Add capability discovery tool

pti commented

2026-07-24 15:00:39 +02:00

Owner

Adds wraptool_discover to list configured CLI tools, allowed subcommands, registered MCP names, and advertised but unapproved subcommands. It collects top-level catalogs during introspection, including for inert tools, and follows config reloads. Decision: expose metadata so an AI can request a real capability while granting nothing without operator approval. The stale prerequisite was omitted because current main already has the live wraptool_info fix. Verified with go test ./..., go vet ./..., and golangci-lint run ./... .

pti added 1 commit

2026-07-24 15:00:39 +02:00

mcptools: add wraptool_discover to bootstrap capability requests

Lint / lint (pull_request) Has been cancelled

Details

b7f09f50e0

A tool with no allow rules is inert by design — config.validateTool
permits it explicitly as a state to pass through while adding rules
incrementally — but it registers zero MCP tools, so the AI cannot call
it, cannot be denied, and therefore never learns what to ask for. The
only route to a first capability was guessing a subcommand name.

Introspection could not help: it ran --help solely for subcommands
that already had an allow rule, so an inert tool yielded an empty
schema. Introspect now also parses the tool's top-level help into a
new Schema.Available catalog, independent of policy. The parsers
already implemented ParseSubcommands for exactly this and nothing had
ever called it; BestParseSubcommands picks the first non-empty result
in parser priority order, so a flags-only help (curl, GNU utilities)
correctly yields no catalog rather than mistaking options for
subcommands.

wraptool_discover exposes, per tool, what policy allows today (with
the MCP tool names to call) and what the tool advertises but does not
permit. It reports policy rather than widening it: listing a
subcommand grants nothing, and approval still runs through the
existing request flow. The handler serves the introspection cache and
never executes a wrapped binary on demand — the only new execution is
a fixed -h/--help/help argv at introspection time, which no AI input
reaches. Depth is deliberately one level: subcommand names and
descriptions, no recursive per-subcommand help.

The registrar now holds the live config (toolNames derives from it),
so discovery follows a reload the same way wraptool_info does.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QPkao1ADjUP2i7uRsHJB7P

pti added 1 commit

2026-07-24 15:02:08 +02:00

docs(discover): clarify cache-miss execution

Lint / lint (pull_request) Successful in 3m28s

Details

56c4f3213b

pti added 1 commit

2026-07-24 15:06:30 +02:00

fix(discover): exclude allowed subcommands

Lint / lint (pull_request) Successful in 22m41s

Details

b048a15abd