paperclipai/paperclip · error · ToolGatewayHttpError

actor_company_mismatch

actor_company_mismatch

Error message

Agent key cannot access another company

What it means

executePluginTool tenancy guard: an agent-type actor attempted a plugin tool execution whose runContext.companyId differs from the actor's own companyId. The 403 enforces that agent keys can never touch another company's plugin executions, mirroring the API-key tenancy boundary.

Source

Thrown at server/src/services/tool-gateway.ts:6216

        .set({
          ...(input.body.name !== undefined ? { name: input.body.name } : {}),
          ...(input.body.slug !== undefined || input.body.displaySlug !== undefined ? { slug: input.body.displaySlug ?? input.body.slug } : {}),
          ...(input.body.slug !== undefined || input.body.displaySlug !== undefined ? { displaySlug: input.body.displaySlug ?? input.body.slug } : {}),
          ...(input.body.description !== undefined ? { description: input.body.description ?? null } : {}),
          ...(input.body.status !== undefined ? { status: input.body.status } : {}),
          ...(input.body.profileId !== undefined ? { profileId: input.body.profileId } : {}),
          ...(input.body.defaultProfileMode !== undefined ? { defaultProfileMode: input.body.defaultProfileMode } : {}),
          ...(input.body.contextScopeType !== undefined ? { contextScopeType: input.body.contextScopeType } : {}),
          ...(input.body.contextScopeId !== undefined ? { contextScopeId: input.body.contextScopeId ?? null } : {}),
          ...(input.body.agentId !== undefined ? { agentId: input.body.agentId ?? null } : {}),
          ...(input.body.projectId !== undefined ? { projectId: input.body.projectId ?? null } : {}),
          ...(input.body.issueId !== undefined ? { issueId: input.body.issueId ?? null } : {}),
          ...(input.body.approvalIssueId !== undefined ? { approvalIssueId: input.body.approvalIssueId ?? null } : {}),
          ...(input.body.authConfig !== undefined ? { authConfig: input.body.authConfig } : {}),
          ...(input.body.headerPolicy !== undefined ? { headerPolicy: input.body.headerPolicy } : {}),
          ...(input.body.metadataPolicy !== undefined ? { metadataPolicy: input.body.metadataPolicy } : {}),
          ...(input.body.onDemandToolsConfig !== undefined ? { onDemandToolsConfig: input.body.onDemandToolsConfig } : {}),
          ...(input.body.metadata !== undefined ? { metadata: input.body.metadata ?? {} } : {}),
          updatedAt: new Date(),
        })
        .where(and(eq(toolMcpGateways.companyId, input.companyId), eq(toolMcpGateways.id, input.gatewayId)))
        .returning();
      if (input.body.profileId && input.body.profileId !== existing.profileId) {
        await db
          .insert(toolProfileBindings)
          .values({
            companyId: input.companyId,
            profileId: input.body.profileId,
            targetType: "gateway",
            targetId: input.gatewayId,
            priority: 10,
            metadata: { source: "named_mcp_gateway" },
          })
          .onConflictDoNothing();
      }
      return getGatewayWithTokens(input.companyId, updated.id);

View on GitHub (pinned to 01ad858492)

Solutions

1. Use an agent API key scoped to the same company as the request; cross-company agent access is forbidden.

When it happens

Trigger: Thrown at server/src/services/tool-gateway.ts:6029 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-08-18). Data as JSON: /api/errors/9ecc0d1462149e7b. Report an issue: GitHub.