feat(mcp): close pre-existing agent allowlist gaps - #922
Conversation
Allowlist the remaining branches of the inbox conversion engine (convertToEvent, convertToReminder), notes.applyTemplate so an agent can apply a template it can already read, and the features/inbox settings get/set pairs. Feature toggles matter most: without them an agent cannot tell which surfaces are enabled and may suggest actions the user cannot perform. Adds a regression guard for the operations deliberately kept out — telemetry, feedback, diagnostics, and shell/OS-surface actions — so a future audit does not re-file them. Closes #921
github-actions
Bot
added
documentation
There was a problem hiding this comment.
🟢 Ready to approve
The allowlist additions align with the stated gaps, are covered by focused regression tests, and the documentation is updated accordingly.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Pull request overview
Closes remaining MCP desktop allowlist gaps so agents can (a) complete inbox conversions, (b) apply note templates they can already read, and (c) read/write feature + inbox settings—while adding a regression test guard against re-allowlisting deliberately excluded telemetry/feedback/diagnostics and shell/OS-surface operations.
Changes:
- Allowlisted
inbox.convertToEvent/inbox.convertToReminder,notes.applyTemplate, andsettings.get/setFeaturesSettings+settings.get/setInboxSettings. - Added targeted regression tests covering the new allowlisted operations and ensuring excluded operations stay excluded.
- Updated Agent MCP docs to reflect the expanded allowlist surface and the intentional exclusions.
File summaries
| File | Description |
|---|---|
| packages/contracts/src/agent-mcp-channels.ts | Adds the missing desktop read/write operation names to the MCP allowlists and schema enum. |
| packages/contracts/src/agent-mcp-channels.test.ts | Adds regression tests for the newly allowlisted ops and asserts excluded ops are not present. |
| apps/docs/src/user-guide/ai/agent-mcp.md | Documents the new allowlisted operations and clarifies excluded operation categories. |
Review details
- Files reviewed: 3/3 changed files
- Comments generated: 0
- Review effort level: Lite
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
What
inbox.convertToEvent,inbox.convertToRemindernotes.applyTemplateso an agent can apply a template it can already readsettings.get/setFeaturesSettingsandsettings.get/setInboxSettingspairsWhy
Without the feature toggles an agent cannot tell which surfaces are enabled, so it suggests actions the user cannot perform. Closes #921.