paperclipai/paperclip · error · ToolGatewayHttpError

actor_agent_mismatch

actor_agent_mismatch

Error message

Agent cannot execute tools as another agent

What it means

executePluginTool identity guard: the agent actor's id does not match the agentId in the run context, so one agent is attempting to execute plugin tools attributed to another agent. The 403 preserves per-agent attribution and audit integrity for plugin tool calls.

Source

Thrown at server/src/services/tool-gateway.ts:6219

          ...(input.body.slug !== undefined || input.body.displaySlug !== undefined ? { displaySlug: input.body.displaySlug ?? input.body.slug } : {}),
          ...(input.body.description !== undefined ? { description: input.body.description ?? null } : {}),
          ...(input.body.status !== undefined ? { status: input.body.status } : {}),
          ...(input.body.profileId !== undefined ? { profileId: input.body.profileId } : {}),
          ...(input.body.defaultProfileMode !== undefined ? { defaultProfileMode: input.body.defaultProfileMode } : {}),
          ...(input.body.contextScopeType !== undefined ? { contextScopeType: input.body.contextScopeType } : {}),
          ...(input.body.contextScopeId !== undefined ? { contextScopeId: input.body.contextScopeId ?? null } : {}),
          ...(input.body.agentId !== undefined ? { agentId: input.body.agentId ?? null } : {}),
          ...(input.body.projectId !== undefined ? { projectId: input.body.projectId ?? null } : {}),
          ...(input.body.issueId !== undefined ? { issueId: input.body.issueId ?? null } : {}),
          ...(input.body.approvalIssueId !== undefined ? { approvalIssueId: input.body.approvalIssueId ?? null } : {}),
          ...(input.body.authConfig !== undefined ? { authConfig: input.body.authConfig } : {}),
          ...(input.body.headerPolicy !== undefined ? { headerPolicy: input.body.headerPolicy } : {}),
          ...(input.body.metadataPolicy !== undefined ? { metadataPolicy: input.body.metadataPolicy } : {}),
          ...(input.body.onDemandToolsConfig !== undefined ? { onDemandToolsConfig: input.body.onDemandToolsConfig } : {}),
          ...(input.body.metadata !== undefined ? { metadata: input.body.metadata ?? {} } : {}),
          updatedAt: new Date(),
        })
        .where(and(eq(toolMcpGateways.companyId, input.companyId), eq(toolMcpGateways.id, input.gatewayId)))
        .returning();
      if (input.body.profileId && input.body.profileId !== existing.profileId) {
        await db
          .insert(toolProfileBindings)
          .values({
            companyId: input.companyId,
            profileId: input.body.profileId,
            targetType: "gateway",
            targetId: input.gatewayId,
            priority: 10,
            metadata: { source: "named_mcp_gateway" },
          })
          .onConflictDoNothing();
      }
      return getGatewayWithTokens(input.companyId, updated.id);
    },

    async createNamedGatewayToken(input: {

View on GitHub (pinned to 01ad858492)

Solutions

1. Execute tools only as the authenticated agent; impersonating another agent is rejected.

When it happens

Trigger: Thrown at server/src/services/tool-gateway.ts:6032 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-08-18). Data as JSON: /api/errors/e6c50c64db056252. Report an issue: GitHub.