fix(security): Scope MCP UI resource caches by server name

[charlesvien]

Problem

Resolves VERIA-352: cross-server MCP UI cache poisoning and capability confusion.

Changes

Key the MCP UI resource caches by (server, uri) so a malicious server can't serve HTML/metadata for a trusted server's resource, and make app tool authorization fail closed so only tools that declared a UI (or opted in with ui.visibility "app") can be invoked from app HTML.

How did you test this?

Unit tests in @posthog/core: cross-server cache isolation, per-server in-flight dedup, and the fail-closed authorization cases.

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

[charlesvien]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• fix(security): Open files in external apps via argv not shell #3805
• fix(security): Confirm repo-provided setup script before running #3804
• fix(security): Enforce CSP on sandboxed MCP app HTML #3803
• fix(security): Run setup discovery agent in plan mode #3802
• fix(security): Scope MCP UI resource caches by server name #3801 👈 (View in Graphite)
• fix(security): Validate agent slug before building ingress host #3800
• fix(security): Keep OAuth token out of terminal environments #3799
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit 315b4a2.}

[greptile-apps]

_{Reviews (1): Last reviewed commit: "scope MCP UI resource caches by server n..." | Re-trigger Greptile}

[stamphog]

Note

🤖 stamphog reviewed 315b4a2e65c3dca6b5620b22afa6eadbe523cf65 — verdict: ESCALATE

This changes MCP resource-cache scoping and tool-call authorization to fix a security vulnerability — squarely security-sensitive surface — but has no independent review; the only signal is a bot reaction, not a substantive approval.

• 👍 on the PR from greptile-apps[bot].
• No top-level or inline reviews are present — only a 👍 reaction from greptile-apps[bot], which is weak evidence and not a substantive review with no unresolved concerns.
• No ownership match and no reported author-familiarity band, so there's no independent-assurance path (owning team or STRONG familiarity) to substitute for a review.
• The change modifies authorization fail-closed logic and cross-server cache keying for a security fix (VERIA-352) — exactly the kind of auth/security-sensitive surface that requires a human or agent-reviewer sign-off before auto-approval, per policy, regardless of code quality or test coverage.

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✓	no deny categories matched
size	✓	55L, 1F substantive, 237L/2F incl. docs/generated/snapshots — within ceiling
tier	✓	T1-agent / T1c-medium (237L, 2F, single-area, fix)
stamphog 2.0.0b3		.stamphog/policy.yml @ 9e6e0ca · reviewed head 315b4a2

Updated in place — this replaces 2 earlier stamphog review(s) on this PR.

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here