Grok Bot: Gmail multi-account connector shows write tools ON for View-only tokens and attempts OAuth upscope

Ideas Feature Requests
, ,
1

Feature request for product/service

Cursor IDE

Describe the request

Cursor IDE — Grok Bot

What

Gmail MCP in Grok Bot / Cursor: tools are one global list for the connector. They are not nested under each authenticated account. After a Google-side wipe and re-auth with only “View your email messages and settings,” Send / Reply / Forward / Create draft still show ON. A write call is attempted, then the client tries to upscope the OAuth grant.

Repro

  1. Connect Gmail with three Google accounts on one Gmail connector.
  2. On two accounts: remove Cursor at Google (third-party access), delete the account from Grok Bot, re-auth. On the consent screen grant only “View your email messages and settings.” Leave the third account as full mail.
  3. Open the Gmail connector. Tools = 29 of 29 enabled. Send message, Reply, Forward, Create draft are ON. There is no per-account tool list.
  4. Call create_draft on a View-only account.

Result

  • UI: write tools ON for every account.
  • MCP catalog: same 29 tools on each account id.
  • create_draft: HTTP 403 after trying upscoping. Google refused. The client asked for more scope than the user granted.

Expected

  • Tool toggles nested under each account.
  • View-only tokens do not show Send/Reply/Forward as ON.
  • A write tool on a readonly grant fails closed. No silent upscope attempt.

Why it matters

The real lock is the Google token. The product UI and tool catalog say the opposite. If anyone clicks through the upscope prompt, a “read-only” mailbox can send as that user. Connectors are account-wide, not per-agent.

Related:

Version: Grok Bot chat — early beta
Does this stop you: No - Cursor works, but with this issue

Operating System (if it applies)

MacOS

2

Hi there!

We detected that this may be a bug report, so we’ve moved your post to the Bug Reports category.

To help us investigate and fix this faster, could you edit your original post to include the details from the template below?

Bug Report Template - Click to expand

Where does the bug appear (feature/product)?

  • Editor, Tab & Chat (autocomplete, Composer, in-editor agent)
  • Terminal & commands
  • Models, pricing & API keys (availability, Auto/Max, BYOK/Bedrock)
  • MCP & tools
  • Cloud Agents & Automations (cursor.com/agents, scheduled/event)
  • BugBot & Code Review
  • Cursor CLI
  • Cursor Mobile
  • Remote (SSH / Dev Containers / WSL)
  • Account, billing & login
  • Something else…

Describe the Bug
A clear and concise description of what the bug is.

Steps to Reproduce
How can you reproduce this bug? We have a much better chance at fixing issues if we can reproduce them!

  1. …
  2. …
  3. …

Expected Behavior
What is meant to happen here that isn’t working correctly?

Screenshots / Screen Recordings
If applicable, attach images or videos (.jpg, .png, .gif, .mp4, .mov)

Operating System

  • Windows 10/11
  • MacOS
  • Linux

Version Information

  • For Cursor IDE: Menu → About Cursor → Copy
  • For Cursor CLI: Run agent about in your terminal
IDE:
Version: 2.xx.x
VSCode Version: 1.105.1
Commit: ......

CLI:
CLI Version 2026.01.17-d239e66

For AI issues: which model did you use?
Model name (e.g., Sonnet 4, Tab…)

For AI issues: add Request ID with privacy disabled
Request ID: f9a7046a-279b-47e5-ab48-6e8dc12daba1
For Background Agent issues, also post the ID: bc-…

Additional Information
Add any other context about the problem here.

Does this stop you from using Cursor?

  • Yes - Cursor is unusable
  • Sometimes - I can sometimes use Cursor
  • No - Cursor works, but with this issue

The more details you provide, the easier it is for us to reproduce and fix the issue. Thanks!

5

Same pattern on Drive.

Drive MCP tools are one global list (11 of 11 enabled: create, share, trash). Not nested under each account.

Repro today:

  1. Account A: Google View-only. create_file returned HTTP 403 after the client tried to upscope. Google held.
  2. Account B: write. create_file succeeded on that account’s My Drive.
  3. There is no product control to sandbox writes to one shared drive. My Drive write is the actual grant.

Expected (same as Gmail):

  • Per-account tool toggles.
  • View-only tokens do not show create / share / trash as ON.
  • A write tool on a readonly grant fails closed. No silent upscope.
  • Optional: a real shared-drive-only write scope, so Account B cannot create files in My Drive if the human only wanted one folder.

No client filenames. Happy to add a screenshot of the Drive connector (Accounts Connected + Tools 11 of 11).

6

Same pattern on Calendar.

Calendar MCP tools are one global list (9 of 9 enabled: Create event, Update, Delete, Respond). Not nested under each account.

Repro today:

  1. Account A: Google View-only. create_event returned HTTP 403 after the client tried to upscope. Google held.
  2. Account B: full. create_event on its own calendar succeeded (no guests; then deleted). create_event on Account A’s calendar was denied (no permission).

Expected (same as Gmail and Drive):

  • Per-account tool toggles.
  • View-only tokens do not show Create / Update / Delete / Respond as ON.
  • A write tool on a readonly grant fails closed. No silent upscope.
8

Same pattern on Slack.

The Slack connector is one global scope list for the whole app (chat:write included). There is no View-only / read-only grant. There is no per-account tool list.

What that means:

  1. A human can want Account A = analyze only and Account B = send as that bot identity. The product cannot express that. Installing Slack for Account A includes write.
  2. Consent is all-or-nothing unless the app owner marks scopes optional. Cursor owns the Slack app. There is no Read-only option in the Grok Bot UI.
  3. Same family as Gmail / Drive / Calendar on this topic: the UI and catalog do not match the lock the human actually wanted.

Expected:

  • A Read-only Slack option (no chat:write).
  • Per-account Slack permissions on a multi-account connector, same as the Gmail ask.
  • A write tool on a read-only intent fails closed. No silent upscope / extra-scope consent.