fix

apps/server/src/core/space/services/space.service.ts

@@ -139,7 +139,7 @@ export class SpaceService {
       });
 
       if (
-        !this.licenseCheckService.hasFeature(workspace.licenseKey, 'security:settings')
+        !this.licenseCheckService.hasFeature(workspace.licenseKey, 'security:settings', workspace.plan)
       ) {
         throw new ForbiddenException(
           'This feature requires a valid license',

apps/server/src/core/workspace/services/workspace.service.ts

@@ -329,7 +329,7 @@ export class WorkspaceService {
     ) {
       const ws = await this.db
         .selectFrom('workspaces')
-        .select(['id', 'licenseKey', 'trashRetentionDays'])
+        .select(['id', 'licenseKey', 'plan', 'trashRetentionDays'])
         .where('id', '=', workspaceId)
         .executeTakeFirst();
 
@@ -337,10 +337,24 @@ export class WorkspaceService {
         throw new NotFoundException('Workspace not found');
       }
 
-      if (!this.licenseCheckService.hasFeature(ws.licenseKey, 'security:settings')) {
-        throw new ForbiddenException(
-          'This feature requires a valid license',
-        );
+      if (typeof updateWorkspaceDto.mcpEnabled !== 'undefined') {
+        if (!this.licenseCheckService.hasFeature(ws.licenseKey, 'mcp', ws.plan)) {
+          throw new ForbiddenException(
+            'This feature requires a valid license',
+          );
+        }
+      }
+
+      if (
+        typeof updateWorkspaceDto.disablePublicSharing !== 'undefined' ||
+        typeof updateWorkspaceDto.trashRetentionDays !== 'undefined' ||
+        typeof updateWorkspaceDto.restrictApiToAdmins !== 'undefined'
+      ) {
+        if (!this.licenseCheckService.hasFeature(ws.licenseKey, 'security:settings', ws.plan)) {
+          throw new ForbiddenException(
+            'This feature requires a valid license',
+          );
+        }
       }
 
       if (

apps/server/src/integrations/environment/license-check.service.ts

@@ -26,9 +26,15 @@ export class LicenseCheckService {
     }
   }
 
-  hasFeature(licenseKey: string, feature: string): boolean {
+  hasFeature(licenseKey: string, feature: string, plan?: string): boolean {
     if (this.environmentService.isCloud()) {
-      return true;
+      try {
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const { getFeaturesForCloudPlan } = require('../../ee/licence/feature-registry');
+        return getFeaturesForCloudPlan(plan).has(feature);
+      } catch {
+        return false;
+      }
     }
 
     try {