fix(mcp): let getDocument read any accessible document - #1641
Conversation
How to use the Graphite Merge QueueAdd the label Main to this PR to add it to the merge queue. You must have a Graphite account in order to use the merge queue. Sign up using this link. An organization admin has enabled the Graphite Merge Queue in this repository. Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue. This stack of pull requests is managed by Graphite. Learn more about stacking. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Claude finished @MaheshtheDev's task in 1m 29s —— View job PR Review Complete
Overview: Removes an overly restrictive space filter from Analysis: I verified the security claim by examining the code path:
The removed filter was checking if The API-level org authorization remains intact (the author verified foreign-org IDs still 404), so this change removes unnecessary client-side filtering without weakening security. Issues found: None — this is a clean bug fix. Score: 10/10 |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
supermemory-mcp | 4d8a4eb | Sep 02 2026, 09:52 PM |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
supermemory-app | 4d8a4eb | Commit Preview URL | Sep 02 2026, 09:53 PM |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: adbd4d9e10
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const client = deps.getClient() | ||
| const document = await client.getDocument(args.documentId) |
There was a problem hiding this comment.
For a restricted organization member or an OAuth connection granted only selected spaces, this unqualified direct lookup can return a same-organization document whose containerTags are outside the caller's grant when its ID is retained or otherwise known. The repository models these finer-grained boundaries in SessionInfo.scope.tags and SessionInfo.containerTags, while the stated upstream guarantee is only organization scoping; removing the sole tag check therefore exposes the document's full content rather than merely enabling reads from other authorized spaces. Replace the active-space-only check with validation that at least one document tag is among the spaces visible to this token.
Useful? React with 👍 / 👎.
Merge activity
|
getDocument filtered on the caller's active space, so an ID from listDocuments in any other space returned "Document not found". With activeSpace unset the fallback is sm_project_default, which broke most cross-space reads. The API already scopes document reads to the caller's org, so the extra filter added no protection. Verified locally against the mono API: own-space and cross-space IDs now resolve, foreign-org IDs still 404.
adbd4d9 to
4d8a4eb
Compare
2 participants
getDocument filtered on the caller's active space, so an ID from listDocuments in any other space returned "Document not found". With activeSpace unset the fallback is sm_project_default, which broke most cross-space reads.
The API already scopes document reads to the caller's org, so the extra filter added no protection. Verified locally against the mono API: own-space and cross-space IDs now resolve, foreign-org IDs still 404.