feat(mcp-server): add enabledTools allowlist option by Scra3 · Pull Request #1547 · ForestAdmin/agent-nodejs

Scra3 · 2026-04-13T14:49:55Z

Summary

Add enabledTools option (allowlist) as an alternative to disabledTools (blocklist)
enabledTools is recommended for read-only setups: new tools in future releases won't be automatically enabled
enabledTools takes priority if both options are set (with a warning)
describeCollection is always forced on regardless of configuration
Startup logs show which tools are enabled and disabled with counts
Support FOREST_MCP_ENABLED_TOOLS env var for standalone mode
Updated README documenting both approaches with trade-offs

Test plan

enabledTools only exposes listed tools + describeCollection via tools/list
Warning logged when both enabledTools and disabledTools are set
describeCollection warning preserved when passed to disabledTools
Existing disabledTools tests still pass
Agent passes enabledTools through to ForestMCPServer
Build succeeds, lint passes

🤖 Generated with Claude Code

Note

Replace `disabledTools` denylist with `enabledTools` allowlist in MCP server

Replaces the disabledTools denylist with an enabledTools allowlist across the MCP server, CLI, and agent. Tools must now be explicitly listed to be enabled; unlisted tools are not registered.
describeCollection is always included regardless of the allowlist. Unknown tool names are ignored with a warning.
The CLI now reads FOREST_MCP_ENABLED_TOOLS instead of FOREST_MCP_DISABLED_TOOLS.
parseDisabledTools is renamed to parseToolList in parse-tool-list.ts with no behavior change.
Risk: Callers passing disabledTools to mountAiMcpServer or FOREST_MCP_DISABLED_TOOLS in the CLI will have no effect; migration to the new allowlist option is required.

^{Macroscope summarized afac92d.}

Add enabledTools option as an alternative to disabledTools. enabledTools is an allowlist: only listed tools are exposed. New tools released in future versions will NOT be automatically enabled, making it the recommended option for read-only setups. - enabledTools takes priority over disabledTools if both are set - describeCollection is always forced on - Startup logs show which tools are enabled and disabled - Support FOREST_MCP_ENABLED_TOOLS env var for standalone mode - Updated README with both approaches documented Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

qltysh · 2026-04-13T14:56:01Z

Coverage Impact

⬆️ Merging this pull request will increase total coverage on main by 0.02%.

Modified Files with Diff Coverage (3)

Rating	File	% Diff	Uncovered Line #s
	packages/agent/src/agent.ts	100.0%
	packages/mcp-server/src/server.ts	100.0%
	packages/mcp-server/src/utils/parse-tool-list.ts	100.0%
	Total	100.0%

🚦 See full report on Qlty Cloud »

🛟 Help

Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.
Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.
File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)
- Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.

BREAKING CHANGE: `disabledTools` option has been removed. Use `enabledTools` instead. This is an allowlist: only listed tools are exposed. New tools in future releases will NOT be auto-enabled. - Remove disabledTools from ForestMCPServerOptions - Remove FOREST_MCP_DISABLED_TOOLS env var - Rename parse-disabled-tools.ts to parse-tool-list.ts - Simplify resolveEnabledTools (no more blocklist path) - Update agent mountAiMcpServer to only accept enabledTools Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

packages/mcp-server/test/server.test.ts

- Fix port conflicts using getAvailablePort() - Replace no-op logging test with empty enabledTools edge case test - Verify enabledTools: [] only exposes describeCollection Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Warn when describeCollection is missing from enabledTools (auto-added) - Log available tools not enabled for discoverability on new releases Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Warn about unknown tool names in enabledTools (typo protection) - Fix test port conflicts by using buildExpressApp + listen instead of run() Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

nbouliol · 2026-04-14T07:43:11Z

packages/agent/src/agent.ts

   * agent.mountAiMcpServer();
-   * // Or with options:
-   * agent.mountAiMcpServer({ disabledTools: ['create', 'update', 'delete'] });
+   * // Or with options (read-only mode):


