Loosen-IT/WP-LIT-MCP
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

feat: configurable exposure policy for direct, indirect and disabled tools

Browse Source 
Introduces ExposurePolicy (option lit_mcp_exposure) deciding per ability
whether it is a direct MCP tool, only reachable via mcp-adapter's
execute-ability meta-tool, or disabled entirely (not registered with the
Abilities API at all). Ability::isDirect() remains the default when no
override applies. lit/guide can never be disabled or made indirect;
lit/media-preview and lit/media-download (image/embedded-resource results)
can never be made indirect, only direct or disabled.

AbilityRegistrar and ServerRegistrar take an optional ExposurePolicy and
use it to filter registered abilities / compute the direct tool list.
IntegrationRegistry::directAbilityNames() is removed (superseded by
ExposurePolicy::directNames()). InstructionsBuilder now also takes the
policy and lists the currently direct tools by name (lit-<name>), noting
the rest are reachable via mcp-adapter-execute-ability as lit/<name>.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
This commit is contained in:
janniclas.loosen
2026-09-26 03:04:14 +02:00
co-authored by Claude Opus 5.5
parent 7f136f6f4c
commit 2f8a9f0c61
11 changed files with 362 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Unit/Server/ServerRegistrarTest.php
+28
View File
@@ -7,6 +7,7 @@ namespace LIT\MCP\Tests\Unit\Server;
use Brain\Monkey\Filters;
use Brain\Monkey\Functions;
use LIT\MCP\Abilities\Ability;
use LIT\MCP\Abilities\ExposurePolicy;
use LIT\MCP\Guides\InstructionsBuilder;
use LIT\MCP\Integrations\Integration;
use LIT\MCP\Integrations\IntegrationRegistry;
@@ -61,6 +62,33 @@ final class ServerRegistrarTest extends TestCase
self::assertNotContains('lit/rare-tool', $args['tools']);
}
public function testExposurePolicyDecidesWhichToolsAreDirect(): void
{
// Deviation from the brief: the brief's original test demoted lit/guide to
// indirect, but the controller's fixed constraint for this task is that
// lit/guide can neither be disabled nor made indirect (see ExposurePolicy::
// REQUIRED / ExposurePolicyTest::testGuideCanNeitherBeDisabledNorMadeIndirect).
// Using a demotable direct ability here instead proves the same thing: the
// policy, not Ability::isDirect(), decides the tool list.
$optional = Mockery::mock(Ability::class);
$optional->allows('name')->andReturn('lit/optional-tool');
$optional->allows('isDirect')->andReturn(true);
$core = Mockery::mock(Integration::class);
$core->allows('id')->andReturn('core');
$core->allows('isAvailable')->andReturn(true);
$core->allows('abilities')->andReturn([$optional]);
$registry = new IntegrationRegistry($core, ...$this->registry()->available());
$policy = new ExposurePolicy(['lit/optional-tool' => 'indirect', 'lit/rare-tool' => 'direct']);
$registrar = new ServerRegistrar($registry, $this->instructions(), static fn () => true, null, null, $policy);
self::assertSame(
['lit/guide', 'lit/rare-tool', 'mcp-adapter/discover-abilities', 'mcp-adapter/get-ability-info', 'mcp-adapter/execute-ability'],
$registrar->serverArguments()['tools']
);
}
public function testNoServerWhenOauthIsDisabled(): void
{
$registrar = new ServerRegistrar($this->registry(), $this->instructions(), static fn () => false);