>[0]) =>
+            provenance?.record(value)
+        : undefined,
       workspaceId: request.context.workspaceId,
       toolName,
       arguments: args,
@@ -222,9 +226,6 @@ export const executeMcpTool: InternalToolOperationHandler = async (request) => {
       const input: ExecuteMcpToolInput = {
         ...commonInput,
         serverId: target.serverId,
-        onResolvedSecretTraceProvenance: provenance
-          ? (value) => provenance?.record(value)
-          : undefined,
       }
       result = await executeMcpToolUseCase.execute({ principal, input })
     } else {

apps/sim/lib/internal/mcp/presentation.ts

@@ -1,4 +1,4 @@
-import { CallToolResultSchema } from '@modelcontextprotocol/sdk/types.js'
+import { CallToolResultSchema, ReadResourceResultSchema } from '@modelcontextprotocol/sdk/types.js'
 import { createLogger } from '@sim/logger'
 import { isPlainRecord } from '@sim/utils/object'
 import {
@@ -51,6 +51,8 @@ export async function presentMcpToolResult(
       const value = {
         arguments: presentation.arguments,
         result: projectMcpEncodedContents(result, registry),
+        resources: projectMcpEncodedContents({ contents: presentation.resources ?? [] }, registry)
+          .contents,
         title: tool.title || tool.name,
       }
       const projection = projectResolvedSecretModelJsonContent(
@@ -72,6 +74,7 @@ export async function presentMcpToolResult(
           tool: { ...tool, title: projection.value.title },
           arguments: projection.value.arguments,
           result: CallToolResultSchema.parse(projection.value.result),
+          resources: ReadResourceResultSchema.shape.contents.parse(projection.value.resources),
           signal,
           secretProvenance: bindDurableSecretProvenanceToValue(
             durableSecretProvenanceFromRegistry(

apps/sim/lib/mcp/application/execute-managed-tool.ts

@@ -1,5 +1,5 @@
 import { AuditAction, AuditResourceType } from '@sim/audit'
-import { resolvePrincipalSubject } from '@sim/auth/principal'
+import { resolvePrincipalSubject, resolvePrincipalSubjectUserId } from '@sim/auth/principal'
 import { defineAuthorizedWorkspaceUseCase } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { requireCredentialGroupCredentialAccess } from '@/lib/credential-groups/application/authorization'
@@ -22,6 +22,7 @@ import {
   loadMcpOperationAccess,
   requireMcpOperationAccess,
 } from '@/lib/mcp/application/operation-access'
+import { createMcpToolPresentation } from '@/lib/mcp/application/presentation'
 import {
   isMcpToolVisible,
   matchesMcpAppOrigin,
@@ -30,6 +31,7 @@ import {
 import { mcpService } from '@/lib/mcp/service'
 import type { McpTool, McpToolCall, McpToolSchema } from '@/lib/mcp/types'
 import { assertWorkspaceCapability } from '@/lib/permission-groups/capability-assertions'
+import type { ResolvedSecretTraceProvenanceV1 } from '@/executor/utils/resolved-secret-trace-registry'
 
 export interface ExecuteManagedMcpToolInput {
   workspaceId: string
@@ -42,6 +44,7 @@ export interface ExecuteManagedMcpToolInput {
   signal?: AbortSignal
   includePresentation?: boolean
   appOrigin?: { toolName: string; resourceUri: string }
+  onResolvedSecretTraceProvenance?: (provenance: ResolvedSecretTraceProvenanceV1) => void
 }
 
 function requireToolSchema(value: unknown): McpToolSchema {
@@ -78,6 +81,7 @@ export const executeManagedMcpToolUseCase = defineAuthorizedWorkspaceUseCase({
   },
   async execute({ principal, input, context }): Promise<ExecuteMcpToolResult> {
     input.signal?.throwIfAborted()
+    const userId = resolvePrincipalSubjectUserId(principal)
     const runtime = await loadManagedMcpRuntimeCredential(context.credentialId, context.workspaceId)
     if (
       runtime.mcpServerId !== context.mcpServerId ||
@@ -103,7 +107,11 @@ export const executeManagedMcpToolUseCase = defineAuthorizedWorkspaceUseCase({
         loadProvider: () => loadManagedMcpAuthProvider(runtime.credentialId, runtime.workspaceId),
       },
       input.signal,
-      { requireComplete: true }
+      {
+        requireComplete: true,
+        provenanceScope: userId ? { userId, workspaceId: context.workspaceId } : undefined,
+        onResolvedSecretTraceProvenance: input.onResolvedSecretTraceProvenance,
+      }
     )
     await saveManagedMcpToolSnapshot(
       runtime.credentialId,
@@ -160,6 +168,9 @@ export const executeManagedMcpToolUseCase = defineAuthorizedWorkspaceUseCase({
       credentialOperations.useManagedMcp.resourcePolicy
     )
     const providerResult = await mcpService.executeManagedMcpTool({
+      userId,
+      workspaceId: context.workspaceId,
+      onResolvedSecretTraceProvenance: input.onResolvedSecretTraceProvenance,
       connectionId: runtime.credentialId,
       serverId: runtime.mcpServerId,
       scope: runtime.scope,
@@ -171,8 +182,26 @@ export const executeManagedMcpToolUseCase = defineAuthorizedWorkspaceUseCase({
     })
     input.signal?.throwIfAborted()
     const result = transformToolResult(providerResult)
-    if (input.includePresentation)
-      result.presentation = { tool, result: providerResult, arguments: args }
+    if (input.includePresentation && userId)
+      result.presentation = await createMcpToolPresentation(
+        { tool, result: providerResult, arguments: args },
+        (uri, signal) =>
+          mcpService.readResource({
+            serverId: current.mcpServerId,
+            workspaceId: context.workspaceId,
+            userId,
+            uri,
+            signal,
+            onResolvedSecretTraceProvenance: input.onResolvedSecretTraceProvenance,
+            managed: {
+              connectionId: context.credentialId,
+              scope: current.scope,
+              loadAuthProvider: () =>
+                loadManagedMcpAuthProvider(context.credentialId, context.workspaceId),
+            },
+          }),
+        input.signal
+      )
     return result
   },
   projectAudit: ({ input, context }) => ({