🛂 fix: Gate MCP Queries Behind USE Permission to Prevent 403 Spam

[danny-avila]

Closes #12342

Summary

Fixed unconditional MCP data-fetching that flooded backend logs with 403 Forbidden errors whenever interface.mcpServers.use: false was set in librechat.yaml. Closes #12342.

• Added a useHasAccess({ permissionType: PermissionTypes.MCP_SERVERS, permission: Permissions.USE }) check in useAppStartup and passed the resulting canUseMcp boolean as enabled to both useMCPServersQuery and useMCPToolsQuery, preventing either query from firing on startup, window focus, or stale intervals when the user lacks the permission.
• Applied the same enabled: canUseMcp guard to useMCPServersQuery and useGetAllEffectivePermissionsQuery in useMCPServerManager, matching the guard pattern already used by MCP UI rendering components (MCPTools, ToolsDropdown, MCPSelect).
• Added useAppStartup.spec.tsx with 6 test cases covering: correct permission type/permission passed to useHasAccess, both queries suppressed when canUseMcp is false, both queries enabled when permission is granted with servers loaded and user present, and tools query suppressed independently when the user prop is undefined, the servers object is empty, or servers are still loading.
• Corrected local import order in useAppStartup.ts to comply with longest-to-shortest project convention.
• Sorted the multi-line librechat-data-provider named import block in useMCPServerManager.ts shortest to longest.
• Restored an intent comment on the useGetStartupConfig call in useMCPServerManager to document that it is retained specifically for interface.mcpServers.placeholder.

Change Type

• Bug fix (non-breaking change which fixes an issue)

Testing

Verified the guard using the new unit test suite in client/src/hooks/Config/__tests__/useAppStartup.spec.tsx. To reproduce manually:

Test Configuration:

1. Set interface.mcpServers.use: false in librechat.yaml and restart the backend.
2. Log in and confirm that no requests to GET /api/mcp/servers appear in the browser network tab or backend logs on startup, window focus, or after 30 seconds.
3. Remove the override (or set use: true) and restart — confirm MCP servers load normally and the tools dropdown and agent panel MCP tools render and function correctly.

Checklist

• My code adheres to this project's style guidelines
• I have performed a self-review of my own code
• I have commented in any complex areas of my code
• My changes do not introduce new warnings
• I have written tests demonstrating that my changes are effective or that my feature works
• Local unit tests pass with my changes

[Copilot]

Pull request overview

This PR prevents repeated unauthorized MCP network requests when MCP is disabled for a user (e.g., via interface.mcpServers.use: false), reducing backend 403/log spam by conditionally enabling MCP React Query hooks only when the user has MCP_SERVERS.USE.

Changes:

• Add a useHasAccess (MCP_SERVERS.USE) gate to useAppStartup, disabling useMCPServersQuery and useMCPToolsQuery when access is not granted.
• Add the same access gate to useMCPServerManager, disabling useMCPServersQuery when access is not granted.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
client/src/hooks/Config/useAppStartup.ts	Gates MCP servers/tools startup queries behind MCP_SERVERS.USE permission.
client/src/hooks/MCP/useMCPServerManager.ts	Gates MCP servers query behind MCP_SERVERS.USE permission inside the shared MCP manager hook.

Comments suppressed due to low confidence (1)

client/src/hooks/MCP/useMCPServerManager.ts:48

• useMCPServersQuery is now gated by canUseMcp, but useGetAllEffectivePermissionsQuery(ResourceType.MCPSERVER) still runs unconditionally. If MCP is disabled for the user, this will continue to hit /api/permissions/MCPSERVER/effective/all on mount/stale refetch and can still generate 403/log spam. Consider passing a react-query enabled: canUseMcp (or canUseMcp && !!loadedServers) config to this permissions query as well.

  // Fetch effective permissions for all MCP servers
  const { data: permissionsMap } = useGetAllEffectivePermissionsQuery(ResourceType.MCPSERVER);

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.