diff --git a/api/controllers/console/app/mcp_server.py b/api/controllers/console/app/mcp_server.py
index d03e27b7fae..6d232451043 100644
--- a/api/controllers/console/app/mcp_server.py
+++ b/api/controllers/console/app/mcp_server.py
@@ -190,7 +190,7 @@ class AppMCPServerRefreshController(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
-    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
     @with_current_tenant_id
     @get_app_model
     def post(self, current_tenant_id: str, app_model: App):
diff --git a/api/tests/unit_tests/controllers/console/app/test_mcp_server_response.py b/api/tests/unit_tests/controllers/console/app/test_mcp_server_response.py
index 692b19dc091..075997b40f9 100644
--- a/api/tests/unit_tests/controllers/console/app/test_mcp_server_response.py
+++ b/api/tests/unit_tests/controllers/console/app/test_mcp_server_response.py
@@ -298,7 +298,7 @@ class TestAppMCPServerRefreshController:
         assert hasattr(AppMCPServerRefreshController, "post")
         assert not hasattr(AppMCPServerRefreshController, "get")
 
-    def test_post_requires_app_view_layout_permission(self):
+    def test_post_requires_app_edit_permission(self):
         method = AppMCPServerRefreshController.post
         while "rbac_permission_required" not in method.__code__.co_qualname:
             method = method.__wrapped__
@@ -326,7 +326,7 @@ class TestAppMCPServerRefreshController:
             tenant_id="tenant-1",
             account_id="account-1",
             resource_type=RBACResourceScope.APP,
-            scene=RBACPermission.APP_VIEW_LAYOUT,
+            scene=RBACPermission.APP_EDIT,
             resource_required=True,
             path_args={"app_id": "app-1"},
         )