{"record":{"id":"e5d6816efd765fc1","repo":"paperclipai/paperclip","slug":"gateway-token-action-denied","errorCode":"gateway_token_action_denied","errorMessage":"Gateway bearer token is not allowed to perform this MCP action","messagePattern":"Gateway bearer token is not allowed to perform this MCP action","errorType":"http","errorClass":"ToolGatewayHttpError","httpStatus":403,"severity":"error","filePath":"server/src/services/tool-gateway.ts","lineNumber":1362,"sourceCode":"      entityType,\n      entityId,\n      agentId: input.agentId,\n      runId: input.runId,\n      issueId: input.issueId,\n      details: {\n        gatewaySessionId: input.session?.id ?? null,\n        gatewayId: input.session?.gatewayId ?? null,\n        gatewayPublicId: input.session?.gatewayPublicId ?? null,\n        issueId: input.issueId,\n        projectId: input.session?.projectId ?? null,\n        runId: input.runId,\n        ...input.details,\n      },\n    });\n  }\n\n  async function writeSessionAuthFailure(\n    row: typeof toolGatewaySessions.$inferSelect,\n    reasonCode: string,\n    details: Record<string, unknown> = {},\n  ) {\n    const session = gatewaySessionFromRow(row);\n    await writeAudit({\n      session,\n      companyId: session.companyId,\n      agentId: session.agentId,\n      runId: session.runId,\n      issueId: session.issueId,\n      action: \"tool_gateway.session_rejected\",\n      details: {\n        decision: \"deny\",\n        reasonCode,\n        expiresAt: session.expiresAt.toISOString(),\n        revokedAt: row.revokedAt?.toISOString() ?? null,\n        ...details,\n      },","sourceCodeStart":1344,"sourceCodeEnd":1380,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/services/tool-gateway.ts#L1344-L1380","documentation":"assertGatewayTokenAction denied a bearer-token MCP request because the named gateway token's allowedActions list does not include the requested action (e.g. a discovery-only token attempting tools/call). A tool_gateway.call_denied audit entry is written with reason gateway_token_action_denied; the fix is to use a token granted that action.","triggerScenarios":"Thrown at server/src/services/tool-gateway.ts:1343 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["The bearer token lacks scope for this MCP action. Use a token issued with the required action permissions or an agent-scoped session."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}