feat: MCP tool profiles & parameter validation hardening#45
Merged
Conversation
added 8 commits
May 15, 2026 16:39
Add --tools flag to mcp serve/tools with readonly/default/all profiles for safe AI agent delegation. Expand device catalog and param-validator coverage. Fix: reject malformed JSON field types before Number() coercion, block waterLevel for all combo vacuum aliases, correct Strip Light 3 brightness range, add missing devices to isColorTemperatureDevice.
Keep parameter range as 0-100 but change exampleParams from '0' to '1' so expand users don't hit the hardcoded min=1 client-side check.
- buildBrightnessSet now accepts deviceType and uses brightnessRange() so 0-100 devices (Floor Lamp, RGBIC, etc.) allow --brightness 0 - buildBlindTiltSetPosition rejects odd angles (must be multiple of 2) - Restore catalog exampleParams to '0' since expand now supports it
validateParameter now resolves aliases (e.g. "Evaporative Humidifier" → "Humidifier2") via canonicalizeDeviceType before matching, so cached alias strings get the same validation as canonical type names.
Prevents Number("") coercing to 0 and silently passing range checks.
Prevents expand from rejecting valid lighting commands when the cached device type is an alias (e.g. "Ceiling Light Pro").
The default profile excludes admin tools; smoke test calls policy_new.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
--toolsflag tomcp serve/mcp toolswith three profiles:readonly(10 tools),default(13),all(24) for safe AI agent delegationNumber(true)→ 1,Number("")→ 0) withisNumericishguardparseParameterForWirefor consistent JSON parameter serialization in MCPTest plan
npm run typecheckpassesnpx vitest run— 2370 tests passswitchbot mcp tools --tools readonlyshows 10 toolsswitchbot mcp tools --tools allshows 24 toolsswitchbot mcp serve --tools readonlyonly registers read-only toolsswitchbot devices expand <floorLampId> setBrightness --brightness 0acceptedswitchbot devices command <blindId> setPosition "up;51"rejected (odd angle)🤖 Generated with Claude Code