feat(mcp): expose conservative tools list cache contract

[seonghobae]

Partial MCP adapter implementation stacked on exact current PR #168 head 9520ffeca808bf75a17c059047534ae494691815.

Buyer-visible gap

PR #168 provides one deterministic reviewed MCP tool catalog, but the 2026-07-28 adapter line had no typed tools/list result contract carrying reviewed result disposition and cache semantics. A transport adapter could otherwise invent completeness, freshness, or shareability independently from the reviewed catalog.

This branch also closes one routing-integrity/resource-boundary defect discovered while revalidating the adapter: each untrusted routing/body tool name must satisfy the bounded ASCII tool-name contract before the two attacker-controlled values are correlated. Otherwise an oversized or malformed cross-field mismatch can take the generic HeaderBodyMismatch path before the intended 128-byte/syntax boundary is enforced.

Live dependency / exact state

The independently refetched live prerequisite remains exact #168 head 9520ffeca808bf75a17c059047534ae494691815. Current exact #170 head is 1ff5d5f3acc3ed81edf17d3e4733adfb216cd7c5. Keep Draft while #168 remains active. No prerequisite check, review, mergeability, approval, or predecessor evidence transfers.

RED -> implementation

The original typed list-page slice was established test-first: exact test-only head e241631b8198605f2a7996c295f3801416bf5df4 required one typed list page derived from supported_mcp_tools() with conservative zero freshness, private cache scope, and no continuation cursor; CI run 31934119252, Rust contracts job 95133305928, reached the locked workspace compile boundary and failed because McpCacheScope / mcp_tools_list_page did not exist.

The newly discovered routing-boundary defect was also repaired test-first. Test-only head 9c7981d10acf482e955eb739224f64ae98d0068b added mcp_route_validates_each_untrusted_tool_name_before_cross_field_comparison. CI run 31967698063, Rust contracts job 95215276820, passed repository contracts, formatting, and workspace checking and then failed at Run tests, proving the old production ordering returned the wrong boundary classification for malformed/oversized cross-field inputs.

Production head 1ff5d5f3acc3ed81edf17d3e4733adfb216cd7c5 now validates both routing_tool_name and body_tool_name with the same bounded ASCII contract before header/body correlation. Valid bounded disagreements still return HeaderBodyMismatch; unsupported methods still fail closed; unknown valid tool names still return UnknownTool.

The complete current implementation therefore:

• derives McpToolsListPage::tools() directly from the same reviewed MCP_TOOL_CATALOG used by request routing;
• exposes typed McpResultType::Complete for this fixed complete catalog;
• binds list freshness to ttl_ms = 0 and cache sharing to typed McpCacheScope::Private;
• emits no continuation cursor for the current fixed catalog;
• validates each untrusted tool name before cross-field correlation or lookup;
• preserves deterministic non-echoing error messages and public rustdoc; and
• grants no MCP tool capability, OriginWeave action authority, origin access, approval, secret access, or browser/network authority.

Current exact-head evidence

On unchanged exact head 1ff5d5f3acc3ed81edf17d3e4733adfb216cd7c5 against unchanged exact prerequisite 9520ffeca808bf75a17c059047534ae494691815:

• CI run 31967771855, Rust contracts job 95215481897: success — repository contracts, canonical formatting, locked workspace check, full tests, strict Clippy, and rustdoc all passed;
• CI run 31967771855, Production coverage job 95215482006: success, including exact owned-production function/line/region/branch enforcement;
• Manifest V3 Compatibility run 31967772157, pinned Chrome fixture job 95215450157: success, including the real pinned browser fixture;
• formal reviews currently returned for this stacked Draft have not been promoted from predecessor evidence; and
• skipped diagnostic helpers are not represented as passing gates.

This stacked Draft has no protected-main Security Scan, SAST, or central OpenCode/Noema/Strix integration proof on this exact head; absent workflows are absent, not passing. No predecessor-head, prerequisite-head, queued, skipped, cancelled, absent, synthetic-merge, status-only, or model-only evidence is promoted as current proof.

Standards / truth boundary

The canonical browser/agent protocol doctoring records the MCP 2026-07-28 result-type/cache-hint evidence and the conservative OriginWeave boundary in APA 7 form. This remains an adapter refinement under the accepted architecture rather than a new binding architecture decision.

This slice is typed MCP discovery/routing metadata only. It does not serialize JSON-RPC/HTTP, implement transport caching, authenticate a client/server, implement OAuth, perform general pagination, invoke a tool, expose arbitrary JavaScript, disclose secrets, persist discovery state, or prove a complete MCP server. The transport adapter must serialize the reviewed value without widening its result, cache, routing, or authority semantics.

Passing automation is not authorization to merge. This scheduled actor follows protected-main AGENTS.md and does not merge, self-approve, alter workflows, add secrets, weaken gates, tag, or publish.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ebb90e09-4d52-4943-9c4a-0c525f0e6bac

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}