MCP tools/list available when MCP is disabled?
1 posts by 1 authors in: Forums > CMS Builder
Last Post: 2 hours ago (RSS)
By runriot - 2 hours ago
Hey
I've been playing the new MCP feature and admittedly I know very little about MCP, so this may be completely normal...
I noticed that even with MCP disabled, the endpoint still responds to a `tools/list` request and returns the full list of available tools. Same when using no/incorrect auth.
For example, with MCP disabled (or no auth) I can still see things like:
- serverShell
- serverPhp
- queryWriteserverRead
- upload tools
Attempting to actually run a tool correctly returns an error saying MCP is disabled, so it doesn't look like anything can be executed.
My question is simply whether exposing the tool list when MCP is disabled is intentional?
I'm guessing there's probably a good reason for it, and you guys know the MCP spec far better than I do, but it feels a little odd that a disabled feature still advertises everything it can do.
Just curious whether that's expected behaviour or something worth tightening up.
Cheers
Rob