🐞 Bug Summary

Public access tokens created in the “All Teams” namespace are able to access team-scoped and private MCP servers and tools, despite the UI explicitly stating that such tokens should be restricted to public-only resources.
This results in unintended privilege escalation and represents a high-priority security issue.

🧩 Affected Component

• mcpgateway - API
• mcpgateway - UI (admin panel)
• mcpgateway.wrapper - stdio wrapper
• Federation or Transports
• CLI, Makefiles, or shell scripts
• Container setup (Docker/Podman/Compose)
• Other (explain below)

🔁 Steps to Reproduce

1. In the admin UI, navigate to 🎫 API Tokens.
2. Select the “All Teams” namespace.
3. Create a new Public Access Token.
   • UI description states the token should have public-only access.
4. In 🖥️ MCP Servers, configure three MCP servers:
   • http://test-mcp-1.mcp.svc.cluster.local/mcp (public)
   • http://test-mcp-2.mcp.svc.cluster.local/mcp (team)
   • http://test-mcp-3.mcp.svc.cluster.local/mcp (private)
   • All servers use streamable HTTP mode.
5. Verify that all tools/resources are discovered correctly.
6. Open the Cloudflare MCP Playground: https://playground.ai.cloudflare.com/
7. Connect to the mcp-context-forge gateway using:
   • URL: https://mcp.example.com/sse
   • Header: Authorization: Bearer <public-token>
8. Observe the list of available tools and MCP servers.

🤔 Expected Behavior

The public access token should only expose tools and resources from:

• Public MCP servers (e.g. test-mcp-1)

The token must not be able to see or invoke:

• Team-scoped MCP servers
• Private MCP servers
• Any non-public tools, resources, or prompts

❗ Actual Behavior

• The public access token can:
  • See all tools from all MCP servers
  • Successfully invoke tools from:
    • test-mcp-2 (team)
    • test-mcp-3 (private)
• Access restrictions described in the UI are not enforced by the API.

This fully bypasses server visibility and access controls.

📓 Logs / Error Output

After manually deleting the token record from the database (since revoking the token via the admin UI leaves related DB records behind), the Cloudflare MCP Playground fails with an authorization error when attempting to reconnect.

🧠 Environment Info

🧩 Additional Context

• Token revocation via the admin UI does not fully clean up token-related records in the database.
• Manual DB deletion is required to cleanup the DB after token invalidation.
• Given the scope of access bypass, this issue should be treated as high priority from a security standpoint.