{
  "$type": "site.standard.document",
  "bskyPostRef": {
    "cid": "bafyreictzkigganykzvvey6e43qup226uxs2lk5cv3txtbhksrzw5k5fi4",
    "uri": "at://did:plc:lk3jfj3zq4k4wxnk474axylu/app.bsky.feed.post/3mp5n3yjcspj2"
  },
  "path": "/t/write-actions-blocked-on-custom-mcp-server-business-plan-workspace-developer-mode-unavailable-at-workspace-level/1384381#post_4",
  "publishedAt": "2026-06-25T22:45:45.000Z",
  "site": "https://community.openai.com",
  "textContent": "Thanks for the responses so far. I wanted to share additional findings that narrow this down considerably.\n\nWe have two versions of the same MCP server, with identical tool definitions:\n\n  * **Production server:** `https://mcp.your-domain.com/internal/mcp` → write actions are **BLOCKED**\n  * **QA/testing server:** `https://mcp.your-domain-qa.net/platform02-core/mcp` → write actions work **SUCCESSFULLY**\n\n\n\nThe only difference between them is the domain (`.com` vs `.net`). This strongly suggests the safety layer is evaluating the server’s domain as part of its decision to block write actions.\n\nWe tested two types of write actions to confirm this:\n\n  1. **Creating a new email from scratch**\n     * Production: blocked, no request for writing tools reached our server\n     * QA: succeeded, edit link returned correctly\n  2. **Copying an existing email** (simplest possible write action — no content, no parameters, just a copy)\n     * Production: blocked\n     * QA: succeeded, edit link returned correctly\n\n\n\nThe simple copy test is particularly relevant because it removes any possible variable related to content, URLs, or parameters. The only remaining variable is the server domain.\n\n**What we already tried:**\n\n  * Marked the tools as non-destructive in the tool definition (`destructiveHint: false`)\n  * Simplified the tool call to its bare minimum (only library name and email name, no optional parameters)\n  * Tried a plain copy with no extra parameters whatsoever\n  * Verified server logs: no incoming request is registered when the call is blocked, confirming it never reaches our server\n\n\n\nSo my main question is: does anyone know why write actions are blocked specifically on the `.com` server while the equivalent `.net` one works fine? Any explanation would be super helpful.\n\nThanks again for your help.",
  "title": "Write actions blocked on custom MCP server – Business plan workspace, Developer Mode unavailable at workspace level"
}