formalise insiders inventory support

Author: mattdholloway

pkg/github/issues.go

@@ -602,8 +602,10 @@ func ListIssueTypes(t translations.TranslationHelperFunc) inventory.ServerTool {
 }
 
 // ListAssignees creates a tool to list available assignees for a repository.
+// This tool is only available when insiders mode is enabled as it's a helper
+// for the MCP Apps UI.
 func ListAssignees(t translations.TranslationHelperFunc) inventory.ServerTool {
-	return NewTool(
+	st := NewTool(
 		ToolsetMetadataIssues,
 		mcp.Tool{
 			Name:        "list_assignees",
@@ -679,11 +681,15 @@ func ListAssignees(t translations.TranslationHelperFunc) inventory.ServerTool {
 
 			return utils.NewToolResultText(string(out)), nil, nil
 		})
+	st.InsidersOnly = true
+	return st
 }
 
 // ListMilestones creates a tool to list milestones for a repository.
+// This tool is only available when insiders mode is enabled as it's a helper
+// for the MCP Apps UI.
 func ListMilestones(t translations.TranslationHelperFunc) inventory.ServerTool {
-	return NewTool(
+	st := NewTool(
 		ToolsetMetadataIssues,
 		mcp.Tool{
 			Name:        "list_milestones",
@@ -775,6 +781,8 @@ func ListMilestones(t translations.TranslationHelperFunc) inventory.ServerTool {
 
 			return utils.NewToolResultText(string(out)), nil, nil
 		})
+	st.InsidersOnly = true
+	return st
 }
 
 // AddIssueComment creates a tool to add a comment to an issue.

pkg/inventory/builder.go

@@ -351,14 +351,19 @@ var insidersOnlyMetaKeys = []string{
 }
 
 // stripInsidersFeatures removes insiders-only features from tools.
-// This includes Meta keys listed in insidersOnlyMetaKeys.
+// This includes removing tools marked with InsidersOnly and stripping
+// Meta keys listed in insidersOnlyMetaKeys from remaining tools.
 func stripInsidersFeatures(tools []ServerTool) []ServerTool {
-	result := make([]ServerTool, len(tools))
-	for i, tool := range tools {
+	result := make([]ServerTool, 0, len(tools))
+	for _, tool := range tools {
+		// Skip tools marked as insiders-only
+		if tool.InsidersOnly {
+			continue
+		}
 		if stripped := stripInsidersMetaFromTool(tool); stripped != nil {
-			result[i] = *stripped
+			result = append(result, *stripped)
 		} else {
-			result[i] = tool
+			result = append(result, tool)
 		}
 	}
 	return result

pkg/inventory/registry_test.go

@@ -1899,6 +1899,40 @@ func TestWithInsidersMode_EnabledPreservesUIMetadata(t *testing.T) {
 	}
 }
 
+func TestWithInsidersMode_EnabledPreservesInsidersOnlyTools(t *testing.T) {
+	normalTool := mockTool("normal", "toolset1", true)
+	insidersTool := mockTool("insiders_only", "toolset1", true)
+	insidersTool.InsidersOnly = true
+
+	// With insiders mode enabled, both tools should be available
+	reg := mustBuild(t, NewBuilder().
+		SetTools([]ServerTool{normalTool, insidersTool}).
+		WithToolsets([]string{"all"}).
+		WithInsidersMode(true))
+	available := reg.AvailableTools(context.Background())
+
+	require.Len(t, available, 2)
+	names := []string{available[0].Tool.Name, available[1].Tool.Name}
+	require.Contains(t, names, "normal")
+	require.Contains(t, names, "insiders_only")
+}
+
+func TestWithInsidersMode_DisabledRemovesInsidersOnlyTools(t *testing.T) {
+	normalTool := mockTool("normal", "toolset1", true)
+	insidersTool := mockTool("insiders_only", "toolset1", true)
+	insidersTool.InsidersOnly = true
+
+	// With insiders mode disabled, insiders-only tool should be removed
+	reg := mustBuild(t, NewBuilder().
+		SetTools([]ServerTool{normalTool, insidersTool}).
+		WithToolsets([]string{"all"}).
+		WithInsidersMode(false))
+	available := reg.AvailableTools(context.Background())
+
+	require.Len(t, available, 1)
+	require.Equal(t, "normal", available[0].Tool.Name)
+}
+
 func TestWithInsidersMode_ToolsWithoutUIMetaUnaffected(t *testing.T) {
 	toolNoUI := mockToolWithMeta("tool_no_ui", "toolset1", map[string]any{
 		"description": "kept",
@@ -2038,6 +2072,23 @@ func TestStripInsidersFeatures(t *testing.T) {
 	require.Nil(t, result[2].Tool.Meta)
 }
 
+func TestStripInsidersFeatures_RemovesInsidersOnlyTools(t *testing.T) {
+	// Create tools: one normal, one insiders-only, one normal
+	normalTool1 := mockTool("normal1", "toolset1", true)
+	insidersTool := mockTool("insiders_only", "toolset1", true)
+	insidersTool.InsidersOnly = true
+	normalTool2 := mockTool("normal2", "toolset1", true)
+
+	tools := []ServerTool{normalTool1, insidersTool, normalTool2}
+
+	result := stripInsidersFeatures(tools)
+
+	// Should only have 2 tools (insiders-only tool filtered out)
+	require.Len(t, result, 2)
+	require.Equal(t, "normal1", result[0].Tool.Name)
+	require.Equal(t, "normal2", result[1].Tool.Name)
+}
+
 func TestInsidersOnlyMetaKeys_FutureAdditions(t *testing.T) {
 	// This test verifies the mechanism works for multiple keys
 	// If we add new experimental keys to insidersOnlyMetaKeys, they should be stripped

pkg/inventory/server_tool.go

@@ -82,6 +82,10 @@ type ServerTool struct {
 	// This includes the required scopes plus any higher-level scopes that provide
 	// the necessary permissions due to scope hierarchy.
 	AcceptedScopes []string
+
+	// InsidersOnly marks this tool as only available when insiders mode is enabled.
+	// When insiders mode is disabled, tools with this flag set are completely omitted.
+	InsidersOnly bool
 }
 
 // IsReadOnly returns true if this tool is marked as read-only via annotations.