feat(search-mcp): add organization assistant and contextual retrieval (#7636)

Author: waleedlatif1

apps/docs/content/docs/search/index.mdx

@@ -90,6 +90,14 @@ For another client, choose **Other** and use the server URL with Streamable HTTP
 
 Each person signs in with their own Sim account. MCP applies their current organization membership and document access; connecting an app does not add sources or grant new document permissions. To disconnect an app, open **Settings → General → Authorized apps** and revoke it.
 
+MCP provides three tools for your organization:
+
+- **search** finds indexed passages. Narrow results by source, modification date, or document.
+- **read_document** opens an indexed document by ID or its original URL. Read around a matching passage or page through longer documents. Results include a citation link.
+- **chat** asks the Sim Assistant for an answer with citations. Each call starts a new private conversation and can use the same search filters.
+
+Search MCP is available in organization settings. All three tools use the caller’s current document permissions. They do not browse the web or change connected sources.
+
 ## Existing workspace Search
 
 Workspace Search remains separate. Workspace admins add sources through **Search → Add source**; the member-account action is **Create & Invite**. Teammates need workspace access and connect from its source list. Organization Search does not automatically include workspace sources or grant access to workspace content.

apps/sim/app/.well-known/oauth-protected-resource/api/mcp/search/[workspaceId]/route.ts

@@ -10,6 +10,6 @@ export const GET = withRouteHandler(
     if (isAuthDisabled) return new NextResponse(null, { status: 404 })
     const parsed = organizationKnowledgeMcpContract.params.safeParse(await context.params)
     if (!parsed.success) return new NextResponse(null, { status: 404 })
-    return searchMcpResourceMetadata(getSearchMcpUrl('organization', parsed.data.organizationId))
+    return searchMcpResourceMetadata(getSearchMcpUrl(parsed.data.organizationId))
   }
 )

apps/sim/app/.well-known/oauth-protected-resource/api/mcp/search/organizations/[organizationId]/route.ts

@@ -150,7 +150,8 @@ describe('OAuth2 authorize route', () => {
     { scope: 'search:read' },
     { scope: 'api:read', resource: `${BASE_URL}/api/mcp/search/organizations/org-1` },
     { scope: 'search:read unknown', resource: `${BASE_URL}/api/mcp/search/organizations/org-1` },
-    { scope: 'search:read', resource: 'https://evil.example/api/mcp/search/org-1' },
+    { scope: 'search:read', resource: 'https://evil.example/api/mcp/search/organizations/org-1' },
+    { scope: 'search:read', resource: `${BASE_URL}/api/mcp/search/workspace-1` },
   ])('refuses ambiguous or overly broad Search grants: %o', async (params) => {
     const response = await GET(
       request({

apps/sim/app/api/auth/oauth2/authorize/route.test.ts

@@ -33,6 +33,7 @@ beforeEach(() => {
         ...(await req.clone().json()),
         client_id: 'client-1',
         client_id_issued_at: 1788000000,
+        token_endpoint_auth_method: 'none',
       },
       { status: 201 }
     )
@@ -97,9 +98,42 @@ describe('MCP public client registration', () => {
     })
   })
 
+  it.each(['client_secret_post', 'client_secret_basic'])(
+    'lets the provider negotiate Claude-style %s registration to a public client',
+    async (authMethod) => {
+      const response = await POST(
+        request({
+          client_name: 'Claude',
+          redirect_uris: ['https://claude.ai/api/mcp/auth_callback'],
+          token_endpoint_auth_method: authMethod,
+          scope: 'search:read offline_access',
+          grant_types: ['authorization_code', 'refresh_token'],
+          response_types: ['code'],
+          application_type: 'web',
+          client_secret: 'must-not-be-forwarded',
+        })
+      )
+      expect(response.status).toBe(201)
+      const body = await response.json()
+      expect(body.token_endpoint_auth_method).toBe('none')
+      expect(body).not.toHaveProperty('client_secret')
+      const forwarded: Request = mocks.register.mock.calls[0][0]
+      expect(await forwarded.json()).toEqual({
+        client_name: 'Claude',
+        redirect_uris: ['https://claude.ai/api/mcp/auth_callback'],
+        token_endpoint_auth_method: authMethod,
+        scope: 'search:read offline_access',
+        grant_types: ['authorization_code', 'refresh_token'],
+        response_types: ['code'],
+        require_pkce: true,
+      })
+    }
+  )
+
   it.each([
     { ...client, scope: 'api:write' },
-    { ...client, token_endpoint_auth_method: 'client_secret_post' },
+    { ...client, token_endpoint_auth_method: 'private_key_jwt' },
+    { ...client, token_endpoint_auth_method: 'unsupported' },
     { ...client, grant_types: ['client_credentials'] },
     { ...client, redirect_uris: ['http://evil.example/callback'] },
     { ...client, redirect_uris: ['https://*.example/callback'] },

apps/sim/app/api/auth/oauth2/register/route.test.ts

@@ -335,6 +335,27 @@ describe('OAuth token route', () => {
     expect(response.status).toBe(200)
   })
 
