Repository navigation
mcp: createHandler lacks readonly mode guard #3810
Description
Description
The \createHandler\ in \pkg/mcp/tools_create.go\ lacks the \s.readonly.Load()\ check that is present in other mutating tools like \deployHandler\ and \deleteHandler.
Because of this, an MCP client can execute the \create\ command (which writes project scaffolding files to the disk) even when the server is operating in readonly mode.
Expected Behavior
The \create\ tool should check \s.readonly.Load()\ and return an error if readonly mode is enabled, matching the behavior of \deploy\ and \delete.
Metadata
Metadata
Assignees
Type
Projects
- Status
Activity
Elvand-Lie commentedon May 20, 2026
/kind bug
fix(mcp): add readonly guard to createHandler
fix(mcp): add readonly guard to createHandler
fix(mcp): add readonly guard to createHandler
fix(mcp): add readonly guard to createHandler
github-actions commentedon Oct 29, 2026
This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Reopen the issue with
/reopen. Mark the issue asfresh by adding the comment
/remove-lifecycle stale.lkingland commentedon Oct 29, 2026
Withdrawn by the author in #3811:
createis allowed in read-only mode by design. The remaining read-only gap (git config tools) is addressed in #4116.