feat: add securityWarning to McpFetchedAsset - #322
Merged
setu4993 merged 1 commit intoJul 27, 2026
Merged
Conversation
Christian-Vallejos
added a commit
to Christian-Vallejos/plugin-agent
that referenced
this pull request
Jul 24, 2026
@W-23572634@ The Connect API already returns descriptions, labels, auth type and (on fetch) a per-tool security warning, but the human-readable tables dropped them. This brings `sf agent mcp` output to parity with the API so a user can review a tool before approving it, without needing --json. - fetch / asset list / asset replace / create: add Label + Description columns (create now prints the discovered-asset table instead of just a count). - fetch: add a Security Warning column (only /fetch populates it). - list / get: add Auth Type + Description. --json output is unchanged (it always carried the full object). Requires @salesforce/agents with the securityWarning field (forcedotcom/agents#322); schemas regenerated for fetch + create. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Christian-Vallejos
force-pushed
the
t/api-catalog/mcp-fetch-security-warning
branch
from
July 24, 2026 17:09
ddd0dc2 to
1528fb3
Compare
Christian-Vallejos
changed the title
Christian-Vallejos
added a commit
to Christian-Vallejos/plugin-agent
that referenced
this pull request
Jul 25, 2026
@W-23572634@ The Connect API already returns descriptions, labels, auth type and (on fetch) a per-tool security warning, but the human-readable tables dropped them. This brings `sf agent mcp` output to parity with the API so a user can review a tool before approving it, without needing --json. - fetch / asset list / asset replace / create: add Label + Description columns (create now prints the discovered-asset table instead of just a count). - fetch: add a Security Warning column (only /fetch populates it). - list / get: add Auth Type + Description. --json output is unchanged (it always carried the full object). Requires @salesforce/agents with the securityWarning field (forcedotcom/agents#322); schemas regenerated for fetch + create. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@W-23572634@
The MCP server fetch/introspection endpoint (POST /mcp-servers/{id}/fetch)
returns a per-tool `securityWarning` string when a tool's definition changed
since it was last approved. Surface it on the fetched-asset type so consumers
(e.g. `sf agent mcp fetch`) can show it before a user re-approves a tool.
Only the live /fetch response populates this field; create/asset responses
do not, so it stays optional.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Christian-Vallejos
force-pushed
the
t/api-catalog/mcp-fetch-security-warning
branch
from
July 25, 2026 18:50
1528fb3 to
5553c7e
Compare
nschejtman
approved these changes
Jul 27, 2026
setu4993
approved these changes
Jul 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The MCP server fetch/introspection endpoint (
POST /mcp-servers/{id}/fetch) returns a per-toolsecurityWarningstring when a tool's definition changed since it was last approved. This addssecurityWarning?: stringtoMcpFetchedAssetso consumers (e.g.sf agent mcp fetchinplugin-agent) can surface it and let a user review it before re-approving a tool./fetchresponse populates this field;createand asset responses do not, so it is optional.fetchMcpServerdeserializes the response directly, so no client-side mapping change was needed — the field flows through automatically.Test plan
tsc+eslintcleanmocha test/apiCatalog.test.ts— 11/11 passing@W-23572634@