supabase / mcp / 33877572328

96%

push

github

feat(mcp): hide legacy cost tools from form-capable clients (#411)

Makes `tools/list` adapt to `costConfirmation.enabledTools` to prevent
supported clients from getting prompted twice, from both the legacy
tools and elicitation strategy, surfaced when testing
https://github.com/supabase/platform/pull/37717

The `tools` callback now receives the per-request `ServerContext` so
`tools/list` can vary by client:
- If both `create_project` and `create_branch` are in
`costConfirmation.enabledTools`, `get_cost` and `confirm_cost` are no
longer advertised. They stay callable, so a client that already knows
the names keeps working.
- If only one `create_` tool is enabled, the two cost tools are still
advertised because the other `create_` tool still needs a
`confirm_cost_id`, but their `type` argument is narrowed.
- `create_project` and `create_branch` drop `confirm_cost_id` when
they're in `enabledTools`, since a form-capable client confirms inline
and never needs it.

Legacy clients are unaffected.

## How to review

Run the server over HTTP w/ `costConfirmation` enabled for both tools
and connect a form-capable client (e.g. Claude Code w/ the SDK v2 flag
as described
[here](https://github.com/supabase/mcp/pull/394#pullrequestreview-5097736337)).
The tool list should have no `get_cost` or `confirm_cost`, and
`create_project` no longer has a `confirm_cost_id` argument. Connect
again without declaring `elicitation` and both tools are back.

## Notes

I renamed the test helper `setupFormCapable` to `setupModern` and made
its capabilities explicit via a `FORM_CAPABLE` constant, because
technically legacy clients can have form capabilities.

The #391 test "a supplied `confirm_cost_id` cannot bypass the form" is
now "is rejected". The field isn't in a form-capable client's schema
anymore, so strict arg parsing errors instead of routing to the form.

454 of 487 branches covered (93.22%)

Branch coverage included in aggregate %.

38 of 38 new or added lines in 1 file covered. (100.0%)

3324 of 3426 relevant lines covered (97.02%)

60.36 hits per line