{"record":{"id":"bef883ef2108ee22","repo":"paperclipai/paperclip","slug":"local-stdio-template-missing","errorCode":"local_stdio_template_missing","errorMessage":"Local stdio MCP connection requires an approved templateId","messagePattern":"Local stdio MCP connection requires an approved templateId","errorType":"http","errorClass":"ToolGatewayHttpError","httpStatus":422,"severity":"error","filePath":"server/src/services/tool-gateway.ts","lineNumber":2672,"sourceCode":"        updatedAt: now,\n      })\n      .where(eq(toolConnections.id, connection.id));\n  }\n\n  function grantRefForCredential(\n    grant: typeof connectionGrants.$inferSelect,\n    ref: McpConnectionCredentialRef,\n  ): ToolCredentialSecretRef | undefined {\n    return grant.credentialSecretRefs.find((candidate) =>\n      candidate.configPath === ref.name || candidate.configPath === `credentials.${ref.name}`,\n    );\n  }\n\n  async function resolveGrantSecretValue(\n    session: ToolGatewaySession,\n    connection: typeof toolConnections.$inferSelect,\n    grant: typeof connectionGrants.$inferSelect,\n    ref: ToolCredentialSecretRef,\n    configPath = ref.configPath,\n  ): Promise<string> {\n    const accessContext = {\n      consumerType: \"tool_connection\" as const,\n      consumerId: connection.id,\n      configPath,\n      actorType: \"system\" as const,\n      actorId: session.agentId,\n      responsibleUserId: grant.subjectUserId,\n      issueId: session.issueId,\n      heartbeatRunId: session.runId,\n    };\n    if (grant.kind !== \"user\") {\n      return secrets.resolveSecretValue(\n        connection.companyId,\n        ref.secretId,\n        ref.versionSelector ?? \"latest\",\n        { accessContext },","sourceCodeStart":2654,"sourceCodeEnd":2690,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/services/tool-gateway.ts#L2654-L2690","documentation":"Guard for local stdio MCP execution: the connection has no approved templateId (blank after trim), meaning no board-approved command template is bound to this connection. Local stdio processes may only launch from approved templates, so the call is rejected until an operator sets an approved template on the connection.","triggerScenarios":"Thrown at server/src/services/tool-gateway.ts:2576 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set an approved templateId on the local stdio MCP connection; unreviewed local commands are not allowed."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}