Skip to content

fix(mcp): classify tool failures, hide write tools from read-only keys, agents send feedback - #2334

Merged
Makisuo merged 3 commits into
mainfrom
fix/mcp-errors-and-feedback
Nov 7, 2026
Merged

fix(mcp): classify tool failures, hide write tools from read-only keys, agents send feedback#2334
Makisuo merged 3 commits into
mainfrom
fix/mcp-errors-and-feedback

Merge remote-tracking branch 'origin/main' into fix/mcp-errors-and-fe…

ccbe280
Select commit
Loading
Failed to load commit list.
Maple Review Bot / Maple / review succeeded Nov 7, 2026 in 2m 21s

Confidence 10/10 · No issues found

🟢 Confidence 10/10 · safe to merge. Every branch I traced holds; the only open note is F1's "nothing was recorded" text, still at send-maple-feedback.ts:154.
1 note · tests covered · risk medium · 3/3 new units observable

Reclassifies MCP failures by public HTTP type, makes a missing Maple table not-ready, hides write tools from read-only keys, and lets agents send feedback themselves. Safe to merge; the open registry McpQueryError issues are sandbox-clone and GitHub rate-limit messages, which this change leaves alone.

  • toMcpHttpError maps a 403 to McpAuthInvalidError(insufficient_scope), so a denial reads as permission, not a bug
  • A missing Maple table on a read becomes McpNotReadyError, and Resource '…' not found is classified ahead of the auth rule
  • Read-only API keys no longer see write tools in tools/list (McpServer.visibility)
  • send_maple_feedback accepts value aliases, defaults agent_type, and retries the insert twice

Still open from earlier reviews

Production impact

Open errors in the changed files (2)
Issue Service Occurrences File
@maple/mcp/errors/McpQueryError (5 issues) maple-chat 33 apps/ai/src/mcp/tools/registry.ts
@maple/mcp/errors/McpQueryError (5 issues) maple-ai 15 apps/ai/src/mcp/tools/registry.ts

After this merges, Maple checks whether they stop.

Production traffic of the changed files (last 7 days)
File Calls/day Busiest operations
apps/ai/src/mcp/dispatcher.ts 44k McpToolDispatcher.call 34k/day, 3.4% err
McpToolDispatcher.call 10k/day, 0.0% err
apps/ai/src/mcp/server.ts 3.4k tools/list 3.4k/day, 0.0% err
apps/ai/src/mcp/lib/tool-suggestions.ts 41 GET /v2/uptime_monitors 41/day, 0.0% err
What was checked
  • toMcpHttpError's switch covers all eight PublicHttpErrorType members, so no call returns undefined (error-policy.ts:17)
  • valueAliases defaults to {} per catalog entry, so entry.valueAliases[key] cannot throw (registry.ts:393)
  • describeWarehouseTable returns null when absent, and the not-ready path only fires for WarehouseConfigError (missing-table.ts:28)
Observability coverage: 3 of 3 changes observable
Change Kind Observable Evidence
tools/list visibility gate for read-only keys inbound MCP entrypoint yes Served by the existing tools/list server span in server.ts; the hide decision itself is not recorded
Missing warehouse table classification and warn log error path yes failRead logs Maple warehouse table missing for org with maple.mcp.pipe and the error message (map-warehouse-error.ts:80)
Real MCP failure message on the dispatcher span span attribute yes maple.mcp.error.message bounded to 500 chars (dispatcher.ts:203)

ccbe280 · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.

View more details on Maple Review Bot