feat(mcp): hide legacy cost tools from form-capable clients - #411
Merged
Conversation
Coverage Report for CI Build 33806422877Coverage increased (+0.05%) to 96.549%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsNo coverage regressions found. Coverage Stats
💛 - Coveralls |
barryroodt
reviewed
Sep 3, 2026
barryroodt
reviewed
Sep 3, 2026
mattrossman
marked this pull request as ready for review
September 3, 2026 21:18
barryroodt
approved these changes
Sep 4, 2026
barryroodt
left a comment
barryroodt
left a comment
Contributor
There was a problem hiding this comment.
Looks good. Thanks for scoping the omit loop, reads clearly now.
barryroodt
added
the
publish-preview
commit: |
Merged
barryroodt
pushed a commit
that referenced
this pull request
Sep 4, 2026
🤖 I have created a release *beep* *boop* --- <details><summary>mcp-utils: 0.8.0</summary> ## [0.8.0](mcp-utils-v0.7.0...mcp-utils-v0.8.0) (2026-09-04) ### Features * **mcp:** add project cost confirmation elicitation ([#391](#391)) ([fb50882](fb50882)) * **mcp:** hide legacy cost tools from form-capable clients ([#411](#411)) ([2f04461](2f04461)) </details> <details><summary>mcp-server-supabase: 0.12.0</summary> ## [0.12.0](mcp-server-supabase-v0.11.0...mcp-server-supabase-v0.12.0) (2026-09-04) ### Features * group lints in `get_advisors` response ([#390](#390)) ([48d593a](48d593a)) * **mcp:** add branch cost confirmation elicitation ([#394](#394)) ([867a160](867a160)) * **mcp:** add project cost confirmation elicitation ([#391](#391)) ([fb50882](fb50882)) * **mcp:** hide legacy cost tools from form-capable clients ([#411](#411)) ([2f04461](2f04461)) ### Bug Fixes * ensure correct escaping in advisor ([#407](#407)) ([a6cf4a0](a6cf4a0)) * make server instructions intent-based instead of naming tools ([#372](#372)) ([fc54ea2](fc54ea2)) </details> --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: supabase-releaser[bot] <223506987+supabase-releaser[bot]@users.noreply.github.com>
barryroodt
added a commit
that referenced
this pull request
Sep 4, 2026
Brings in #411 (ctx-aware tools(), hidden get_cost/confirm_cost and confirm_cost_id omission for form-capable clients) and the 0.12.0 release. Conflicts resolved so #411's per-request tool shaping runs under the renamed `confirmation` option; #408's tests migrated from setupFormCapable to setupModern with explicit FORM_CAPABLE capabilities.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Makes
tools/listadapt tocostConfirmation.enabledToolsto prevent supported clients from getting prompted twice, from both the legacy tools and elicitation strategy, surfaced when testing https://github.com/supabase/platform/pull/37717The
toolscallback now receives the per-requestServerContextsotools/listcan vary by client:create_projectandcreate_branchare incostConfirmation.enabledTools,get_costandconfirm_costare no longer advertised. They stay callable, so a client that already knows the names keeps working.create_tool is enabled, the two cost tools are still advertised because the othercreate_tool still needs aconfirm_cost_id, but theirtypeargument is narrowed.create_projectandcreate_branchdropconfirm_cost_idwhen they're inenabledTools, since a form-capable client confirms inline and never needs it.Legacy clients are unaffected.
How to review
Run the server over HTTP w/
costConfirmationenabled for both tools and connect a form-capable client (e.g. Claude Code w/ the SDK v2 flag as described here). The tool list should have noget_costorconfirm_cost, andcreate_projectno longer has aconfirm_cost_idargument. Connect again without declaringelicitationand both tools are back.Notes
I renamed the test helper
setupFormCapabletosetupModernand made its capabilities explicit via aFORM_CAPABLEconstant, because technically legacy clients can have form capabilities.The #391 test "a supplied
confirm_cost_idcannot bypass the form" is now "is rejected". The field isn't in a form-capable client's schema anymore, so strict arg parsing errors instead of routing to the form.