paperclipai/paperclip · error · ToolGatewayHttpError

gateway_token_action_denied

gateway_token_action_denied

Error message

Gateway bearer token is not allowed to perform this MCP action

What it means

assertGatewayTokenAction denied a bearer-token MCP request because the named gateway token's allowedActions list does not include the requested action (e.g. a discovery-only token attempting tools/call). A tool_gateway.call_denied audit entry is written with reason gateway_token_action_denied; the fix is to use a token granted that action.

Source

Thrown at server/src/services/tool-gateway.ts:1362

      entityType,
      entityId,
      agentId: input.agentId,
      runId: input.runId,
      issueId: input.issueId,
      details: {
        gatewaySessionId: input.session?.id ?? null,
        gatewayId: input.session?.gatewayId ?? null,
        gatewayPublicId: input.session?.gatewayPublicId ?? null,
        issueId: input.issueId,
        projectId: input.session?.projectId ?? null,
        runId: input.runId,
        ...input.details,
      },
    });
  }

  async function writeSessionAuthFailure(
    row: typeof toolGatewaySessions.$inferSelect,
    reasonCode: string,
    details: Record<string, unknown> = {},
  ) {
    const session = gatewaySessionFromRow(row);
    await writeAudit({
      session,
      companyId: session.companyId,
      agentId: session.agentId,
      runId: session.runId,
      issueId: session.issueId,
      action: "tool_gateway.session_rejected",
      details: {
        decision: "deny",
        reasonCode,
        expiresAt: session.expiresAt.toISOString(),
        revokedAt: row.revokedAt?.toISOString() ?? null,
        ...details,
      },

View on GitHub (pinned to 01ad858492)

Solutions

1. The bearer token lacks scope for this MCP action. Use a token issued with the required action permissions or an agent-scoped session.

When it happens

Trigger: Thrown at server/src/services/tool-gateway.ts:1343 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-08-18). Data as JSON: /api/errors/e5d6816efd765fc1. Report an issue: GitHub.