From 753ba09e6e6210b7d3389907f8f66460c8e97b59 Mon Sep 17 00:00:00 2001 From: mrhid6 Date: Thu, 17 Sep 2026 09:23:14 +0000 Subject: [PATCH] fix(mcp): filter list_incidents by the token's visible servers --- server/internal/mcp/tools_health.go | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/server/internal/mcp/tools_health.go b/server/internal/mcp/tools_health.go index b509bc7..11abe63 100644 --- a/server/internal/mcp/tools_health.go +++ b/server/internal/mcp/tools_health.go @@ -187,6 +187,12 @@ func init() { } } + // Metric incidents name a server, so a server-scoped token sees only + // the ones on servers it can see, matching the REST endpoint. + visible, restricted, err := services.VisibleServerIDs(c.InstanceID, c.TokenScope) + if err != nil { + return nil, fmt.Errorf("could not resolve visible servers: %w", err) + } out := []incidentSummary{} for _, mid := range monitorIDs { if len(out) >= int(limit) { @@ -196,6 +202,7 @@ func init() { if err != nil { return nil, fmt.Errorf("could not list incidents: %w", err) } + incidents = services.FilterByVisibleServer(incidents, func(i models.Incident) string { return i.ServerID }, visible, restricted) name := mid if monitorNames != nil { if n, ok := monitorNames[mid]; ok {