[Elvand-Lie]

config_git_set and config_git_remove never checked the read-only flag, so they still ran when the MCP server was started without FUNC_ENABLE_MCP_WRITE. This meant a client in read-only mode could rewrite func.yaml and create cluster resources and a GitHub webhook with config_git_set, or delete cluster pipeline resources with config_git_remove and delete_cluster: true. The tools were added in #3818 without the read-only check.

Add the same read-only check the config envs, labels and volumes handlers use (#3708) as the first check in each handler, so nothing reaches the executor.

Changes

• Add the read-only guard to configGitSetHandler and configGitRemoveHandler in pkg/mcp/tools_config_git.go
• List the git config tools under disabled operations in instructions_warning.md
• Add TestTool_ConfigGitSet_Readonly and TestTool_ConfigGitRemove_Readonly

config_ci is unchanged; it only generates a local workflow file.

/kind bug

Testing

go test -race ./pkg/mcp/... -count=1    # PASS

Both new tests fail without the guards (the executor still runs) and pass with the fix. The existing TestTool_ConfigGitSet_Args and TestTool_ConfigGitRemove_Args tests still cover the writable path.

Release Note

The MCP server now blocks config_git_set and config_git_remove in read-only mode.

Docs

[knative-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Elvand-Lie
Once this PR has been reviewed and has the lgtm label, please assign matzew for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[knative-prow]

Hi @Elvand-Lie. Thanks for your PR.

I'm waiting for a knative member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.