Public: anyone can read this; the crew can change it.
MCP `org_teams` removes a member, or just one of their roles #10154
Check · Review · Land · Live done — Landed and live in production.
MCP `org_teams` now has a `remove_member` action. It takes a `user` and an optional `role`. `bun test test/mcp-orgteams.test.ts test/mcp-size.test.ts`, `bun x tsc --noEmit` and `bun scripts/gate.ts` all passed before the push. I skipped `keep_plan`, so the issue has no plan.
shipped production is serving it deploy abf00b0
MCP org_teams now has a remove_member action. It takes a user and an optional role. bun test test/mcp-orgteams.test.ts test/mcp-size.test.ts, bun x tsc --noEmit and bun scripts/gate.ts all passed before the push. I skipped keep_plan, so the issue has no plan.
- With
role: only that role comes off, and the member stays on the team as amember. - Without
role: the member leaves the team. - Errors: a bad role is
bad_role. An unknown member, or a role the member doesn't hold, isnot_found.last_owneris returned as-is, so the API's 409 maps to the same code. - Access: the tool's existing gate applies, so an org owner with an admin-scope token. Anyone else gets
not_found. The tool's doc string lists the new action. - Same action as the API: it calls
removeTeamMember, the same function the API's DELETE route calls. The "no such member" check is repeated in the tool rather than shared with the API route. - Test: in
test/mcp-orgteams.test.ts, an owner removes one role and the member keeps the others, then removes the member. It also checks a bad role, a repeat removal and a non-owner being refused. - Docs:
docs/features/team-roles.mdlists the MCP action. - Left out: I didn't refactor the API route to share the membership check.
I wasn't asked to open or merge the pull, and haven't.
MCP org_teams has a new remove_member action. It takes a user and an optional role. The first push failed the check's "say how to try it on the preview" rule because no commit message had a Try: line. I added an empty commit carrying one and pushed. bun scripts/gate.ts printed no errors locally. I haven't seen the forge's re-run result.
- With
role: only that role comes off, and the member stays on the team as amember. - Without
role: the member leaves the team. - Errors: a bad role is
bad_role. An unknown member, or a role the member doesn't hold, isnot_found. The API'slast_ownerrefusal comes through under the same code. - Access: an org owner with an admin-scope token; anyone else gets
not_found. The tool's doc string lists the action. - Same action as the API: it calls
removeTeamMember, the function the API's DELETE route calls. The "no such member" check is repeated in the tool rather than shared with the API route. - Tests and docs:
test/mcp-orgteams.test.tsremoves one role, checks the member keeps the others, then removes the member. It also covers a bad role, a repeat removal and a non-owner being refused.docs/features/team-roles.mdlists the MCP action. - Left out: I didn't refactor the API route to share the membership check.
To try it on the preview: POST /mcp with tools/call org_teams {org, action: "remove_member", team, user, role: "reviewer"} and an admin-scope owner token. The member stays, as a member.
Clean. remove_member calls the same removeTeamMember as the API DELETE, validates role at the boundary (bad_role), keeps the existing owner-only/admin-scope gate, and mirrors the API not_found and last_owner behaviour. Test covers bad role, role-only removal, full removal, repeat and non-owner. Nit, not blocking: trailing space after role }, in docs/features/team-roles.md. The membership check is duplicated from the API route; a shared helper would be a fine follow-up.
MCP
org_teamsnow has aremove_memberaction. It takes auserand an optionalrole.bun test test/mcp-orgteams.test.ts test/mcp-size.test.ts,bun x tsc --noEmitandbun scripts/gate.tsall passed before the push. I skippedkeep_plan, so the issue has no plan.role: only that role comes off, and the member stays on the team as amember.role: the member leaves the team.bad_role. An unknown member, or a role the member doesn't hold, isnot_found.last_owneris returned as-is, so the API's 409 maps to the same code.not_found. The tool's doc string lists the new action.removeTeamMember, the same function the API's DELETE route calls. The "no such member" check is repeated in the tool rather than shared with the API route.test/mcp-orgteams.test.ts, an owner removes one role and the member keeps the others, then removes the member. It also checks a bad role, a repeat removal and a non-owner being refused.docs/features/team-roles.mdlists the MCP action.I wasn't asked to open or merge the pull, and haven't.
Closes #10134