MCP individual permission controls unresponsive despite canConfigure: true

[dlphoto-ctrl]

Bug report — MCP permission controls not working

I'm requesting help from the Paperclip maintainers with an issue preventing me from configuring individual MCP action permissions.

What happens

I have an installed Home Assistant MCP connection in Paperclip, with 40 discovered actions (32 Read and 8 Write).

All actions currently show Off.

When I try to change the individual Get Entity State action from Off to Ask first, nothing happens. The permission remains Off, and a prohibited cursor appears.

This happens in both Brave and Microsoft Edge.

Expected behaviour

I should be able to change one individual MCP action to Ask first, without enabling all 32 Read actions or any Write actions.

What has already been verified

• My account has organisation Owner and instance Administrator access.
• The permissions API returns HTTP 200 with capabilities.canConfigure: true.
• The bulk permissions dropdown opens, but the individual permission control does not work.
• The problem occurs in two different browsers.
• The installation runs in Docker on a UGREEN NAS.

Technical investigation

The following frontend files were examined:

• PermissionsPanel.tsx
• AppDetail.tsx
• Tooltip wrappers and CSS
• Installed frontend bundle index-YJY9oyby.js

Isolated component and mocked save tests passed, but the reported behaviour has not been reproduced in an automated browser environment.

A separate reproduction package has been prepared containing source hashes, test evidence, a mocked browser harness and disposable-database instructions.

The exact cause remains unknown.

Help requested

Could a Paperclip maintainer please investigate why individual MCP permission controls are unresponsive even when the API reports canConfigure: true?

I need to enable specific read-only actions while leaving all write actions disabled.

I would appreciate guidance on a verified fix rather than further speculative troubleshooting.

No production permissions, deployment settings or credentials have been changed as part of this investigation.