fix(mcp): list verb tools for table-less Resources to any authenticated user (#1940)

`makeVisibleTo` returned false for a Resource with no databaseName/tableName,
so every non-super user saw none of its verb tools in tools/list. That hid
exactly the Resources #1920/#1921 taught to produce rich schemas, and hid
nothing meaningful: tools/call already accepts these tools by name, so the
gate cost discoverability without buying access control.

Return true instead and let the Resource's own allow* predicates enforce at
call time — the contract custom `mcpTools` have always had (they have never
had a listing filter beyond authentication). The table-backed path is
unchanged and still gates on per-table permissions.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0188G62J9fZQg4J9rVuqLzjy

Author: 2 people

components/mcp/tools/application.ts

@@ -708,11 +708,12 @@ function makeVisibleTo(
 	return function visibleTo(user: AuthedUser): boolean {
 		// Super-user sees everything.
 		if (user?.role?.permission?.super_user === true) return true;
-		// Non-table Resources have no static permission gate — runtime allow*
-		// predicates enforce. Conservative default: don't list them for
-		// non-super users; they can still call via tools/call if they know
-		// the tool name (pass-through is documented behavior).
-		if (!databaseName || !tableName) return false;
+		// A Resource with no backing table has no static permission gate to consult, so listing is
+		// open to any authenticated caller and the Resource's own `allow*` predicates enforce at call
+		// time. This matches custom `mcpTools`, which have never had a listing filter beyond
+		// authentication — and hiding these while still accepting `tools/call` on them bought no
+		// security, only undiscoverable tools (#1940).
+		if (!databaseName || !tableName) return true;
 		const perm = getUserTablePermissions(user, databaseName, tableName);
 		if (!perm) return false;
 		if (mode === 'read') return perm.read === true || perm.describe === true;

unitTests/components/mcp/tools/application.test.js

@@ -331,6 +331,33 @@ describe('mcp/tools/application — registration', () => {
 		assert.equal(update.visibleTo(ALICE_WRITE), true);
 	});
 
+	it('lists verb tools for a table-less Resource to any authenticated user (#1940)', () => {
+		// No databaseName/tableName means no static permission gate to consult, so listing is open and
+		// the Resource's own allow* predicates enforce at call time — the same contract custom
+		// `mcpTools` have always had. Hiding these while still accepting tools/call bought no security.
+		const Inventory = makeTableResource({
+			primaryKey: 'sku',
+			attributes: [{ name: 'sku', type: 'String', isPrimaryKey: true }],
+		});
+		_setResourcesForTest(makeRegistry([['Inventory', { Resource: Inventory }]]));
+		registerApplicationTools();
+		for (const name of ['get_Inventory', 'search_Inventory', 'create_Inventory', 'delete_Inventory']) {
+			const tool = getTool(name);
+			assert.ok(tool, `${name} registered`);
+			assert.equal(tool.visibleTo(NOBODY), true, `${name} is listed for a user with no table grants`);
+			assert.equal(tool.visibleTo(SUPER), true, `${name} is listed for super_user`);
+		}
+	});
+
+	it('still gates a table-backed Resource by table permissions after #1940', () => {
+		// Guards against the #1940 change leaking into the table-backed path.
+		const Product = makeTableResource({ databaseName: 'data', tableName: 'product' });
+		_setResourcesForTest(makeRegistry([['Product', { Resource: Product }]]));
+		registerApplicationTools();
+		assert.equal(getTool('get_Product').visibleTo(NOBODY), false);
+		assert.equal(getTool('delete_Product').visibleTo(ALICE_READ), false);
+	});
+
 	it('flags delete_ tools as destructive and get_/search_ as readOnly', () => {
 		const Product = makeTableResource({ databaseName: 'data', tableName: 'product' });
 		_setResourcesForTest(makeRegistry([['Product', { Resource: Product }]]));