From 11ad9801765655f55a34a785b5785e7052a972d4 Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Mon, 2 Nov 2026 18:40:25 -0800
Subject: [PATCH] fix(ui): disable MCP URL edits and table rename for roles the
 server refuses

---
 .../mcp-server-form-modal.tsx                   | 17 ++++++++++++++++-
 .../settings/components/mcp/mcp.tsx             |  1 +
 .../[workspaceId]/tables/[tableId]/table.tsx    |  1 +
 3 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/components/mcp-server-form-modal/mcp-server-form-modal.tsx b/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/components/mcp-server-form-modal/mcp-server-form-modal.tsx
index d1d3ceb4b4c..80853ef5f3c 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/components/mcp-server-form-modal/mcp-server-form-modal.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/components/mcp-server-form-modal/mcp-server-form-modal.tsx
@@ -65,6 +65,8 @@ export interface McpServerFormModalProps {
   allowedMcpDomains: string[] | null
   domainPolicyUnavailable?: boolean
   domainPolicyError?: string
+  /** False locks the URL field: the server refuses a destination change from a non-admin. */
+  canChangeDestination?: boolean
 }
 
 const ENV_VAR_PATTERN = /\{\{[^{}]+\}\}/
@@ -130,6 +132,7 @@ interface FormattedInputProps {
   envVarProps: EnvVarDropdownConfig
   availableEnvVars?: Set<string>
   className?: string
+  disabled?: boolean
   onChange: (e: React.ChangeEvent<HTMLInputElement>) => void
   onScroll: (scrollLeft: number) => void
 }
@@ -143,6 +146,7 @@ function FormattedInput({
   envVarProps,
   availableEnvVars,
   className,
+  disabled,
   onChange,
   onScroll,
 }: FormattedInputProps) {
@@ -159,12 +163,18 @@ function FormattedInput({
         ref={ref}
         placeholder={placeholder}
         value={value}
+        disabled={disabled}
         onChange={onChange}
         onScroll={handleScroll}
         onInput={handleScroll}
         inputClassName='font-sans text-transparent caret-[var(--text-primary)]'
       />
-      <div className='pointer-events-none absolute inset-0 flex items-center overflow-hidden px-2 py-1.5 font-sans text-sm'>
+      <div
+        className={cn(
+          'pointer-events-none absolute inset-0 flex items-center overflow-hidden px-2 py-1.5 font-sans text-sm',
+          disabled && 'opacity-50'
+        )}
+      >
         <div className='whitespace-nowrap' style={{ transform: `translateX(-${scrollLeft}px)` }}>
           {formatDisplayText(value, { availableEnvVars })}
         </div>
@@ -316,6 +326,7 @@ export function McpServerFormModal({
   allowedMcpDomains,
   domainPolicyUnavailable = false,
   domainPolicyError,
+  canChangeDestination = true,
 }: McpServerFormModalProps) {
   const urlInputRef = useRef<HTMLInputElement>(null)
 
@@ -715,6 +726,9 @@ export function McpServerFormModal({
               type='custom'
               title='Server URL'
               error={isDomainBlocked ? 'Domain not permitted by server policy' : undefined}
+              hint={
+                canChangeDestination ? undefined : 'Only workspace admins can change the server URL'
+              }
             >
               <FormattedInput
                 ref={urlInputRef}
@@ -730,6 +744,7 @@ export function McpServerFormModal({
                   onClose: resetEnvVarState,
                 }}
                 availableEnvVars={availableEnvVars}
+                disabled={!canChangeDestination}
                 onChange={(e) => handleInputChange('url', e.target.value)}
                 onScroll={setUrlScrollLeft}
               />
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/mcp.tsx b/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/mcp.tsx
index eefe088e261..bcc31895cad 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/mcp.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/mcp.tsx
@@ -664,6 +664,7 @@ export function MCP() {
             allowedMcpDomains={allowedMcpDomains}
             domainPolicyUnavailable={domainPolicyUnavailable}
             domainPolicyError={domainPolicyError}
+            canChangeDestination={workspacePermissions.canAdmin}
           />
         )}
         {deleteConfirmModal}
diff --git a/apps/sim/app/workspace/[workspaceId]/tables/[tableId]/table.tsx b/apps/sim/app/workspace/[workspaceId]/tables/[tableId]/table.tsx
index 7703b71ad3b..dbd6036d4d2 100644
--- a/apps/sim/app/workspace/[workspaceId]/tables/[tableId]/table.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/tables/[tableId]/table.tsx
@@ -1322,6 +1322,7 @@ export function Table({
                     label: 'Rename',
                     icon: Pencil,
                     onClick: handleStartTableRename,
+                    disabled: userPermissions.canEdit !== true,
                   },
                   ...(userPermissions.canAdmin
                     ? [