Description

The selective export endpoint POST /export/selective crashes with a 500 Internal Server Error when exporting tools. The error is:

Export failed: 'Tool' object has no attribute 'rate_limit'

Root Cause

In mcpgateway/services/export_service.py, the _export_selected_tools() method (line ~813) accesses db_tool.rate_limit and db_tool.timeout directly:

"rate_limit": db_tool.rate_limit,
"timeout": db_tool.timeout,

However, the Tool ORM model in mcpgateway/db.py (line ~2738) does not define rate_limit or timeout columns. This causes an AttributeError.

The full export path (_export_tool_data, line ~429) correctly uses getattr() with a fallback:

"rate_limit": getattr(tool, "rate_limit", None),
"timeout": getattr(tool, "timeout", None),

This is a copy-paste inconsistency between the two code paths.

Steps to Reproduce

# Create a tool
curl -X POST http://localhost:8080/tools/ \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"tool": {"name": "test-tool", "url": "https://httpbin.org/post", "integration_type": "REST", "request_type": "POST"}, "team_id": null}'

# Try selective export (returns 500)
curl -X POST http://localhost:8080/export/selective \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"tools": ["<tool_id>"]}'

Expected Behavior

Selective export should return the exported tool data (same as full export).

Suggested Fix

In mcpgateway/services/export_service.py, change _export_selected_tools() lines ~813-814 from:

"rate_limit": db_tool.rate_limit,
"timeout": db_tool.timeout,

to:

"rate_limit": getattr(db_tool, "rate_limit", None),
"timeout": getattr(db_tool, "timeout", None),

This matches the pattern already used in _export_tool_data().

Environment

• Discovered during E2E testing (issue [EPIC][TESTING][SECURITY]: RBAC automated regression suite (visibility, teams, token scope) #2387)
• Affects POST /export/selective only; GET /export (full export) works correctly