fix(gateway): listed tools/prompts/resources are always callable

A tool could appear in tools/list yet be rejected on call ("not allowed by the
current grants" — e.g. notion_notion-get-users). Root cause: the list path
encodes names via ServerFeature::qualified_name() (alias-or-serverid + "_" +
name), but the call path DECODED via the prefix-cache reverse lookup
(split-on-"_" then get_server_for_prefix), which can be stale or fall back to
the prefix string as server_id — so the (server_id, name) used to authorize
didn''t match the listed feature.

Authorize + route by matching the requested qualified name against the SAME
resolved feature set the list path uses (identical encoding both ways), so
"if it lists, it calls":
- routing.call_tool: find by qualified_name() in resolve_feature_sets; take
  (server_id, tool_name) from the matched feature (no prefix-cache decode).
- handler.get_prompt + read_resource: same treatment.

Also refresh the workspace_binding module doc (exact-match, empty allowed).

Regression test: mcp_flows::listed_tool_is_resolvable_by_qualified_name
(hyphenated names + alias != server_id).

Signed-off-by: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>

Author: its-mash

crates/mcpmux-core/src/domain/workspace_binding.rs

@@ -11,15 +11,15 @@
 //! all to `FeatureService::get_*_for_grants` which composes the union.
 //! This is what lets one folder layer e.g. `Read Only` + `Project-specific
 //! tools` without forcing the user to merge them into a single FS by hand.
-//! Empty `feature_set_ids` is rejected at validation time; storing one
-//! would be indistinguishable from "not bound" yet route via Tier 1.
+//! Empty `feature_set_ids` is allowed — a "no Space tools" mapping: the
+//! folder still routes to its Space (built-in servers apply per Space).
 //!
-//! Path handling is **platform-agnostic**. A binding written on Windows
-//! (`d:\work\proj`) has to match correctly on a Linux host that's just
-//! reading the DB (and vice versa). We detect the path style from the
-//! string itself — drive-letter prefix ⇒ Windows, leading `/` ⇒ POSIX —
-//! rather than from `cfg!(windows)`. Both separators are accepted for
-//! prefix matching regardless of the host OS.
+//! Resolution is an EXACT match on the normalized root — there is no
+//! ancestor/prefix inheritance (`d:\a\b` does not pick up a binding on
+//! `d:\a`). Path handling is still **platform-agnostic**: a binding written
+//! on Windows (`d:\work\proj`) must match on a Linux host reading the DB and
+//! vice versa, so we normalize from the string's own style (drive-letter ⇒
+//! Windows, leading `/` ⇒ POSIX) rather than from `cfg!(windows)`.
 
 use chrono::{DateTime, Utc};
 use serde::{Deserialize, Serialize};

crates/mcpmux-gateway/src/mcp/handler.rs

@@ -940,14 +940,11 @@ impl ServerHandler for McpMuxGatewayHandler {
             )
             .await?;
 
-        let (server_id, prompt_name) = self
-            .services
-            .pool_services
-            .feature_service
-            .parse_qualified_prompt_name(&space_id.to_string(), &params.name)
-            .await
-            .map_err(|e| McpError::invalid_params(format!("Invalid prompt name: {}", e), None))?;
-
+        // Authorize + route by matching the requested qualified name against
+        // the resolved prompt set — the SAME encoding the list path uses
+        // (ServerFeature::qualified_name). Guarantees "if it lists, it's
+        // callable"; no dependency on the prefix-cache reverse lookup (which
+        // could be stale and reject a listed prompt). Mirrors call_tool.
         let authorized_prompts = self
             .services
             .pool_services
@@ -958,16 +955,18 @@ impl ServerHandler for McpMuxGatewayHandler {
                 McpError::internal_error(format!("Failed to verify authorization: {}", e), None)
             })?;
 