+  it.each(['authorization_code', 'refresh_token'])(
+    'rejects removed workspace resources before %s issuance',
+    async (grantType) => {
+      const response = await POST(
+        tokenRequest(
+          new URLSearchParams({
+            grant_type: grantType,
+            client_id: 'search-client',
+            code: 'code',
+            refresh_token: 'sim_ort_original',
+            resource: 'https://sim.example/api/mcp/search/workspace-one',
+          }).toString()
+        )
+      )
+      expect(response.status).toBe(400)
+      await expect(response.json()).resolves.toMatchObject({ error: 'invalid_target' })
+      expect(mocks.betterAuthPost).not.toHaveBeenCalled()
+      expect(mocks.rotate).not.toHaveBeenCalled()
+    }
+  )
+
   it('passes a canonical resource to refresh rotation and preserves omission', async () => {
     const resource = 'https://sim.example/api/mcp/search/organizations/one'
     await POST(

apps/sim/app/api/auth/oauth2/token/route.test.ts

@@ -2,7 +2,7 @@ import { createKnowledgeMcpHandlers } from '@/lib/knowledge/mcp/route-handler'
 
 export const dynamic = 'force-dynamic'
 
-const handlers = createKnowledgeMcpHandlers('organization')
+const handlers = createKnowledgeMcpHandlers()
 
 export const POST = handlers.POST
 export const GET = handlers.GET

apps/sim/app/api/mcp/search/[workspaceId]/route.ts

@@ -1,16 +1,16 @@
 'use client'
 
-import { SearchMcpConnection } from '@/components/search-mcp-connection'
 import { getSearchMcpUrl } from '@/lib/knowledge/mcp/urls'
 import { useOrganizationContext } from '@/app/o/[organizationId]/providers/organization-provider'
+import { SearchMcpConnection } from '@/app/o/[organizationId]/settings/components/search-mcp-connection'
 
 export function OrganizationSearchMcp() {
   const { organization } = useOrganizationContext()
-  const endpoint = getSearchMcpUrl('organization', organization.id)
+  const endpoint = getSearchMcpUrl(organization.id)
 
   return (
     <div className='flex max-w-xl flex-col gap-4'>
-      <SearchMcpConnection key={organization.id} endpoint={endpoint} flush />
+      <SearchMcpConnection key={organization.id} endpoint={endpoint} />
     </div>
   )
 }

apps/sim/app/api/mcp/search/organizations/[organizationId]/route.ts

@@ -2,7 +2,7 @@
 import { act } from 'react'
 import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { SearchMcpConnection } from '@/components/search-mcp-connection'
+import { SearchMcpConnection } from '@/app/o/[organizationId]/settings/components/search-mcp-connection'
 
 const ENDPOINT = 'https://sim.fixture.test/api/mcp/search/organizations/org-1'
 
@@ -30,7 +30,7 @@ describe('Search MCP client connection', () => {
   })
 
   async function render(endpoint = ENDPOINT) {
-    await act(async () => root.render(<SearchMcpConnection endpoint={endpoint} flush />))
+    await act(async () => root.render(<SearchMcpConnection endpoint={endpoint} />))
   }
 
   async function selectClient(label: string) {
@@ -105,10 +105,10 @@ describe('Search MCP client connection', () => {
   })
 
   it('quotes a shell metacharacter in the copied endpoint as a literal', async () => {
-    await render("https://sim.fixture.test/api/mcp/search/workspace'$(example)")
+    await render("https://sim.fixture.test/api/mcp/search/organizations/org'$(example)")
     await selectClient('Claude Code')
     expect(await copyConfiguration()).toBe(
-      "claude mcp add --transport http sim-search 'https://sim.fixture.test/api/mcp/search/workspace'\\''$(example)'"
+      "claude mcp add --transport http sim-search 'https://sim.fixture.test/api/mcp/search/organizations/org'\\''$(example)'"
     )
   })
 
@@ -127,7 +127,7 @@ describe('Search MCP client connection', () => {
       await render()
       await selectClient(client)
       await copyConfiguration()
-      const nextEndpoint = 'https://sim.fixture.test/api/mcp/search/workspace-2'
+      const nextEndpoint = 'https://sim.fixture.test/api/mcp/search/organizations/org-2'
       await render(nextEndpoint)
       const value = await copyConfiguration()
       expect(value).toContain(nextEndpoint)