Hosted MCP OAuth create_comment returns 403 Unable to verify permissions

[filipenevola]

Summary

The hosted OAuth MCP endpoint can read tasks and execute integration checks, but create_comment fails with HTTP 403 Unable to verify permissions for the same signed-in organization administrator.

Reproduction

Tested 2026-08-14 against the recommended hosted endpoint:

https://mcp.trycomp.ai/mcp

1. Complete MCP OAuth successfully.
2. Call get_tasks — succeeds.
3. Call run_check_for_task on an existing task/check — succeeds and returns a check run ID.
4. Call create_comment for that same task with a short plain-text comment.

Actual result:

{
  "message": "Unable to verify permissions",
  "error": "Forbidden",
  "statusCode": 403
}

Expected: the comment is created using the OAuth user's organization permissions, or a specific Access denied response if the resolved role genuinely lacks comment:create.

Notes

The current main PermissionGuard has a dedicated request.isMcpOAuth branch intended to authorize from the roles resolved by HybridAuthGuard. The generic error above comes from the non-OAuth hasPermission exception path, so the hosted request may not be marked as MCP OAuth for this route, or the hosted API may not include the current OAuth permission path.

No organization, task, user, or comment identifiers are included here.

[linear-code]

COMP-292

[filipenevola]

Additional verification: get_comments for the same existing task also returns the identical HTTP 403 Unable to verify permissions. The authenticated UI can read and create the comments successfully. This appears to affect the hosted OAuth comment permission path generally, not only the create operation.

[filipenevola]

Reproduced again on 2026-08-18 with the hosted OAuth MCP. Read-only task/member/integration calls succeeded, but both get_comments and create_comment for an existing task returned HTTP 403 Unable to verify permissions. The comment was intended to record a current roster-source discrepancy, so this still blocks keeping Comp AI task activity synchronized through MCP. No identifiers are included here.