-        let is_authorized = authorized_prompts
+        let (server_id, prompt_name) = match authorized_prompts
             .iter()
-            .any(|p| p.server_id == server_id && p.feature_name == prompt_name && p.is_available);
-
-        if !is_authorized {
-            return Err(McpError::invalid_params(
-                format!("Prompt '{}' not authorized", params.name),
-                None,
-            ));
-        }
+            .find(|p| p.is_available && p.qualified_name() == params.name)
+        {
+            Some(p) => (p.server_id.clone(), p.feature_name.clone()),
+            None => {
+                return Err(McpError::invalid_params(
+                    format!("Prompt '{}' not authorized", params.name),
+                    None,
+                ));
+            }
+        };
 
         let result_value = self
             .services
@@ -1049,19 +1048,10 @@ impl ServerHandler for McpMuxGatewayHandler {
             )
             .await?;
 
-        let server_id = self
-            .services
-            .pool_services
-            .feature_service
-            .find_server_for_resource(&space_id.to_string(), &params.uri)
-            .await
-            .map_err(|e| {
-                McpError::internal_error(format!("Failed to resolve resource: {}", e), None)
-            })?
-            .ok_or_else(|| {
-                McpError::invalid_params(format!("Resource '{}' not found", params.uri), None)
-            })?;
-
+        // Authorize + route by matching the requested URI against the resolved
+        // resource set (resources are namespaced by URI, so qualified_name ==
+        // feature_name == uri). The server_id comes from the matched feature,
+        // so a listed resource is always readable. Mirrors call_tool / get_prompt.
         let authorized_resources = self
             .services
             .pool_services
@@ -1072,16 +1062,18 @@ impl ServerHandler for McpMuxGatewayHandler {
                 McpError::internal_error(format!("Failed to verify authorization: {}", e), None)
             })?;
 
-        let is_authorized = authorized_resources
+        let server_id = match authorized_resources
             .iter()
-            .any(|r| r.server_id == server_id && r.feature_name == params.uri && r.is_available);
-
-        if !is_authorized {
-            return Err(McpError::invalid_params(
-                format!("Resource '{}' not authorized", params.uri),
-                None,
-            ));
-        }
+            .find(|r| r.is_available && r.qualified_name() == params.uri)
+        {
+            Some(r) => r.server_id.clone(),
+            None => {
+                return Err(McpError::invalid_params(
+                    format!("Resource '{}' not authorized", params.uri),
+                    None,
+                ));
+            }
+        };
 
         let contents_values = self
             .services

crates/mcpmux-gateway/src/pool/routing.rs

@@ -189,59 +189,44 @@ impl RoutingService {
     ) -> Result<ToolCallResult> {
         let space_id_str = space_id.to_string();
 
-        // 1. Find the server that provides this tool
-        let (server_id, actual_tool_name) = self
-            .feature_service
-            .find_server_for_qualified_tool(&space_id_str, tool_name)
-            .await?
-            .ok_or_else(|| anyhow!("Tool '{}' not found", tool_name))?;
-
-        // 2. Check if the tool is allowed by grants
+        // Authorize AND route in one step by matching the requested qualified
+        // name against the resolved feature set — using the SAME encoding the
+        // list path uses (`ServerFeature::qualified_name`). This guarantees
+        // "if it lists, it calls": the (server_id, tool_name) we route to come
+        // straight from the matched feature, so there's no dependency on the
+        // prefix-cache reverse lookup, which could be stale and surface a
+        // listed tool as "not allowed by the current grants".
         let allowed_features = self
             .feature_service
             .resolve_feature_sets(&space_id_str, feature_set_ids)
             .await?;
 
-        info!(
-            "[RoutingService] Checking authorization for tool '{}' (server: {}, actual_name: {})",
-            tool_name, server_id, actual_tool_name
-        );
-        info!(
-            "[RoutingService] Feature sets to check: {:?}",
-            feature_set_ids
-        );
-        info!(
-            "[RoutingService] Total allowed features: {}",
-            allowed_features.len()
-        );
-
-        // Log all tool features for debugging
-        let tool_features: Vec<_> = allowed_features
-            .iter()
-            .filter(|f| f.feature_type == FeatureType::Tool)
-            .map(|f| format!("{}::{}", f.server_id, f.feature_name))
-            .collect();
-        info!("[RoutingService] Allowed tools: {:?}", tool_features);
-
-        let is_allowed = allowed_features.iter().any(|f| {
-            f.feature_type == FeatureType::Tool
-                && f.server_id == server_id
-                && f.feature_name == actual_tool_name
-                && f.is_available
+        let feature = allowed_features.iter().find(|f| {
+            f.feature_type == FeatureType::Tool && f.is_available && f.qualified_name() == tool_name
         });
 
