Repository navigation
MCP tool permission requests carry no arguments (metadata: {}) #51061
Description
Description
MCP tool permission requests carry no arguments. The MCP tool wrapper asserts permission with metadata: {} (packages/core/src/tool/mcp.ts:55), while built-in tools pass what they are about to do (websearch passes its input, edit/write pass file previews, read_mcp_resource passes server and URI).
Anything deciding on an MCP call therefore sees only the tool name:
| Consumer | What it gets for demo_search({ query: "…" }) |
|---|---|
permission.evaluate plugin hook |
action: "demo_search", metadata: {} |
permission.asked event (SDK/server clients) |
same |
A plugin or client that approves destination-scoped tools (e.g. "post to this channel only") cannot tell one call from another, so it must either allow the tool wholesale or deny it wholesale.
Previously reported against 1.x as #19549 (auto-closed); the 1.x fix is #48464.
OpenCode version
2.0.16 (v2 @ dcfe1ec)
Steps to reproduce
- Configure any MCP server and set its tool to
ask. - Have the agent call the tool with arguments.
- Inspect the
permission.askedevent or apermission.evaluatehook:metadatais{}.
Reacted by ma5d
Activity
Serenity-2026 commentedon Sep 27, 2026
I'd like to take this one.
packages/core/src/tool/mcp.tsasserts permission withmetadata: {}, sopermission.evaluatehooks andpermission.askedevents only see the tool name. I'll forward the tool call arguments (the same value already passed tocallTool), matching built-in tools likewebsearch, and add a regression test. Please assign if this scope looks right.