MCP Reports AI Agent Access Denied Errors for some tool calls
>>> [!note] Migrated issue
<!-- Drupal.org comment -->
<!-- Migrated from issue #3530662. -->
Reported by: [afoster](https://www.drupal.org/user/594458)
>>>
<p> First, thank you for your ongoing work on the MCP contrib project. I appreciate the effort and how awesome MCP in Drupal is.
</p>
<h3>Environment & Setup</h3>
<ul>
<li><strong>Drupal:</strong> 10.4.7</li>
<li><strong>Modules:</strong> AI, AI Agents, OpenAI Provider (all using latest dev releases)</li>
<li><strong>MCP:</strong> v1.1 and latest dev</li>
<li><strong>Authentication:</strong> Tested as both user 1 and a user with the MCP role (all permissions granted)</li>
<li><strong>Clients Tested:</strong>
<ul>
<li>Cursor (STDIO protocol)</li>
<li>Roo Code (STDIO protocol)</li>
<li>MCP Inspector both to the https and http url enpoints (<code>npx @modelcontextprotocol/inspector</code>, HTTP-stream)</li>
</ul>
</li>
</ul>
<h3>What I Tried</h3>
<ul>
<li>Verified AI / Agents configuration and confirmed chat works in the site UI .</li>
<li>Tested a range of MCP and AI tools using MCP Inspector; some tools work, others consistently return errors regardless of authentication method.</li>
<li>Used both user 1 and a fully-permissioned MCP role user to rule out permission inconsistencies.</li>
</ul>
<h3>Issue Details</h3>
<h4>1. General MCP Tool</h4>
<ul>
<li><strong>Status:</strong> Works (returns site name, etc.)</li>
<li>No issues here.</li>
</ul>
<h4>2. Content Tool</h4>
<p><strong>Request Example:</strong></p>
<pre>
{
"method": "tools/call",
"params": {
"name": "content_85d467739a1b4ba46a9b8c4c9516704c",
"arguments": {
"contentType": "page",
"filters": [],
"limit": 10,
"offset": 0,
"sort": {}
},
"_meta": {
"progressToken": 4
}
}
}
</pre><ul>
<li><strong>Response:</strong> MCP error -32603: Internal Error</li>
<li><strong>Drupal Error Log:</strong><br>
<pre>
Exception InvalidArgumentException: "Unknown field: " at /var/www/html/web/modules/contrib/mcp/modules/mcp_extra/src/Plugin/Mcp/Content.php line 493
</pre></li>
<li><strong>Notes:</strong> I suspect missing or misconfigured parameters, but none of the MCP clients (Cursor, Roo Code, Inspector) could successfully prompt for "list recent site content" or similar queries.</li>
</ul>
<h4>3. Content > Additional Configuration > Page Content Type</h4>
<ul>
<li><strong>Resource Template:</strong> Works when entering known <code>node_ids</code> directly.</li>
</ul>
<h4>4. AI Agent Calling – Custom Agent</h4>
<ul>
<li><strong>Agent:</strong> Custom MCP Agent (works in UI chat)</li>
<li><strong>Request Example:</strong><br>
<pre>
{
"method": "tools/call",
"params": {
"name": "aia_00732b0e6e6f3c95bfcee61e700579af",
"arguments": {
"prompt": "list content in site"
},
"_meta": {
"progressToken": 5
}
}
}
</pre></li>
<li><strong>Response:</strong><br>
<pre>
{
"error": "MCP error -32603: Internal Error"
}
</pre></li>
<li><strong>Drupal Error Log:</strong><br>
<pre>
Exception Exception: "You do not have permission to list config entities." at /var/www/html/web/modules/contrib/ai_agents/src/Plugin/AiFunctionCall/ListConfigEntities.php line 114
</pre></li>
<li><strong>Notes:</strong> This happens even as user 1 and with all permissions granted to the MCP role.</li>
</ul>
<h4>5. AI Agent Calling – Taxonomy Agent (Default)</h4>
<ul>
<li><strong>Request Example:</strong><br>
<pre>
{
"method": "tools/call",
"params": {
"name": "aia_57f4bc2d663471cf7a55568f2678b49e",
"arguments": {
"prompt": "list taxonomy vocabularies"
},
"_meta": {
"progressToken": 6
}
}
}
</pre></li>
<li><strong>Response:</strong><br>
<pre>
{
"error": "MCP error -32603: Internal Error"
}
</pre></li>
<li><strong>Drupal Error Log:</strong><br>
<pre>
Exception Exception: "You do not have permission to list config entities." at /var/www/html/web/modules/contrib/ai_agents/src/Plugin/AiFunctionCall/ListConfigEntities.php line 114
</pre></li>
<li><strong>Notes:</strong> Same as above, occurs with all permissions and user 1[#].</li>
</ul>
<h3>What I Expect</h3>
<ul>
<li>For the Content tool and AI agents, I expect either a successful response or a clear error indicating what parameter or permission is missing so the agent can retry with a different approach.</li>
<li>I would appreciate guidance on:
<ul>
<li>Required parameters for the Content tool "list" actions.</li>
<li>Any additional permissions or configuration needed for AI agents to list config entities.</li>
</ul>
</li>
</ul>
<h3>What I Know Already</h3>
<ul>
<li>AI chat works in the site UI, so the base AI config is functional.</li>
<li>These errors are consistent across all authentication methods and clients.</li>
<li>I’ve reviewed the module documentation and tried all relevant permissions and roles.</li>
<li>There is a similar reported issue on Drupal Slack #ai-mcp - <a href="https://drupal.slack.com/archives/C084EAF2UNS/p1750192107386939">https://drupal.slack.com/archives/C084EAF2UNS/p1750192107386939</a></li>
</ul>
<h3>How I Can Help</h3>
<ul>
<li>Happy to provide additional logs, screenshots, or access if needed.</li>
<li>Willing to test patches or config changes and report back results.</li>
</ul>
issue