mcp: remove madt_auth_login and madt_auth_use_ssh from the default tool list, or gate them #689

New issue

Open

opened 2026-10-02 20:00:51 +00:00 by hexajon · 0 comments

hexajon commented

2026-10-02 20:00:51 +00:00

Owner

Problem

madt_auth_login and madt_auth_use_ssh load in every MCP session. Both are one-time setup operations. I run each one once per checkout, or never. Their schemas still cost context in every session:

madt_auth_login: 2771 bytes measured (internal/mcp/schema_budget_test.go:123).
madt_auth_use_ssh: 1536 bytes measured (internal/mcp/schema_budget_test.go:122).

madt_auth_login is in the always tier (internal/mcp/server.go:195-199), so it loads even in a session with no credentials (#89). madt_auth_use_ssh loads with the credentialed tools (internal/mcp/tools_auth.go:82-84).

The CLI already has both operations: madtea auth login (internal/cmd/setup/setup.go:108) and madtea auth use-ssh (internal/cmd/auth/use_ssh.go:27).

This follows ADR 0015, which keeps rare tools out of the default list. It does not fork that ADR.

Options

I have not picked one yet.

Remove both tools from the MCP surface. The CLI keeps them. This reverses #89: a session with no credentials loses its in-session OAuth remedy, and the user must run madtea auth login in a terminal.
Move both tools into a gated auth domain that loads through madt_enable(domains=["auth"]). madt_enable is in the always tier (internal/mcp/server.go:189), so a session with no credentials still reaches the login remedy in two calls. The #89 requirement then holds through madt_enable, not through madt_auth_login itself. ADR 0015 lists the gated domains, so it needs an edit.

Acceptance criteria

The default tool list does not include madt_auth_login or madt_auth_use_ssh (option 2: until madt_enable loads the auth domain).
Every text that names madt_auth_login as a remedy names the new path. Known places: the madt_auth_whoami description (internal/mcp/tools_auth.go:94) and the foreign-repo refusal (internal/mcp/foreignrepo.go:405-409).
The always-tier count in internal/mcp/context_test.go:155, the entries in schema_budget_test.go, output_schema.go, and tool_meta.go, and the clean-room test (internal/mcp/cleanroom_acceptance_test.go:350) match the new surface.
Option 2 only: ADR 0015's gated-domain list and internal/parity/exposure_test.go match the live server.
docs/COMPARISON.md and the generated reference docs match.

## Problem `madt_auth_login` and `madt_auth_use_ssh` load in every MCP session. Both are one-time setup operations. I run each one once per checkout, or never. Their schemas still cost context in every session: - `madt_auth_login`: 2771 bytes measured (`internal/mcp/schema_budget_test.go:123`). - `madt_auth_use_ssh`: 1536 bytes measured (`internal/mcp/schema_budget_test.go:122`). `madt_auth_login` is in the always tier (`internal/mcp/server.go:195-199`), so it loads even in a session with no credentials (#89). `madt_auth_use_ssh` loads with the credentialed tools (`internal/mcp/tools_auth.go:82-84`). The CLI already has both operations: `madtea auth login` (`internal/cmd/setup/setup.go:108`) and `madtea auth use-ssh` (`internal/cmd/auth/use_ssh.go:27`). This follows ADR 0015, which keeps rare tools out of the default list. It does not fork that ADR. ## Options I have not picked one yet. 1. **Remove both tools from the MCP surface.** The CLI keeps them. This reverses #89: a session with no credentials loses its in-session OAuth remedy, and the user must run `madtea auth login` in a terminal. 2. **Move both tools into a gated `auth` domain** that loads through `madt_enable(domains=["auth"])`. `madt_enable` is in the always tier (`internal/mcp/server.go:189`), so a session with no credentials still reaches the login remedy in two calls. The #89 requirement then holds through `madt_enable`, not through `madt_auth_login` itself. ADR 0015 lists the gated domains, so it needs an edit. ## Acceptance criteria - [ ] The default tool list does not include `madt_auth_login` or `madt_auth_use_ssh` (option 2: until `madt_enable` loads the `auth` domain). - [ ] Every text that names `madt_auth_login` as a remedy names the new path. Known places: the `madt_auth_whoami` description (`internal/mcp/tools_auth.go:94`) and the foreign-repo refusal (`internal/mcp/foreignrepo.go:405-409`). - [ ] The always-tier count in `internal/mcp/context_test.go:155`, the entries in `schema_budget_test.go`, `output_schema.go`, and `tool_meta.go`, and the clean-room test (`internal/mcp/cleanroom_acceptance_test.go:350`) match the new surface. - [ ] Option 2 only: ADR 0015's gated-domain list and `internal/parity/exposure_test.go` match the live server. - [ ] `docs/COMPARISON.md` and the generated reference docs match.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea#689

No description provided.

Rows
Columns