Conversation
Contributor
There was a problem hiding this comment.
Code Review
This pull request updates the Model Context Protocol (MCP) server implementation to support tool annotations and metadata extensions (such as toolbox/authInvoke and toolbox/authParam) across both the v20241105 and v20250326 versions. The generateToolManifest functions and associated tests have been updated to handle these new fields. The reviewer pointed out a testing issue in manifests_test.go where the Annotations assertion is wrapped in a conditional block, which could cause the test to silently pass if the annotations are unexpectedly nil.
Contributor
Author
|
/gemini review |
Contributor
There was a problem hiding this comment.
Code Review
This pull request updates the MCP server implementation across multiple schema versions (v20241105, v20250326, etc.) to support tool annotations and metadata, specifically mapping authorization requirements (toolbox/authInvoke and toolbox/authParam) to the tool manifests. Feedback on these changes suggests optimizing performance by lazily initializing the metadata map only when authorization requirements exist. Additionally, it is recommended to cast JSON byte slices to strings in the unit tests when using cmp.Diff to ensure readable test failure outputs, while also correcting a typo in the test error messages.
duwenxin99
approved these changes
Jun 4, 2026
Contributor
|
🧨 Preview deployments removed. Cloudflare Pages environments for |
Yuan325
added a commit
that referenced
this pull request
Jun 4, 2026
🤖 I have created a release *beep* *boop* --- ## [1.4.0](v1.3.0...v1.4.0) (2026-06-04) ### Features * **ci:** Add support for windows/arm64 binary distribution ([#3231](#3231)) ([10abf3b](10abf3b)) * **datalineage:** Add Data Lineage integration ([#3285](#3285)) ([19353c3](19353c3)) * **server:** Ignore unknown tools at startup with `--ignore-unknown-tools` flag ([#3353](#3353)) ([5f0304f](5f0304f)) * **tools/cloudsqlpg:** Add remaining vector assist tools for Cloud SQL Postgres ([#3203](#3203)) ([b514cbd](b514cbd)) * **tools/spanner-search-catalog:** Implement search_catalog tool ([#3140](#3140)) ([defc086](defc086)) ### Bug Fixes * **auth/generic:** Enforce issuer presence in opaque token validation ([#3360](#3360)) ([1d8df0d](1d8df0d)) * **auth:** Separate Google and Generic MCP OAuth verification ([#3341](#3341)) ([dfd66ee](dfd66ee)) * **mcp:** Support annotations and metadata within Tools to earlier MCP schemas ([#3300](#3300)) ([9a88c72](9a88c72)) * **oracle:** Remove trailing semicolons from prebuilt tools ([#3215](#3215)) ([fcad02d](fcad02d)) * **server/auth:** Centralize tool scopes validation ([#3335](#3335)) ([adce4ab](adce4ab)) * **server:** Return null id for batch request rejection ([#3333](#3333)) ([0b18d58](0b18d58)) * **source/dataplex:** Limit search results to pageSize ([#3323](#3323)) ([905c1f6](905c1f6)), closes [#3308](#3308) * **telemetry:** Allow GCP project override ([#2960](#2960)) ([3c83ba5](3c83ba5)) * **tool/bigquery:** Prevent `allowedDatasets` bypass in forecast query ([#3324](#3324)) ([45df461](45df461)) * **tool/clickhouse:** Handle ignored ProcessParameters error ([#3340](#3340)) ([ddfd887](ddfd887)) * **tools/clickhouse,tools/bigquery:** Validate identifier parameters to prevent injection ([#3219](#3219)) ([2f45f75](2f45f75)) * **tools/looker:** Escape filter values for unquoted parameters ([#3289](#3289)) ([1711156](1711156)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com>
github-actions Bot
pushed a commit
that referenced
this pull request
Jun 4, 2026
