Skip to content

MCP: titles on every tool + destructiveHint on browse/ask - #298

Merged
ralyodio merged 1 commit into
mainfrom
feat/mcp-annotations
Nov 11, 2026
Merged

ralyodio merged 1 commit into
mainfrom
feat/mcp-annotations

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

All 12 tools in tools/list now carry a Title Case title (TITLES map in src/mcp.mjs), and w3bs_browse/w3bs_ask gain the missing explicit destructiveHint: false. Existing hints unchanged; no names, schemas or behavior change. test/mcp-annotations.test.mjs lists tools over an in-memory MCP client and asserts title + all three hints.

Local: bun test 164 pass, 0 fail.

🤖 Generated with Claude Code

Claude Connectors Directory and ChatGPT app rules want a human title and
explicit readOnly/destructive/openWorld booleans on each tool. Test asserts it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

0 finding(s) in the 2 file(s) this pull request changes.

Nothing in the files this pull request changes.

55 pre-existing finding(s) elsewhere in the repository — **HIGH**: 12 | **MEDIUM**: 32 | **LOW**: 11

Not introduced by this pull request.

Severity Rule Location
HIGH secret-database-url .github/workflows/ci.yml:23
HIGH sh-remote-script-execution de/share/bin/w3bs-de:241
HIGH js-unescaped-html-sink desktop/crates/w3bs-desktop/assets/control/app.js:163
HIGH js-ssrf-outbound-request desktop/crates/w3bs-desktop/assets/control/sw.js:21
HIGH sh-unquoted-expansion-destructive desktop/packaging/install.sh:106
HIGH sh-eval-expansion os/iso/overlay/usr/local/sbin/w3bs-os-install:119
HIGH sh-eval-expansion os/iso/overlay/usr/local/sbin/w3bs-os-install:125
HIGH sh-eval-expansion os/iso/overlay/usr/local/sbin/w3bs-os-install:143
HIGH sh-plaintext-download os/iso/overlay/usr/local/sbin/w3bs-os-install:499
HIGH sh-remote-script-execution package-manager/bootstrap/npm-cli-install.sh:35
HIGH tls-verification-disabled src/store.mjs:85
HIGH tls-verification-disabled training/hosted.mjs:25
MEDIUM sh-remote-script-execution de/install.sh:197
MEDIUM sh-remote-script-execution de/share/bin/w3bs-de:70
MEDIUM sh-remote-script-execution de/share/bin/w3bs-de:221
MEDIUM js-timing-unsafe-mac-compare native/client.mjs:105
MEDIUM sh-remote-script-execution os/debian/config/includes.chroot/usr/local/sbin/w3bs-os-install:723
MEDIUM sh-remote-script-execution os/debian/config/includes.chroot/usr/local/sbin/w3bs-os-install:734
MEDIUM sh-predictable-temp-path os/docker/check-desktop.sh:29
MEDIUM sh-remote-script-execution os/iso/overlay/usr/local/sbin/w3bs-os-install:912

…and 35 more; the full set is in the SARIF artifact.

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio

Copy link
Copy Markdown
Contributor Author

Merging on local green: bun test test/*.test.mjs 164 pass / 0 fail, bun run check OK. The failing validate and bun audit jobs die at bun install --frozen-lockfile, which also fails on main (Conformance red on 37870cf and 8f4df5a); unrelated to this diff (src/mcp.mjs + one test).

@ralyodio
ralyodio merged commit 9467217 into main Nov 11, 2026
4 of 8 checks passed
@ralyodio
ralyodio deleted the feat/mcp-annotations branch November 11, 2026 13:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant