mcp/team: the console flags a server no agent can reach, but cannot fix one

[YellowSnnowmann]

Symptom

Since #568, the MCP tab flags a server no teammate can reach:

No agent can reach this server — no teammate's tool grants cover mcp:linear. Widen a company or per-agent tool grant, or this server is unused.

The console cannot widen a grant. There is no control anywhere in the product that changes which agents reach a server, so the warning ends in an instruction the operator reading it cannot carry out. On a packaged or hosted install they have no company.toml to edit either — that file belongs to whoever ships the company bundle.

This is the shape epic #565 exists to remove: a screen that states something the operator cannot act on. #568 is still worth having — a healthy server nobody can call was invisible before — but it delivers a diagnosis with no cure.

What the console can write today

Verified against main:

Route	Fields it accepts	Effect on reachability
POST …/team (AddMember)	name, role, description, budget_usd_daily	none — an overlay teammate silently inherits the whole company allow (agent_effective_grants(allow, &[])), and cannot be scoped at creation
PATCH …/team/{agent_id} (EditAgent)	name, role, description	none
PUT …/team/{agent_id}/budget	budget_usd_daily	none
PUT …/mcp/servers/{name}	enabled, allowed_tools, disallowed_tools, endpoint, token	enabled: false empties the list; allowed_tools scopes which tools of that server are exposed, never which agents reach it

So the only in-app lever is the on/off toggle, which is all-or-nothing. Everything else requires editing [tools] allow or an agent's tools in company.toml and restarting the host.

Two fixes, not exclusive

1. Make the copy honest (small). The zero-state should say where grants live and who changes them, rather than naming an action the console does not offer. Cheap, removes the false promise, leaves the gap.

2. Make grants editable (the real fix). Per-agent tool grants become a console write, stored on the overlay rather than the manifest — the same shape budget_usd_daily already uses for a per-agent value the manifest also carries.

Worth settling as part of (2):

• Overlay vs manifest. A manifest agent's tools is committed config; an overlay grant would have to layer over it the way runtime MCP servers layer over manifest ones, with the console showing which layer won.
• The company allow ceiling. A per-agent grant can only ever narrow within allow (agent_effective_grants intersects). Editing allow itself is a bigger decision — it is the company-wide ceiling — and may deserve to stay manifest-only.
• Scoping a teammate at creation. AddMember currently cannot, so every console-created teammate starts with the full company allow. That is its own quiet surprise.

Permissions

Admin-only, following the established precedent rather than inventing one: set_budget calls require_admin, add_member requires admin the moment it carries a budget, and #403 put every company-settling MCP write behind AdminScopedCompany. Deciding what an agent may call is squarely "settles something on the company's behalf", so it belongs in the same bracket — a plain member should keep read access and get a 403 on the write.

Acceptance

• The zero-state no longer instructs an action the console cannot perform.
• If grants become editable: an admin can change which agents reach a server from the console, a member cannot, and the change reaches agents on the next turn without a restart (the mcp: the console tells operators to restart for a change that is already live #566 contract).
• Reachability keeps reading agent_effective_grants, so the console and the harness cannot disagree (mcp: nothing shows which agents can actually reach a server #568's rule).

Related

• mcp: nothing shows which agents can actually reach a server #568 (shipped the reachability read-out, PR feat(mcp): surface which agents can reach each MCP server (#568) #631)
• EPIC: MCP and Skills tabs — the console and the harness disagree about what is true #565 (the epic: console and harness disagree about what is true)
• connections: any member can connect a company account or replace its Composio credential #403 (authority over company-settling writes)