🤖 I have created a release *beep* *boop* --- ## [1.4.0](v1.3.0...v1.4.0) (2026-06-04) ### Features * **ci:** Add support for windows/arm64 binary distribution ([#3231](#3231)) ([10abf3b](10abf3b)) * **datalineage:** Add Data Lineage integration ([#3285](#3285)) ([19353c3](19353c3)) * **server:** Ignore unknown tools at startup with `--ignore-unknown-tools` flag ([#3353](#3353)) ([5f0304f](5f0304f)) * **tools/cloudsqlpg:** Add remaining vector assist tools for Cloud SQL Postgres ([#3203](#3203)) ([b514cbd](b514cbd)) * **tools/spanner-search-catalog:** Implement search_catalog tool ([#3140](#3140)) ([defc086](defc086)) ### Bug Fixes * **auth/generic:** Enforce issuer presence in opaque token validation ([#3360](#3360)) ([1d8df0d](1d8df0d)) * **auth:** Separate Google and Generic MCP OAuth verification ([#3341](#3341)) ([dfd66ee](dfd66ee)) * **mcp:** Support annotations and metadata within Tools to earlier MCP schemas ([#3300](#3300)) ([9a88c72](9a88c72)) * **oracle:** Remove trailing semicolons from prebuilt tools ([#3215](#3215)) ([fcad02d](fcad02d)) * **server/auth:** Centralize tool scopes validation ([#3335](#3335)) ([adce4ab](adce4ab)) * **server:** Return null id for batch request rejection ([#3333](#3333)) ([0b18d58](0b18d58)) * **source/dataplex:** Limit search results to pageSize ([#3323](#3323)) ([905c1f6](905c1f6)), closes [#3308](#3308) * **telemetry:** Allow GCP project override ([#2960](#2960)) ([3c83ba5](3c83ba5)) * **tool/bigquery:** Prevent `allowedDatasets` bypass in forecast query ([#3324](#3324)) ([45df461](45df461)) * **tool/clickhouse:** Handle ignored ProcessParameters error ([#3340](#3340)) ([ddfd887](ddfd887)) * **tools/clickhouse,tools/bigquery:** Validate identifier parameters to prevent injection ([#3219](#3219)) ([2f45f75](2f45f75)) * **tools/looker:** Escape filter values for unquoted parameters ([#3289](#3289)) ([1711156](1711156)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> d67cfbe
github-actions Bot
pushed a commit
to renovate-bot/googleapis-_-genai-toolbox
that referenced
this pull request
Jun 4, 2026
🤖 I have created a release *beep* *boop* --- ## [1.4.0](googleapis/mcp-toolbox@v1.3.0...v1.4.0) (2026-06-04) ### Features * **ci:** Add support for windows/arm64 binary distribution ([googleapis#3231](googleapis#3231)) ([10abf3b](googleapis@10abf3b)) * **datalineage:** Add Data Lineage integration ([googleapis#3285](googleapis#3285)) ([19353c3](googleapis@19353c3)) * **server:** Ignore unknown tools at startup with `--ignore-unknown-tools` flag ([googleapis#3353](googleapis#3353)) ([5f0304f](googleapis@5f0304f)) * **tools/cloudsqlpg:** Add remaining vector assist tools for Cloud SQL Postgres ([googleapis#3203](googleapis#3203)) ([b514cbd](googleapis@b514cbd)) * **tools/spanner-search-catalog:** Implement search_catalog tool ([googleapis#3140](googleapis#3140)) ([defc086](googleapis@defc086)) ### Bug Fixes * **auth/generic:** Enforce issuer presence in opaque token validation ([googleapis#3360](googleapis#3360)) ([1d8df0d](googleapis@1d8df0d)) * **auth:** Separate Google and Generic MCP OAuth verification ([googleapis#3341](googleapis#3341)) ([dfd66ee](googleapis@dfd66ee)) * **mcp:** Support annotations and metadata within Tools to earlier MCP schemas ([googleapis#3300](googleapis#3300)) ([9a88c72](googleapis@9a88c72)) * **oracle:** Remove trailing semicolons from prebuilt tools ([googleapis#3215](googleapis#3215)) ([fcad02d](googleapis@fcad02d)) * **server/auth:** Centralize tool scopes validation ([googleapis#3335](googleapis#3335)) ([adce4ab](googleapis@adce4ab)) * **server:** Return null id for batch request rejection ([googleapis#3333](googleapis#3333)) ([0b18d58](googleapis@0b18d58)) * **source/dataplex:** Limit search results to pageSize ([googleapis#3323](googleapis#3323)) ([905c1f6](googleapis@905c1f6)), closes [googleapis#3308](googleapis#3308) * **telemetry:** Allow GCP project override ([googleapis#2960](googleapis#2960)) ([3c83ba5](googleapis@3c83ba5)) * **tool/bigquery:** Prevent `allowedDatasets` bypass in forecast query ([googleapis#3324](googleapis#3324)) ([45df461](googleapis@45df461)) * **tool/clickhouse:** Handle ignored ProcessParameters error ([googleapis#3340](googleapis#3340)) ([ddfd887](googleapis@ddfd887)) * **tools/clickhouse,tools/bigquery:** Validate identifier parameters to prevent injection ([googleapis#3219](googleapis#3219)) ([2f45f75](googleapis@2f45f75)) * **tools/looker:** Escape filter values for unquoted parameters ([googleapis#3289](googleapis#3289)) ([1711156](googleapis@1711156)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> d67cfbe
github-actions Bot
pushed a commit
to rodineyw/mcp-toolbox
that referenced
this pull request
Jun 4, 2026
🤖 I have created a release *beep* *boop* --- ## [1.4.0](googleapis/mcp-toolbox@v1.3.0...v1.4.0) (2026-06-04) ### Features * **ci:** Add support for windows/arm64 binary distribution ([googleapis#3231](googleapis#3231)) ([10abf3b](googleapis@10abf3b)) * **datalineage:** Add Data Lineage integration ([googleapis#3285](googleapis#3285)) ([19353c3](googleapis@19353c3)) * **server:** Ignore unknown tools at startup with `--ignore-unknown-tools` flag ([googleapis#3353](googleapis#3353)) ([5f0304f](googleapis@5f0304f)) * **tools/cloudsqlpg:** Add remaining vector assist tools for Cloud SQL Postgres ([googleapis#3203](googleapis#3203)) ([b514cbd](googleapis@b514cbd)) * **tools/spanner-search-catalog:** Implement search_catalog tool ([googleapis#3140](googleapis#3140)) ([defc086](googleapis@defc086)) ### Bug Fixes * **auth/generic:** Enforce issuer presence in opaque token validation ([googleapis#3360](googleapis#3360)) ([1d8df0d](googleapis@1d8df0d)) * **auth:** Separate Google and Generic MCP OAuth verification ([googleapis#3341](googleapis#3341)) ([dfd66ee](googleapis@dfd66ee)) * **mcp:** Support annotations and metadata within Tools to earlier MCP schemas ([googleapis#3300](googleapis#3300)) ([9a88c72](googleapis@9a88c72)) * **oracle:** Remove trailing semicolons from prebuilt tools ([googleapis#3215](googleapis#3215)) ([fcad02d](googleapis@fcad02d)) * **server/auth:** Centralize tool scopes validation ([googleapis#3335](googleapis#3335)) ([adce4ab](googleapis@adce4ab)) * **server:** Return null id for batch request rejection ([googleapis#3333](googleapis#3333)) ([0b18d58](googleapis@0b18d58)) * **source/dataplex:** Limit search results to pageSize ([googleapis#3323](googleapis#3323)) ([905c1f6](googleapis@905c1f6)), closes [googleapis#3308](googleapis#3308) * **telemetry:** Allow GCP project override ([googleapis#2960](googleapis#2960)) ([3c83ba5](googleapis@3c83ba5)) * **tool/bigquery:** Prevent `allowedDatasets` bypass in forecast query ([googleapis#3324](googleapis#3324)) ([45df461](googleapis@45df461)) * **tool/clickhouse:** Handle ignored ProcessParameters error ([googleapis#3340](googleapis#3340)) ([ddfd887](googleapis@ddfd887)) * **tools/clickhouse,tools/bigquery:** Validate identifier parameters to prevent injection ([googleapis#3219](googleapis#3219)) ([2f45f75](googleapis@2f45f75)) * **tools/looker:** Escape filter values for unquoted parameters ([googleapis#3289](googleapis#3289)) ([1711156](googleapis@1711156)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> d67cfbe
github-actions Bot
pushed a commit
to Jaleel-zhu/genai-toolbox
that referenced
this pull request
Jun 4, 2026
🤖 I have created a release *beep* *boop* --- ## [1.4.0](googleapis/mcp-toolbox@v1.3.0...v1.4.0) (2026-06-04) ### Features * **ci:** Add support for windows/arm64 binary distribution ([googleapis#3231](googleapis#3231)) ([10abf3b](googleapis@10abf3b)) * **datalineage:** Add Data Lineage integration ([googleapis#3285](googleapis#3285)) ([19353c3](googleapis@19353c3)) * **server:** Ignore unknown tools at startup with `--ignore-unknown-tools` flag ([googleapis#3353](googleapis#3353)) ([5f0304f](googleapis@5f0304f)) * **tools/cloudsqlpg:** Add remaining vector assist tools for Cloud SQL Postgres ([googleapis#3203](googleapis#3203)) ([b514cbd](googleapis@b514cbd)) * **tools/spanner-search-catalog:** Implement search_catalog tool ([googleapis#3140](googleapis#3140)) ([defc086](googleapis@defc086)) ### Bug Fixes * **auth/generic:** Enforce issuer presence in opaque token validation ([googleapis#3360](googleapis#3360)) ([1d8df0d](googleapis@1d8df0d)) * **auth:** Separate Google and Generic MCP OAuth verification ([googleapis#3341](googleapis#3341)) ([dfd66ee](googleapis@dfd66ee)) * **mcp:** Support annotations and metadata within Tools to earlier MCP schemas ([googleapis#3300](googleapis#3300)) ([9a88c72](googleapis@9a88c72)) * **oracle:** Remove trailing semicolons from prebuilt tools ([googleapis#3215](googleapis#3215)) ([fcad02d](googleapis@fcad02d)) * **server/auth:** Centralize tool scopes validation ([googleapis#3335](googleapis#3335)) ([adce4ab](googleapis@adce4ab)) * **server:** Return