Added an missing commnad line flag for edit_costom_detector capability

README.md

@@ -133,6 +133,7 @@ configuration file.
 | `run_defi_vanguard_task` | Start a DeFi Vanguard task for a project version; registered only when task runs are explicitly enabled |
 | `create_version_from_file` | Create a project version by uploading a local `.zip` archive; registered only when version creation is explicitly enabled |
 | `create_version_from_url` | Create a project version from a git repository or archive URL; registered only when version creation is explicitly enabled |
+| `upload_custom_detector` | Create or update an organization-level custom detector; registered only when custom detector editing is explicitly enabled |
 
 All tools return typed Python objects backed by `audithub-sdk` models.
 
@@ -158,6 +159,7 @@ allowlists.
 - **Opt-in DeFi Vanguard task execution.** The `run_defi_vanguard_task` mutation tool is registered under the same task-run opt-in gate. Its inputs are flattened at the top level: `organization_id`, `project_id`, `version_id`, detector selections, and the runtime options. Pass detector selections as two-item JSON arrays `[type, id]`, where builtin selectors use a built-in detector code from `get_defi_vanguard_detectors`, and custom selectors use the catalog id shown by the same tool. The server resolves those selections through the backend detector catalog before calling the generated DeFi Vanguard v2 POST endpoint.
 - **On-chain OrCa mode.** When launching OrCa against already deployed contracts, pass `deployment_info_file` as a path ending in `.deployment.json`. The server normalizes that into `on_chain=True` and rejects mismatched paths early so callers do not accidentally launch a local Foundry-style run.
 - **Opt-in version creation.** The `create_version_from_url` mutation tool is registered only when `AH_ENABLE_VERSION_CREATION=1` or `--enable-version-creation` is supplied. It calls the generated project version URL POST endpoint through `audithub-sdk`.
+- **Opt-in custom detector editing.** The `upload_custom_detector` mutation tool is registered only when `capabilities.edit_custom_detectors: true` is set in the config file or `--enable-edit-custom-detectors` is supplied.
 - **Local findings parsing.** The `parse_findings_from_task_log` utility tool reads one or more local task log files, extracts findings with the shared log parser, and writes a JSON file containing the parsed findings plus the total finding count and per-log counts. It does not call the AuditHub API.
 - **Local PAQL validation.** The `validate_paql` utility tool runs the bundled PAQL WebAssembly
   module with the uv-installed Node.js runtime, invokes it directly without a shell, and does

docs/configuration.md

@@ -21,6 +21,7 @@ CLI flags can also override the allowlist and feature toggles after the base set
 - `--allowed-project-ids`
 - `--enable-task-runs`
 - `--enable-version-creation`
+- `--enable-edit-custom-detectors`
 
 Use CLI overrides when you want a temporary change without editing the config file or exporting
 new environment variables.
@@ -134,6 +135,7 @@ appropriate `capabilities` options.
   - `edit_custom_detectors` (boolean)
     - Set to `true` to enable `upload_custom_detector` for organization-level custom
       detectors. Default: `false`.
+    - Command-line override: `--enable-edit-custom-detectors`.
     - The tool accepts inline detector source text via `contents`. A local `file_path`
       remains available for same-machine workflows, but remote MCP clients should pass
       the detector text directly.

src/audithub_mcp/server.py

@@ -293,6 +293,7 @@ def _assert_edit_custom_detectors_enabled() -> None:
     if not _edit_custom_detectors_enabled:
         raise RuntimeError(
             "AuditHub custom detector uploads are disabled. Restart the server with "
+            "--enable-edit-custom-detectors or "
             "capabilities.edit_custom_detectors: true in the config file to enable "
             "upload_custom_detector."
         )
@@ -369,6 +370,11 @@ def _build_arg_parser() -> argparse.ArgumentParser:
         action="store_true",
         help="Register opt-in mutation tools that can create AuditHub project versions.",
     )
+    parser.add_argument(
+        "--enable-edit-custom-detectors",
+        action="store_true",
+        help="Register the opt-in tool that can create or update custom detectors.",
+    )
     parser.add_argument(
         "--list-tools",
         action="store_true",
@@ -507,7 +513,9 @@ def _apply_cli_args_to_config(
         allowed_project_ids=allowed_project_ids,
         task_runs_enabled=config.task_runs_enabled or args.enable_task_runs,
         version_creation_enabled=config.version_creation_enabled or args.enable_version_creation,
-        edit_custom_detectors_enabled=config.edit_custom_detectors_enabled,
+        edit_custom_detectors_enabled=(
+            config.edit_custom_detectors_enabled or args.enable_edit_custom_detectors
+        ),
     )
 
 

tests/test_server.py

@@ -529,6 +529,28 @@ def test_main_enables_version_creation_from_cli_flag(self) -> None:
         finally:
             server._set_version_creation_enabled(False)
 
+    def test_main_enables_custom_detector_upload_from_cli_flag(self) -> None:
+        allow_env = {
+            "AH_ALLOWED_ORG_IDS": "1",
+            "AH_ALLOWED_PROJECT_IDS": "10",
+            **_FULL_ENV,
+        }
+        server._context = None
+        argv = ["audithub-mcp", "--enable-edit-custom-detectors"]
+        try:
+            with (
+                patch.dict(os.environ, allow_env, clear=True),
+                patch.object(sys, "argv", argv),
+                patch.object(server.mcp, "run"),
+            ):
+                server.main()
+            self.assertTrue(server._edit_custom_detectors_enabled)
+            self.assertTrue(server._is_tool_registered("upload_custom_detector"))
+            self.assertFalse(server._task_runs_enabled)
+            self.assertFalse(server._version_creation_enabled)
+        finally:
+            server._set_edit_custom_detectors_enabled(False)
+
     def test_main_loads_settings_from_config_file_and_env_overrides(self) -> None:
         config_path = Path(__file__).with_name("dummy_config.yaml")
         env = {