fix(security): scope workflow target and monitor runner validation to the caller's tags

server/internal/mcp/tools_create.go

@@ -135,6 +135,17 @@ func buildMonitor(args map[string]any) (models.Monitor, error) {
 		return models.Monitor{}, fmt.Errorf("unknown monitor type %q", monitorType)
 	}
 
+	// Runner is deliberately not settable from a tool call, and this refusal
+	// makes that explicit rather than leaving it safe by omission. A runner
+	// is a server ID: accepting one would let an agent push a check onto a
+	// named agent, and a silently ignored argument would leave a model
+	// believing it had. services.CreateMonitor now validates a runner
+	// through GetServerScoped as well, so this is a second line rather than
+	// the only one — but the clearer answer belongs here.
+	if _, present := args["runner"]; present {
+		return models.Monitor{}, fmt.Errorf("runner cannot be set from here; monitors created this way always run on the control plane")
+	}
+
 	interval := 60
 	if n, ok := args["interval_sec"].(float64); ok && int(n) > 0 {
 		interval = int(n)
@@ -214,7 +225,7 @@ func init() {
 				}
 			}
 
-			created, err := services.CreateWorkflow(c.InstanceID, wf)
+			created, err := services.CreateWorkflow(c.InstanceID, wf, c.TokenScope)
 			if err != nil {
 				return nil, fmt.Errorf("could not create the workflow: %w", err)
 			}
@@ -240,7 +251,7 @@ func init() {
 			if err != nil {
 				return nil, err
 			}
-			created, err := services.CreateMonitor(c.InstanceID, &m)
+			created, err := services.CreateMonitor(c.InstanceID, &m, c.TokenScope)
 			if err != nil {
 				return nil, fmt.Errorf("could not create the monitor: %w", err)
 			}