From eb6cbfc5e3f4e7adf9faf7afcead016333ebd908 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Milorad=20FIlipovi=C4=87?= <milorad@n8n.io>
Date: Wed, 19 Nov 2025 19:35:13 +0100
Subject: [PATCH] fix(core): Fix mcp access scope issue (#22031)

---
 .../cli/src/modules/mcp/mcp.settings.controller.ts  | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/packages/cli/src/modules/mcp/mcp.settings.controller.ts b/packages/cli/src/modules/mcp/mcp.settings.controller.ts
index db20f5fa59d..8d5288f4e1d 100644
--- a/packages/cli/src/modules/mcp/mcp.settings.controller.ts
+++ b/packages/cli/src/modules/mcp/mcp.settings.controller.ts
@@ -1,6 +1,15 @@
 import { ModuleRegistry, Logger } from '@n8n/backend-common';
 import { type AuthenticatedRequest, WorkflowEntity } from '@n8n/db';
-import { Body, Post, Get, Patch, RestController, GlobalScope, Param } from '@n8n/decorators';
+import {
+	Body,
+	Post,
+	Get,
+	Patch,
+	RestController,
+	GlobalScope,
+	Param,
+	ProjectScope,
+} from '@n8n/decorators';
 import type { Response } from 'express';
 
 import { UpdateMcpSettingsDto } from './dto/update-mcp-settings.dto';
@@ -57,7 +66,7 @@ export class McpSettingsController {
 		return await this.mcpServerApiKeyService.rotateMcpServerApiKey(req.user);
 	}
 
-	@GlobalScope('mcp:manage')
+	@ProjectScope('workflow:update')
 	@Patch('/workflows/:workflowId/toggle-access')
 	async toggleWorkflowMCPAccess(
 		req: AuthenticatedRequest,