diff --git a/frontend/src/lib/components/copilot/chat/global/apiCatalogTools.ts b/frontend/src/lib/components/copilot/chat/global/apiCatalogTools.ts
index a26e218e74..2ad62e0e28 100644
--- a/frontend/src/lib/components/copilot/chat/global/apiCatalogTools.ts
+++ b/frontend/src/lib/components/copilot/chat/global/apiCatalogTools.ts
@@ -45,9 +45,12 @@ const COVERED_ENDPOINTS: Record<string, string> = {
 	createScript: 'write_script',
 	createFlow: 'write_flow',
 	updateFlow: 'patch_flow_json or write_flow',
-	// The catalog exposes the raw-source app endpoints, not `createApp`/`updateApp`.
-	createAppRawSource: 'init_app and the app draft tools',
-	updateAppRawSource: 'write_app_file / write_app_runnable',
+	// Keyed by the name the catalog exposes (`EndpointTool.name`), which is the
+	// `x-mcp-tool-name` override where openapi.yaml sets one — not the operationId.
+	// These two are the only overrides: operations `createAppRawSource` /
+	// `updateAppRawSource`, served as `createApp` / `updateApp`.
+	createApp: 'init_app and the app draft tools',
+	updateApp: 'write_app_file / write_app_runnable',
 	createVariable: 'write_variable',
 	updateVariable: 'write_variable',
 	createResource: 'write_resource',
diff --git a/frontend/src/lib/components/copilot/chat/global/sessionToolset.ts b/frontend/src/lib/components/copilot/chat/global/sessionToolset.ts
index 9d4ece04bd..d76d0db911 100644
--- a/frontend/src/lib/components/copilot/chat/global/sessionToolset.ts
+++ b/frontend/src/lib/components/copilot/chat/global/sessionToolset.ts
@@ -59,11 +59,9 @@ export const SESSION_TOOL_POLICIES: Record<string, SessionToolPolicy> = {
 	exec_datatable_sql: RUN_PREVIEW,
 
 	// ── API catalog and MCP ─────────────────────────────────────────────────
-	// No capability needed: COVERED_ENDPOINTS in apiCatalogTools refuses the authoring
-	// and delete endpoints for everyone, leaving reads and run-by-path. That list is
-	// keyed by operationId and the server serves the catalog unfiltered, so it holds
-	// only as long as it tracks the catalog — the server, not this table, is what
-	// actually refuses a call that slips through.
+	// No capability needed: every endpoint these can reach is a read or a run-by-path.
+	// The authoring and delete endpoints are refused for everyone by COVERED_ENDPOINTS
+	// in apiCatalogTools, so there is no per-role cut left to make here.
 	search_api_endpoints: NONE,
 	call_api_get: NONE,
 	call_api_endpoint: NONE,