this is not read only mode, it only mounts the enabled tools

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

# @forestadmin/mcp-server [2.0.0](https://github.com/ForestAdmin/agent-nodejs/compare/@forestadmin/mcp-server@1.9.1...@forestadmin/mcp-server@2.0.0) (2026-04-14) ### Features * **mcp-server:** add enabledTools allowlist option ([#1547](#1547)) ([fc5127a](fc5127a)) ### BREAKING CHANGES * **mcp-server:** `disabledTools` option has been removed. Use `enabledTools` instead. This is an allowlist: only listed tools are exposed. New tools in future releases will NOT be auto-enabled. - Remove disabledTools from ForestMCPServerOptions - Remove FOREST_MCP_DISABLED_TOOLS env var - Rename parse-disabled-tools.ts to parse-tool-list.ts - Simplify resolveEnabledTools (no more blocklist path) - Update agent mountAiMcpServer to only accept enabledTools Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * test(mcp-server): fix enabledTools tests and add empty array edge case - Fix port conflicts using getAvailablePort() - Replace no-op logging test with empty enabledTools edge case test - Verify enabledTools: [] only exposes describeCollection Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat(mcp-server): add warning and discovery logs for enabledTools - Warn when describeCollection is missing from enabledTools (auto-added) - Log available tools not enabled for discoverability on new releases Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(mcp-server): validate enabledTools names and fix test port conflicts - Warn about unknown tool names in enabledTools (typo protection) - Fix test port conflicts by using buildExpressApp + listen instead of run() Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(example): revert mountAiMcpServer to default (no options) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * docs(mcp-server): clarify read-only is an example of enabledTools usage Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

# @forestadmin/agent [2.0.0](https://github.com/ForestAdmin/agent-nodejs/compare/@forestadmin/agent@1.77.1...@forestadmin/agent@2.0.0) (2026-04-14) ### Features * **mcp-server:** add enabledTools allowlist option ([#1547](#1547)) ([fc5127a](fc5127a)) ### BREAKING CHANGES * **mcp-server:** `disabledTools` option has been removed. Use `enabledTools` instead. This is an allowlist: only listed tools are exposed. New tools in future releases will NOT be auto-enabled. - Remove disabledTools from ForestMCPServerOptions - Remove FOREST_MCP_DISABLED_TOOLS env var - Rename parse-disabled-tools.ts to parse-tool-list.ts - Simplify resolveEnabledTools (no more blocklist path) - Update agent mountAiMcpServer to only accept enabledTools Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * test(mcp-server): fix enabledTools tests and add empty array edge case - Fix port conflicts using getAvailablePort() - Replace no-op logging test with empty enabledTools edge case test - Verify enabledTools: [] only exposes describeCollection Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat(mcp-server): add warning and discovery logs for enabledTools - Warn when describeCollection is missing from enabledTools (auto-added) - Log available tools not enabled for discoverability on new releases Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(mcp-server): validate enabledTools names and fix test port conflicts - Warn about unknown tool names in enabledTools (typo protection) - Fix test port conflicts by using buildExpressApp + listen instead of run() Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(example): revert mountAiMcpServer to default (no options) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * docs(mcp-server): clarify read-only is an example of enabledTools usage Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> ### Dependencies * **@forestadmin/mcp-server:** upgraded to 2.0.0

macroscopeapp bot reviewed Apr 13, 2026

View reviewed changes

packages/mcp-server/test/server.test.ts Outdated Show resolved Hide resolved

alban bertolini and others added 4 commits April 13, 2026 20:00

feat(mcp-server): add warning and discovery logs for enabledTools

853755c

- Warn when describeCollection is missing from enabledTools (auto-added) - Log available tools not enabled for discoverability on new releases Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix(mcp-server): validate enabledTools names and fix test port conflicts

5a6b8ed

- Warn about unknown tool names in enabledTools (typo protection) - Fix test port conflicts by using buildExpressApp + listen instead of run() Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

chore(example): revert mountAiMcpServer to default (no options)

61c4309

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

nbouliol reviewed Apr 14, 2026

View reviewed changes

Scra3 force-pushed the feat/mcp-enabled-tools-option branch from ac6c301 to ba59b79 Compare April 14, 2026 08:25

docs(mcp-server): clarify read-only is an example of enabledTools usage

afac92d

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Scra3 force-pushed the feat/mcp-enabled-tools-option branch from ba59b79 to afac92d Compare April 14, 2026 08:29

nbouliol approved these changes Apr 14, 2026

View reviewed changes

Scra3 merged commit fc5127a into main Apr 14, 2026
29 checks passed

Scra3 deleted the feat/mcp-enabled-tools-option branch April 14, 2026 08:36

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(mcp-server): add enabledTools allowlist option#1547

feat(mcp-server): add enabledTools allowlist option#1547
Scra3 merged 7 commits intomainfrom
feat/mcp-enabled-tools-option

Scra3 commented Apr 13, 2026 •

edited by macroscopeapp bot

Loading

Uh oh!

qltysh bot commented Apr 13, 2026 •

edited

Loading

Uh oh!

Uh oh!

nbouliol Apr 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Scra3 commented Apr 13, 2026 • edited by macroscopeapp bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Replace disabledTools denylist with enabledTools allowlist in MCP server

Uh oh!

qltysh bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

nbouliol Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Scra3 commented Apr 13, 2026 •

edited by macroscopeapp bot

Loading

Replace `disabledTools` denylist with `enabledTools` allowlist in MCP server

qltysh bot commented Apr 13, 2026 •

edited

Loading