activeing123/mcptoon v0.8.27

v0.8.27 — destructive-op guard honours MCP annotations and inspects arguments

on GitHub

Fixed

• MCPTOON_CALL_TIMEOUT now actually extends a call. The gateway read the
  documented env var but used it only for its own worker-thread wait; the MCP
  client underneath kept its separate 30s default, so a call configured for 900s
  still died at 30s with [RESPONSE_TIMEOUT] ... within 30s (server went silent)
  while the upstream process kept running and its result was lost. MCPClientPool
  now takes a default per-request deadline and forwards it to every client it
  creates, and both construction sites in serve.py pass _get_call_timeout().
  An explicit per-server "timeout" in config.json still wins, so the
  workaround in the report keeps working. Reported as #34.

• mcptoon_call now answers in the shape it advertises. Under the default
  compact exposure every upstream call is routed through mcptoon_call, which
  declares an outputSchema requiring tool and server. The escape hatch
  re-entered the direct-call path and returned that path's envelope verbatim, so
  when the upstream tool answered with its own structuredContent (e.g.
  {"entities": [], "relations": []} from a graph tool) the response did not
  match the schema the gateway itself published — and a strict client rejected
  every such call. The answer is now rebuilt as {tool, server, result},
  including on a routed error, so the declared schema is always satisfied. A
  side effect of the #22 fix; reported as #33. Workaround until release:
  mcptoon config set exposure full.

• The destructive-op guard now honours MCP annotations and inspects
  arguments. _check_dangerous matched only the tool name against a
  substring list and never read the annotations object it exists to consume,
  so it was both too loose and too strict at once: a truncate_table tool that
  declared destructiveHint: true ran with no confirmation, a neutral
  run_query carrying {"sql": "DROP TABLE customers"} passed untouched, and a
  clear_cache annotated readOnlyHint: true was refused for containing
  clear. The screen now reads readOnlyHint: true first and lets it clear the
  name check, treats destructiveHint: true as dangerous regardless of the
  name, keeps the substring list as a fallback for the many servers that ship no
  annotations (now also catching truncate/overwrite/execute/run_), and
  inspects sql/command-style arguments for destructive statements. The
  gateway path passes the in-memory annotations straight in; the CLI path reads
  them from the tool cache (never spawning a server). Reported by an external
  tester on 0.8.26 with a minimal repro and the fix location.