Problem/Motivation

2.22.1 removed McpEntityToolTrait::checkResponseSizeCap() as unused. Nothing inside this project called it, but the trait is what other modules use to build governed tools, and GraphQL Compose Codegen's MCP submodule calls it in SchemaToolBase::doExecute().

With MCP Sentinel 2.22.1 installed, that call is an undefined method. The tool base catches every Throwable and returns its fixed refusal, so all three Codegen tools (inspect, diff, preview) answer "Schema operation refused. Check selectors and schema limits." for every request. Access checks still pass, the tools are still listed, and nothing in the result says the cause is a missing method. The only trace is a warning in the log with the exception class.

Removing a protected method from a trait that other projects use is a breaking change in a patch release.

Steps to reproduce

  1. Install MCP Sentinel 2.22.1 with GraphQL Compose Codegen 1.4.0 and its MCP submodule.
  2. Run the submodule's kernel test, or call graphql_compose_codegen_inspect as a permitted account.
  3. Access is allowed. Execution returns the refusal message. testGovernedToolsAndAnonymousDenial fails at the success assertion.

Reproduced locally on Drupal 11 with 2.22.1.

Proposed resolution

  • Restore checkResponseSizeCap() with its previous signature and behaviour.
  • Mark the protected methods of McpGovernedToolBase and McpEntityToolTrait as API for downstream tool authors, and say so in the developer documentation, so a cleanup pass does not read them as dead code again.
  • Add a test module with a tool that lives outside this project's namespace and calls every helper a downstream tool is expected to use. A removed or renamed helper then fails this project's own CI.

Remaining tasks

  • Patch release.
  • Check the other removals in the same cleanup (decide(), the scope resolver wrapper) for callers outside this project.

API changes

Restores a protected trait method that 2.22.0 had.

Comments

jmcerda created an issue. See original summary.

jmcerda’s picture

jmcerda
Location Boca Raton, FL
commented
Status: Active » Fixed

Committed to 1.x. checkResponseSizeCap() is restored with its 2.22.0 signature and behaviour. The same cleanup had removed the --require-oauth option of mcp-sentinel:setup; it is declared again as the no-op it was, because Drush rejects an option a command does not declare and a provisioning script outside this project passes it. The protected members of McpGovernedToolBase and McpEntityToolTrait are tagged @api and documented as the surface for tool authors in other projects. A new test module holds a tool in another namespace that calls every one of those helpers, so removing or renaming one now fails this project's own tests. This ships in the next patch release.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.