From 3c2e9a9723ca2d2740ee06f8505e590027ea740e Mon Sep 17 00:00:00 2001
From: Tom Moor <tom@getoutline.com>
Date: Tue, 9 Jun 2026 08:38:34 -0400
Subject: [PATCH] fix: Default collections created through MCP to private
 (#12644)

---
 server/routes/api/collections/collections.test.ts | 1 +
 server/tools/collections.test.ts                  | 1 +
 server/tools/collections.ts                       | 3 +--
 3 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/server/routes/api/collections/collections.test.ts b/server/routes/api/collections/collections.test.ts
index d47fbc5aa4..e6ad829fa6 100644
--- a/server/routes/api/collections/collections.test.ts
+++ b/server/routes/api/collections/collections.test.ts
@@ -1241,6 +1241,7 @@ describe("#collections.create", () => {
     expect(body.data.name).toBe("Test");
     expect(body.data.sort.field).toBe("index");
     expect(body.data.sort.direction).toBe("asc");
+    expect(body.data.permission).toBe(null);
     expect(body.policies.length).toBe(1);
     expect(body.policies[0].abilities.read).toBeTruthy();
   });
diff --git a/server/tools/collections.test.ts b/server/tools/collections.test.ts
index 053093862e..7cf0524b1a 100644
--- a/server/tools/collections.test.ts
+++ b/server/tools/collections.test.ts
@@ -60,6 +60,7 @@ describe("collection tools", () => {
     expect(data.color).toEqual("#FF0000");
     expect(data.id).toBeDefined();
     expect(data.url).toMatch(/^https?:\/\//);
+    expect(data.permission).toEqual(null);
   });
 
   it("update_collection updates fields on existing collection", async () => {
diff --git a/server/tools/collections.ts b/server/tools/collections.ts
index 7739258272..47808feda8 100644
--- a/server/tools/collections.ts
+++ b/server/tools/collections.ts
@@ -1,7 +1,6 @@
 import { z } from "zod";
 import { Sequelize, Op, type WhereOptions } from "sequelize";
 import { type McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { CollectionPermission } from "@shared/types";
 import { Collection, Team } from "@server/models";
 import { sequelize } from "@server/storage/database";
 import { authorize } from "@server/policies";
@@ -179,7 +178,7 @@ export function collectionTools(server: McpServer, scopes: string[]) {
             color: input.color,
             teamId: user.teamId,
             createdById: user.id,
-            permission: CollectionPermission.ReadWrite,
+            permission: null,
           });
 
           await collection.saveWithCtx(ctx);