Fix cross organization virtual mcp bug

[0xcucumbersalad]

Here's a PR description you can use:

---

What is this contribution about?

Fixes a cross-organization authorization bypass in the virtual MCP/agent routes. Previously, a user could access agents belonging to a different organization by providing a foreign organizationId via the x-org-id or x-org-slug headers. This PR adds a check that verifies the resolved organizationId matches the authenticated user's organization (ctx.organization.id), returning a 403 Forbidden if they don't match.

How to Test

1. Authenticate as a user in Organization A
2. Send a request to /mcp/gateway/:virtualMcpId or /mcp/virtual-mcp/:virtualMcpId with an x-org-id header belonging to Organization B
3. Expected outcome: 403 Forbidden with "Agent does not belong to your organization"
4. Repeat with a valid x-org-id for Organization A — request should succeed as before

---

Summary by cubic

Fixes an auth bypass that let users access agents in other organizations on virtual MCP routes by spoofing x-org-id/x-org-slug. The server now validates virtualMcp.organization_id against ctx.organization.id and returns 403 (“Forbidden: Agent does not belong to your organization”) when they differ.

^{Written for commit 3aee08b. Summary will update on new commits.}

[github-actions]

Release Options

Should a new version be published when this PR is merged?

React with an emoji to vote on the release type:

Reaction	Type	Next Version
👍	Prerelease	2.120.2-alpha.1
🎉	Patch	2.120.2
❤️	Minor	2.121.0
🚀	Major	3.0.0

Current version: 2.120.1

Deployment

• Deploy to production (triggers ArgoCD sync after Docker image is published)

[github-actions]

🧪 Benchmark

Should we run the Virtual MCP strategy benchmark for this PR?

React with 👍 to run the benchmark.

Reaction	Action
👍	Run quick benchmark (10 & 128 tools)

Benchmark will run on the next push after you react.

[cubic-dev-ai]

1 issue found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/mesh/src/api/routes/virtual-mcp.ts">

<violation number="1" location="apps/mesh/src/api/routes/virtual-mcp.ts:97">
P2: Authorization now compares the optional header-derived organizationId against ctx.organization?.id. When x-org-id/x-org-slug is omitted but a valid virtualMcpId is provided, organizationId is null and this check always 403s, breaking valid requests. Compare the resolved virtualMcp.organization_id to ctx.organization?.id (or guard the check) instead of requiring headers.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}