Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces a significant security enhancement by allowing users to define an explicit allowlist for secrets accessible by AI agents through the MCP server. This prevents unintended exposure of sensitive information and streamlines the agent's environment by only providing necessary credentials, thereby reducing unnecessary authentication prompts and improving overall system security posture.

Highlights

• New Configuration Option: Added mcp.secrets to restrict which secrets the MCP server exposes to AI agents.
• Secret Access Control: When mcp.secrets is set, only listed secrets are resolved and available via get_secret and exec; unlisted secrets are never resolved.
• Backward Compatibility: If mcp.secrets is omitted, all profile secrets remain available, maintaining current behavior.
• Configuration Validation: The system now warns at startup if the allowlist contains secret names that are not configured.

Greptile Summary

This PR adds an optional mcp.secrets allowlist to McpConfig that restricts which profile secrets the MCP server resolves and exposes via get_secret/exec. When omitted, all profile secrets remain available (backward-compatible). The implementation is clean and the security boundary is enforced at a single, well-tested point (filter_secrets).

Key changes:

• McpConfig.secrets: Option<Vec<String>> field with correct serde attributes (default, skip_serializing_if)
• filter_secrets helper method that returns the map unchanged when secrets is None, or filters to the allowlist when set
• Startup warnings for: empty allowlist, unknown allowlist entries, and allowlisted secrets whose provider depends on another fnox-managed secret that was excluded from the allowlist
• Overlay merge replaces rather than appends the allowlist (documented inline), with a dedicated test verifying base is not silently re-exposed
• FnoxMcpServer receives the pre-filtered profile_secrets, so both get_secret and exec naturally enforce the boundary without additional checks in the server
• Schema JSON and documentation updated to match

All prior review concerns have been addressed: the empty-allowlist warning was added, the merge semantics are commented, unit tests cover the four filter_secrets variants plus both merge scenarios, and the cross-provider dependency warning loop was implemented.

Confidence Score: 4/5

• Safe to merge — the allowlist is enforced at a single well-tested point and existing behavior is fully preserved when the field is omitted.
• Implementation is correct end-to-end: filter_secrets is the sole enforcement gate and is exercised by both get_secret and exec through the pre-filtered profile_secrets. The backward-compatibility path (no allowlist) is trivially safe. Merge semantics for overlays are correctly replace-not-append and are tested. The only deduction is that config.get_providers(&profile) is cloned even when the allowlist is empty, which is a negligible startup-time inefficiency rather than a correctness issue.
• No files require special attention; src/commands/mcp.rs has a minor startup-path inefficiency (providers map cloned for an empty allowlist) but no correctness issues.

Important Files Changed

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[fnox mcp startup] --> B[get_secrets for profile]
    B --> C{mcp.secrets set?}
    C -- None --> D[all secrets available]
    C -- Some allowlist --> E{allowlist empty?}
    E -- Yes --> F[warn: no secrets will be available]
    E -- No --> G[warn: unknown entries in allowlist]
    G --> H[warn: missing provider dependency secrets]
    F --> I[filter_secrets: keep only allowlisted]
    H --> I
    D --> I
    I --> J[profile_secrets passed to FnoxMcpServer]
    J --> K{MCP tool called}
    K -- get_secret --> L{name in profile_secrets?}
    L -- No --> M[return not found]
    L -- Yes --> N[resolve and return value]
    K -- exec --> O[ensure_resolved: batch resolve env=true secrets]
    O --> P[inject only allowlisted env=true vars into subprocess]

_{Last reviewed commit: 8f71f60}