From 68abd0d867355cc71f054e6c69e0311d6714a2b9 Mon Sep 17 00:00:00 2001
From: Joshua Valluru <326636767+joshua-berri@users.noreply.github.com>
Date: Thu, 17 Sep 2026 17:44:29 -0700
Subject: [PATCH] test(mcp): assert the toolset-specific denial reason

---
 tests/e2e/mcp/test_mcp_toolset_enforcement_e2e.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/e2e/mcp/test_mcp_toolset_enforcement_e2e.py b/tests/e2e/mcp/test_mcp_toolset_enforcement_e2e.py
index 1deafdf0ecc..135830c52ed 100644
--- a/tests/e2e/mcp/test_mcp_toolset_enforcement_e2e.py
+++ b/tests/e2e/mcp/test_mcp_toolset_enforcement_e2e.py
@@ -161,7 +161,7 @@ def _assert_principal_toolset(client: McpClient, resources: ResourceManager, pri
         assert replica.await_tools(scoped_key, server_id, expected=expected) == expected
         denied = replica.call_tool(scoped_key, server_id=server_id, name=outside[0], arguments={})
         assert isinstance(denied, UnknownApiError) and denied.status_code == 403, denied
-        assert "access_denied" in denied.body, denied.body
+        assert "is not allowed for your key/team on server" in denied.body, denied.body
         arguments = {"query": f"service:e2e-toolset-{unique_marker()}", "from": DD_SEARCH_FROM}
         granted.assert_arguments_are_documented(arguments)
         result = unwrap(replica.call_tool(scoped_key, server_id=server_id, name=granted.name, arguments=arguments))