Repository navigation
Annotate Girder MCP tools accurately (source-only follow-up to #1333) #1368
Description
Girder MCP's 72 tools have no annotations, causing conservative Codex approvals for reads. Source-only work in currentbits/girder; no deployments, production changes, or Solenta approval-policy changes.
Plan:
- Trace every tool to its actual API behavior, including conditional writes.
- Add accurate readOnlyHint/destructiveHint/idempotentHint metadata; keep mutations marked as mutations.
- Add and run a minimal tools/list metadata regression check; review diff and record results.
Complements Solenta #1333; does not close or replace its MCP approval-card fix.
Activity
currentbits commentedon Sep 27, 2026
Audit complete against Girder's local source (75 tools, newer than the reported 72-tool binary). Source-only implementation underway in isolated checkout. Important finding:
secrets.Getinvokes an identity helper that writes a new secrets.key if ciphertext exists but the key is missing; remote runtime/broker/node/cluster reads invoke EnsureNodeKey, which creates node_key and node_key.pub. Consequently deploy_plan/list_deploys and related nominal reads cannot honestly receive unconditional readOnlyHint=true yet. This patch conservatively retains approval hints for those paths and explicitly marks 18 verified reads. Backup verification/PITR create/drop scratch containers/databases; app_config may reseed/tear down staging; create_app templates can deploy. Mutations stay readOnlyHint=false/destructiveHint=true. Minimal JSON-RPC tools/list test reproduced missing metadata before changes and now covers the entire inventory. No Girder API calls or deployment actions performed.currentbits commentedon Sep 27, 2026
Implemented and applied source-only changes in Girder's owning checkout (
cmd/girder-mcp/main.go, newmain_test.go,docs/ISSUES.md). All 75 current-source tools advertise explicit readOnlyHint/destructiveHint/idempotentHint; 18 are verified reads, all other paths retain conservative mutation hints. Seven repeatable mutations advertise idempotence without being marked read-only. Dispatch/auth/input schemas unchanged.Validation: tools/list test failed for missing metadata on baseline, passes after patch; freshly built stdio server returned 75 annotated tools with 18 read-only using a dummy token and unreachable local API URL; full
go test ./...passed (exit 0). Initial sandbox full-suite attempt failed because httptest loopback listeners were denied; unrestricted local rerun passed.Limitation: deploy_plan/list_deploys remain conservative because their helper chains can initialize persistent secrets/SSH keys. This is documented and a separate source-cleanup suggestion was recorded. No deployments, installation of binaries, production calls/settings changes, pushes or commits. Solenta #1333 remains open; this does not fix its approval UI.