null id for batch request rejection ([googleapis#3333](googleapis#3333)) ([0b18d58](googleapis@0b18d58)) * **source/dataplex:** Limit search results to pageSize ([googleapis#3323](googleapis#3323)) ([905c1f6](googleapis@905c1f6)), closes [googleapis#3308](googleapis#3308) * **telemetry:** Allow GCP project override ([googleapis#2960](googleapis#2960)) ([3c83ba5](googleapis@3c83ba5)) * **tool/bigquery:** Prevent `allowedDatasets` bypass in forecast query ([googleapis#3324](googleapis#3324)) ([45df461](googleapis@45df461)) * **tool/clickhouse:** Handle ignored ProcessParameters error ([googleapis#3340](googleapis#3340)) ([ddfd887](googleapis@ddfd887)) * **tools/clickhouse,tools/bigquery:** Validate identifier parameters to prevent injection ([googleapis#3219](googleapis#3219)) ([2f45f75](googleapis@2f45f75)) * **tools/looker:** Escape filter values for unquoted parameters ([googleapis#3289](googleapis#3289)) ([1711156](googleapis@1711156)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> d67cfbe
github-actions Bot
pushed a commit
to pepe57/genai-toolbox
that referenced
this pull request
Jun 5, 2026
🤖 I have created a release *beep* *boop* --- ## [1.4.0](googleapis/mcp-toolbox@v1.3.0...v1.4.0) (2026-06-04) ### Features * **ci:** Add support for windows/arm64 binary distribution ([googleapis#3231](googleapis#3231)) ([10abf3b](googleapis@10abf3b)) * **datalineage:** Add Data Lineage integration ([googleapis#3285](googleapis#3285)) ([19353c3](googleapis@19353c3)) * **server:** Ignore unknown tools at startup with `--ignore-unknown-tools` flag ([googleapis#3353](googleapis#3353)) ([5f0304f](googleapis@5f0304f)) * **tools/cloudsqlpg:** Add remaining vector assist tools for Cloud SQL Postgres ([googleapis#3203](googleapis#3203)) ([b514cbd](googleapis@b514cbd)) * **tools/spanner-search-catalog:** Implement search_catalog tool ([googleapis#3140](googleapis#3140)) ([defc086](googleapis@defc086)) ### Bug Fixes * **auth/generic:** Enforce issuer presence in opaque token validation ([googleapis#3360](googleapis#3360)) ([1d8df0d](googleapis@1d8df0d)) * **auth:** Separate Google and Generic MCP OAuth verification ([googleapis#3341](googleapis#3341)) ([dfd66ee](googleapis@dfd66ee)) * **mcp:** Support annotations and metadata within Tools to earlier MCP schemas ([googleapis#3300](googleapis#3300)) ([9a88c72](googleapis@9a88c72)) * **oracle:** Remove trailing semicolons from prebuilt tools ([googleapis#3215](googleapis#3215)) ([fcad02d](googleapis@fcad02d)) * **server/auth:** Centralize tool scopes validation ([googleapis#3335](googleapis#3335)) ([adce4ab](googleapis@adce4ab)) * **server:** Return null id for batch request rejection ([googleapis#3333](googleapis#3333)) ([0b18d58](googleapis@0b18d58)) * **source/dataplex:** Limit search results to pageSize ([googleapis#3323](googleapis#3323)) ([905c1f6](googleapis@905c1f6)), closes [googleapis#3308](googleapis#3308) * **telemetry:** Allow GCP project override ([googleapis#2960](googleapis#2960)) ([3c83ba5](googleapis@3c83ba5)) * **tool/bigquery:** Prevent `allowedDatasets` bypass in forecast query ([googleapis#3324](googleapis#3324)) ([45df461](googleapis@45df461)) * **tool/clickhouse:** Handle ignored ProcessParameters error ([googleapis#3340](googleapis#3340)) ([ddfd887](googleapis@ddfd887)) * **tools/clickhouse,tools/bigquery:** Validate identifier parameters to prevent injection ([googleapis#3219](googleapis#3219)) ([2f45f75](googleapis@2f45f75)) * **tools/looker:** Escape filter values for unquoted parameters ([googleapis#3289](googleapis#3289)) ([1711156](googleapis@1711156)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> d67cfbe
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Extended the annotations and metadata fields within the Tools interface to support older MCP schemas (specifically
v20241105andv20250326). Because these fields are not part of the official MCP schema for those versions, they were dropped when we implemented strict manifest versioning. However, since they were historically included prior to versioning, we are restoring them as a custom extension to the existing MCP specifications.