Stop auto injecting Coder MCP tools

[matifali]

Problem

Coder's MCP server provides access to a list of Coder-specific tools. These can be useful when interacting with Coder from agents running outside Coder, but are not particularly useful within Coder Workspaces. Even if someone needs it in Coder workspaces, it can be easily configured using the CLI, i.e., coder exp mcp.

They get auto-injected if you have CODER_EXPERIMENTS=oauth,http-mcp-server experiments enabled and get included in each interaction.

Injecting them into all intercepted requests, regardless of whether a client needs them, will inflate token usage if the client is already injecting Coder MCP tools or does not need these tools.

Suggested Solution

Stop automatic injection entirely and use explicit ways to add the Coder MCP server:

1. coder exp mcp: for Coder workspaces configurable via Templates
2. Remote MCP: for any clients that support http MCP servers
3. Centrally via AI Bridge, but make automatic injection opt-in by explicitly specifying CODER_AIBRIDGE_CODER_MCP_TOOLS=enable and an ALLOW_LIST=coder_list_workspaces,coder_list_templates` of tools to inject.

Note

In the future, we could extend this to per-client configuration, allowing users to opt out of specific tools. How? TBD.

[matifali]

As a workaround, we have limited the Coder MCP tools injected by the Claude Cide module coder/registry#507