-        if !is_allowed {
-            warn!(
-                "[RoutingService] Tool '{}' NOT allowed. Looking for server_id='{}', feature_name='{}', is_available=true",
-                tool_name, server_id, actual_tool_name
-            );
-            return Err(anyhow!(
-                "Tool '{}' is not allowed by the current grants",
-                tool_name
-            ));
-        }
+        let (server_id, actual_tool_name) = match feature {
+            Some(f) => (f.server_id.clone(), f.feature_name.clone()),
+            None => {
+                let available = allowed_features
+                    .iter()
+                    .filter(|f| f.feature_type == FeatureType::Tool && f.is_available)
+                    .count();
+                warn!(
+                    "[RoutingService] Tool '{}' not in the resolved feature set ({} tools available)",
+                    tool_name, available
+                );
+                return Err(anyhow!(
+                    "Tool '{}' is not allowed by the current grants",
+                    tool_name
+                ));
+            }
+        };
 
-        info!("[RoutingService] Tool '{}' is ALLOWED", tool_name);
+        info!(
+            "[RoutingService] Tool '{}' ALLOWED → server={}, tool={}",
+            tool_name, server_id, actual_tool_name
+        );
 
         info!(
             "[RoutingService] Calling tool {} on server {}",

tests/rust/tests/integration/mcp_flows.rs

@@ -242,6 +242,61 @@ async fn test_call_tool_unauthorized() {
     assert_eq!(tools.len(), 0, "No tools should be authorized");
 }
 
+/// Regression: every tool that LISTS must be callable. call_tool now authorizes
+/// + routes by matching `qualified_name()` against the SAME resolved feature
+/// set the list path uses, so a listed tool always maps back to exactly one
+/// callable feature — no prefix-cache reverse-lookup that could reject it.
+/// Covers hyphenated tool names under an alias prefix (e.g.
+/// `notion_notion-get-users`), the exact shape that surfaced the bug.
+#[tokio::test]
+async fn listed_tool_is_resolvable_by_qualified_name() {
+    let ctx = TestContext::new();
+    ctx.register_server("notion-mcp-http", Some("notion")).await;
+    ctx.add_feature("notion-mcp-http", "notion-get-users", FeatureType::Tool)
+        .await;
+    ctx.add_feature("notion-mcp-http", "notion-search", FeatureType::Tool)
+        .await;
+    // A second server with a hyphenated alias, to exercise alias≠server_id too.
+    ctx.register_server("idsearch", Some("instant-domain-search"))
+        .await;
+    ctx.add_feature("idsearch", "check_domain_availability", FeatureType::Tool)
+        .await;
+
+    let all = ctx.new_grant_everything_set().await;
+    let all_id = ctx.add_feature_set(all).await;
+
+    let listed = ctx
+        .service
+        .get_tools_for_grants(&ctx.space_id, &[all_id.clone()])
+        .await
+        .unwrap();
+    let resolved = ctx
+        .service
+        .resolve_feature_sets(&ctx.space_id, &[all_id])
+        .await
+        .unwrap();
+
+    // The hyphen-under-alias tool lists with the exact qualified name.
+    assert!(listed
+        .iter()
+        .any(|t| t.qualified_name() == "notion_notion-get-users"));
+
+    // Every listed tool maps back to EXACTLY ONE callable feature by qualified
+    // name — the invariant call_tool relies on for authorization + routing.
+    for t in &listed {
+        let qn = t.qualified_name();
+        let matches: Vec<_> = resolved
+            .iter()
+            .filter(|f| {
+                f.feature_type == FeatureType::Tool && f.is_available && f.qualified_name() == qn
+            })
+            .collect();
+        assert_eq!(matches.len(), 1, "listed tool {qn} must map to one feature");
+        assert_eq!(matches[0].feature_name, t.feature_name);
+        assert_eq!(matches[0].server_id, t.server_id);
+    }
+}
+
 // ============================================================================
 // RESOURCES FLOW TESTS
 // ============================================================================