AlistGo/alist · error

MCP access not permitted

Error message

MCP access not permitted

What it means

Returned by checkAccess (server/mcp/auth.go:131) when the user passes the meta and role path check but is not an admin and the merged role permissions for reqPath lack the PermMCPAccess bit. This is the dedicated 'may use MCP at all (read-level)' permission, evaluated after path access succeeds.

Source

Thrown at server/mcp/auth.go:131

	reqPath, err := user.JoinPath(path)
	if err != nil {
		return ctx, "", err
	}
	meta, _ := op.GetNearestMeta(reqPath)
	ctx = context.WithValue(ctx, "meta", meta)
	ctx = context.WithValue(ctx, "user", user)
	return ctx, reqPath, nil
}

// checkAccess checks if user can access the path (read).
func checkAccess(user *model.User, reqPath string) error {
	meta, _ := op.GetNearestMeta(reqPath)
	if !common.CanAccessWithRoles(user, meta, reqPath, "") {
		return fmt.Errorf("permission denied")
	}
	perm := common.MergeRolePermissions(user, reqPath)
	if !user.IsAdmin() && !common.HasPermission(perm, common.PermMCPAccess) {
		return fmt.Errorf("MCP access not permitted")
	}
	return nil
}

// checkManage checks if user can perform write operations via MCP.
func checkManage(user *model.User, reqPath string, permBit uint) error {
	if err := checkAccess(user, reqPath); err != nil {
		return err
	}
	perm := common.MergeRolePermissions(user, reqPath)
	if !user.IsAdmin() && !common.HasPermission(perm, common.PermMCPManage) {
		return fmt.Errorf("MCP manage not permitted")
	}
	if !user.IsAdmin() && !common.HasPermission(perm, permBit) {
		return fmt.Errorf("permission denied for this operation")
	}
	return nil
}

View on GitHub (pinned to 843d9dc814)

Solutions

1. Grant the MCP access permission to the user's role in the admin panel
2. Or perform MCP calls as an admin account, which bypasses the bit
3. After enabling MCP, audit roles and add the permission where intended

// before non-admins use MCP, verify the role's permission list includes the 'mcp access' bit

When it happens

Trigger: A non-admin user with otherwise valid path roles calls any MCP read tool without the 'mcp access' permission granted on their role.

Common situations: MCP introduced to an instance after roles were defined, so no existing role carries the bit; admins assuming path access implies MCP access.

Related errors

• MCP manage not permitted
• permission denied for this operation
• user is not allowed to access via FTP
• permission denied
• failed to get download link

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/1707795848641d83. Report an issue: GitHub.