[MCP] Accept can_read in a file-defined access grant

[fashxp]

A file-defined MCP server cannot express can_read, so defining one in YAML fails:

Unrecognized option "can_read" under
"pimcore_studio_backend.studio_mcp_servers.foo3.access.shared_users.0".
Available options are "can_access", "can_edit", "name".

0bf234f7 introduced the capability across the DTOs, hydrator, schema and access resolver, but not in the
configuration tree. McpServerAccessEntry::fromMixed() reads can_read and toArray() emits it, so the
settings-store form round-trips a grant the YAML equivalent then rejects. The two config locations disagree
about the same grant shape.

What this changes

Adds can_read to mcpAccessGrantListNode(), defaulting to true rather than false like the other two.
That matches McpServerAccessEntry::fromMixed(), where the flag defaults to true and a bare string name is a
read-only grant: naming someone without saying more lets them see the server. Defaulting it to false would
silently strip visibility from every existing file-defined grant.

The stale docblock describing the grid as {name, can_access, can_edit} is corrected too.

Verified

Unit suite green (889 tests), PHPStan clean. The existing testSharedUsersAndRolesAcceptTheCapabilityGrid
encoded the old two-capability shape and is updated to the three-capability one, including the defaulting
behaviour for a grant that names someone and nothing else.

Checked against a running instance: a YAML-defined server with can_read on its grants now validates, and
debug:config shows all three capabilities normalised per grant.

🤖 Generated with Claude Code

[Copilot]

🔵 Needs a closer look

The change appears correct, but authorization-sensitive defaults warrant final maintainer review.

Pull request overview

Fixes YAML-defined MCP access grants so they support can_read, matching stored grants.

Changes:

• Adds can_read with a backward-compatible true default.
• Updates configuration tests and documentation.
• Covers both user and role grants through the shared configuration node.

The fix addresses the root cause at the configuration boundary, preserves existing behavior, and adds focused regression coverage.

File summaries

File	Description
src/DependencyInjection/Configuration.php	Adds and documents can_read.
tests/Unit/DependencyInjection/McpServersConfigurationTest.php	Verifies explicit and default read grants.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud