From 44e6140e27a2741d1c043bc2f903760c1bb9bb9b Mon Sep 17 00:00:00 2001 From: AnnaXWang <6621137+AnnaXWang@users.noreply.github.com> Date: Tue, 23 Jun 2026 04:18:20 +0000 Subject: [PATCH] Add tool annotations to remaining MCP tools Adds title and behavior hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to the 12 tools that were missing them, matching the pattern already used by the credential and API-key tools. All tools now declare annotations, which MCP clients use to label tools and gate destructive actions. Co-Authored-By: Claude Opus 4.7 --- src/lib/mcp/tools/apps.ts | 7 +++++++ src/lib/mcp/tools/browser-curl.ts | 7 +++++++ src/lib/mcp/tools/browser-pools.ts | 7 +++++++ src/lib/mcp/tools/browsers.ts | 7 +++++++ src/lib/mcp/tools/computer-action.ts | 7 +++++++ src/lib/mcp/tools/docs.ts | 7 +++++++ src/lib/mcp/tools/extensions.ts | 7 +++++++ src/lib/mcp/tools/playwright.ts | 7 +++++++ src/lib/mcp/tools/profiles.ts | 7 +++++++ src/lib/mcp/tools/projects.ts | 7 +++++++ src/lib/mcp/tools/proxies.ts | 7 +++++++ src/lib/mcp/tools/shell.ts | 7 +++++++ 12 files changed, 84 insertions(+) diff --git a/src/lib/mcp/tools/apps.ts b/src/lib/mcp/tools/apps.ts index 25e317d..2c49fa8 100644 --- a/src/lib/mcp/tools/apps.ts +++ b/src/lib/mcp/tools/apps.ts @@ -102,6 +102,13 @@ export function registerAppCapabilities(server: McpServer) { .describe("(list_apps, list_deployments) Pagination offset. Default 0.") .optional(), }, + { + title: "Manage Kernel apps and invocations", + readOnlyHint: false, + destructiveHint: false, + idempotentHint: false, + openWorldHint: true, + }, async (params, extra) => { if (!extra.authInfo) throw new Error("Authentication required"); const client = createKernelClient(extra.authInfo.token); diff --git a/src/lib/mcp/tools/browser-curl.ts b/src/lib/mcp/tools/browser-curl.ts index 9cb8e1b..a19c903 100644 --- a/src/lib/mcp/tools/browser-curl.ts +++ b/src/lib/mcp/tools/browser-curl.ts @@ -41,6 +41,13 @@ export function registerBrowserCurlTool(server: McpServer) { .describe("Request timeout in milliseconds.") .optional(), }, + { + title: "Send HTTP request via browser", + readOnlyHint: false, + destructiveHint: true, + idempotentHint: false, + openWorldHint: true, + }, async (params, extra) => { if (!extra.authInfo) throw new Error("Authentication required"); const client = createKernelClient(extra.authInfo.token); diff --git a/src/lib/mcp/tools/browser-pools.ts b/src/lib/mcp/tools/browser-pools.ts index 8d07b5b..8c7ebbe 100644 --- a/src/lib/mcp/tools/browser-pools.ts +++ b/src/lib/mcp/tools/browser-pools.ts @@ -115,6 +115,13 @@ export function registerBrowserPoolCapabilities(server: McpServer) { .describe("(release) Reuse browser instance or recreate. Default true.") .optional(), }, + { + title: "Manage Kernel browser pools", + readOnlyHint: false, + destructiveHint: true, + idempotentHint: false, + openWorldHint: false, + }, async (params, extra) => { if (!extra.authInfo) throw new Error("Authentication required"); const client = createKernelClient(extra.authInfo.token); diff --git a/src/lib/mcp/tools/browsers.ts b/src/lib/mcp/tools/browsers.ts index b6b7346..44fc864 100644 --- a/src/lib/mcp/tools/browsers.ts +++ b/src/lib/mcp/tools/browsers.ts @@ -356,6 +356,13 @@ export function registerBrowserCapabilities(server: McpServer) { ) .optional(), }, + { + title: "Manage Kernel browser sessions", + readOnlyHint: false, + destructiveHint: true, + idempotentHint: false, + openWorldHint: false, + }, async (params, extra) => { if (!extra.authInfo) throw new Error("Authentication required"); const client = createKernelClient(extra.authInfo.token); diff --git a/src/lib/mcp/tools/computer-action.ts b/src/lib/mcp/tools/computer-action.ts index 165642b..1dd2109 100644 --- a/src/lib/mcp/tools/computer-action.ts +++ b/src/lib/mcp/tools/computer-action.ts @@ -254,6 +254,13 @@ export function registerComputerActionTool(server: McpServer) { "Ordered list of actions. Use one action for simple operations or multiple for batched sequences.", ), }, + { + title: "Control browser (mouse, keyboard, screenshot)", + readOnlyHint: false, + destructiveHint: true, + idempotentHint: false, + openWorldHint: true, + }, async ({ session_id, actions }, extra) => { if (!extra.authInfo) throw new Error("Authentication required"); const client = createKernelClient(extra.authInfo.token); diff --git a/src/lib/mcp/tools/docs.ts b/src/lib/mcp/tools/docs.ts index 9848056..bce4bf0 100644 --- a/src/lib/mcp/tools/docs.ts +++ b/src/lib/mcp/tools/docs.ts @@ -19,6 +19,13 @@ export function registerDocsTools(server: McpServer) { 'Natural language search query (e.g., "how to deploy an app", "browser automation examples").', ), }, + { + title: "Search Kernel documentation", + readOnlyHint: true, + destructiveHint: false, + idempotentHint: true, + openWorldHint: false, + }, async ({ query }, extra) => { if ( !process.env.MINTLIFY_ASSISTANT_API_TOKEN || diff --git a/src/lib/mcp/tools/extensions.ts b/src/lib/mcp/tools/extensions.ts index b7d5312..83d52cf 100644 --- a/src/lib/mcp/tools/extensions.ts +++ b/src/lib/mcp/tools/extensions.ts @@ -14,6 +14,13 @@ export function registerExtensionTools(server: McpServer) { .describe("(delete) Extension ID or name to delete.") .optional(), }, + { + title: "Manage Kernel browser extensions", + readOnlyHint: false, + destructiveHint: true, + idempotentHint: false, + openWorldHint: false, + }, async (params, extra) => { if (!extra.authInfo) throw new Error("Authentication required"); const client = createKernelClient(extra.authInfo.token); diff --git a/src/lib/mcp/tools/playwright.ts b/src/lib/mcp/tools/playwright.ts index 2cebe3c..2778765 100644 --- a/src/lib/mcp/tools/playwright.ts +++ b/src/lib/mcp/tools/playwright.ts @@ -20,6 +20,13 @@ export function registerPlaywrightTool(server: McpServer) { ) .optional(), }, + { + title: "Execute Playwright code", + readOnlyHint: false, + destructiveHint: true, + idempotentHint: false, + openWorldHint: true, + }, async ({ code, session_id }, extra) => { if (!extra.authInfo) throw new Error("Authentication required"); const client = createKernelClient(extra.authInfo.token); diff --git a/src/lib/mcp/tools/profiles.ts b/src/lib/mcp/tools/profiles.ts index d341c78..b65e9cc 100644 --- a/src/lib/mcp/tools/profiles.ts +++ b/src/lib/mcp/tools/profiles.ts @@ -79,6 +79,13 @@ export function registerProfileCapabilities(server: McpServer) { .describe("(setup) If true, update existing profile. Default false.") .optional(), }, + { + title: "Manage Kernel browser profiles", + readOnlyHint: false, + destructiveHint: true, + idempotentHint: false, + openWorldHint: true, + }, async (params, extra) => { if (!extra.authInfo) throw new Error("Authentication required"); const client = createKernelClient(extra.authInfo.token); diff --git a/src/lib/mcp/tools/projects.ts b/src/lib/mcp/tools/projects.ts index f3a425b..f7eda73 100644 --- a/src/lib/mcp/tools/projects.ts +++ b/src/lib/mcp/tools/projects.ts @@ -36,6 +36,13 @@ export function registerProjectCapabilities(server: McpServer) { .optional(), ...paginationParams, }, + { + title: "Manage Kernel projects", + readOnlyHint: false, + destructiveHint: true, + idempotentHint: false, + openWorldHint: false, + }, async (params, extra) => { if (!extra.authInfo) throw new Error("Authentication required"); const client = createKernelClient(extra.authInfo.token); diff --git a/src/lib/mcp/tools/proxies.ts b/src/lib/mcp/tools/proxies.ts index c41c5e3..94b5725 100644 --- a/src/lib/mcp/tools/proxies.ts +++ b/src/lib/mcp/tools/proxies.ts @@ -48,6 +48,13 @@ export function registerProxyTools(server: McpServer) { .describe("(create, custom type) Auth password.") .optional(), }, + { + title: "Manage Kernel proxy configurations", + readOnlyHint: false, + destructiveHint: true, + idempotentHint: false, + openWorldHint: false, + }, async (params, extra) => { if (!extra.authInfo) throw new Error("Authentication required"); const client = createKernelClient(extra.authInfo.token); diff --git a/src/lib/mcp/tools/shell.ts b/src/lib/mcp/tools/shell.ts index 21d88e2..53235df 100644 --- a/src/lib/mcp/tools/shell.ts +++ b/src/lib/mcp/tools/shell.ts @@ -23,6 +23,13 @@ export function registerShellTool(server: McpServer) { .optional(), as_root: z.boolean().describe("Run with root privileges.").optional(), }, + { + title: "Run shell command in browser VM", + readOnlyHint: false, + destructiveHint: true, + idempotentHint: false, + openWorldHint: true, + }, async ({ session_id, command, args, cwd, timeout_sec, as_root }, extra) => { if (!extra.authInfo) throw new Error("Authentication required"); const client = createKernelClient(extra.authInfo.token);