Skip to content

mcp: createHandler lacks readonly mode guard #3810

@Elvand-Lie

Description

@Elvand-Lie

Description

The \createHandler\ in \pkg/mcp/tools_create.go\ lacks the \s.readonly.Load()\ check that is present in other mutating tools like \deployHandler\ and \deleteHandler.

Because of this, an MCP client can execute the \create\ command (which writes project scaffolding files to the disk) even when the server is operating in readonly mode.

Expected Behavior

The \create\ tool should check \s.readonly.Load()\ and return an error if readonly mode is enabled, matching the behavior of \deploy\ and \delete.

Metadata

Metadata

Assignees

Labels

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions