René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"MCP App UI resources for write tools are registered in --read-only mode","articleBody":"## Summary\n\nWhen the server is started with `--read-only` and MCP Apps are enabled, write-tool UI form resources (`issue_write_ui`, `pr_write_ui`) are still registered and served, even though the underlying write tools (`create_issue`, `update_issue`, `create_pull_request`, etc.) are filtered out of the inventory.\n\n## Where\n\n`pkg/github/ui_resources.go` — `RegisterUIResources` unconditionally calls `s.AddResource` for all three UI forms.\n\n`internal/ghmcp/server.go:182` — the only gating is on `MCPAppsFeatureFlag` + `UIAssetsAvailable()`; no read-only check.\n\n```go\nmcpAppsEnabled, _ := featureChecker(context.Background(), github.MCPAppsFeatureFlag)\nif mcpAppsEnabled \u0026\u0026 github.UIAssetsAvailable() {\n    github.RegisterUIResources(ghServer)\n}\n```\n\n## Why it matters\n\n- Read-only mode should not expose UI affordances for mutating actions. A client that lists resources will see `issue_write_ui` and `pr_write_ui` and may surface them, even though calling the backing tool is impossible.\n- The mismatch is confusing — read-only is supposed to be the complete answer to \"hide all write surface\".\n- Same concern applies regardless of feature-flag wiring: any read-only filter that excludes a write tool should also exclude its companion UI resource.\n\n## Suggested fix\n\nTwo options:\n\n1. **Annotate each UI resource with the tool it backs** and skip registration when that tool would be filtered out (parallel to the read-only / feature-flag pipeline on the tool side). Cleanest, future-proof.\n2. **Pass `readOnly` into `RegisterUIResources`** and short-circuit the two write forms. Quick; doesn't generalise.\n\nLikely also worth: treating these UI resources as part of the inventory (`ServerResource` with a `ToolName` or `ReadOnlyHint` field) so they flow through the same filter pipeline as tools, rather than living in a sibling registration path.\n\n## Related\n\n- Follow-up from #2516 / #2450 review.\n- MCP Apps gating itself works correctly (MCPAppsFeatureFlag in `internal/ghmcp/server.go`); the gap is specifically the read-only interaction.","author":{"url":"https://github.com/SamMorrowDrums","@type":"Person","name":"SamMorrowDrums"},"datePublished":"2026-05-21T13:20:48.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/2519/github-mcp-server/issues/2519"}