Approving a Bot's access to an app grants every read-only action at once (239 for Shopify) #884

What happens

Approving a Bot's access to an app grants it every read-only action the app has, in one click. For Composio's Shopify toolkit that is 239 actions. The audit row says so:

app_access.approved {"app": "composio-shopify", "bot": "general-assistant", "kind": "grant", "direct": true, "granted": 239}

Every granted tool is sent to the model on every call. 239 on its own is past OpenAI's 128-tool limit, so after one approval the Bot stopped answering anything (see #883). Large catalogues are common: Shopify publishes 407 actions, GitHub 898.

Code: server/src/plugins/plugin-store/app-access.ts (the grant on approval, around the classifyTool(...) === "read" selection).

Reproduce

1. Enable a Composio app with a large catalogue (Shopify, GitHub).
2. Ask a Bot something that makes it request access to that app, and approve it.
3. The Bot now holds every read action of the app; check GET /api/plugins for its grants on that server.

Suggested fix

• Show the number of tools an approval will grant before it is approved, and refuse or warn when it would take the Bot over the provider's tool limit.
• Prefer a narrower default: the reads the Bot actually asked for, a curated set per app, or a cap with "grant more" on the Bot's page.
• Longer term, consider offering large apps through a search or "load tools" step instead of putting every action in every request.