feat(tools): decouple tool initialization from sources by twishabansal · Pull Request #3355 · googleapis/mcp-toolbox

twishabansal · 2026-06-04T11:42:28Z

Description

Tool initialization no longer needs live data sources. The sources map moves out of Initialize and into the request-time Manifest/GetParameters calls, so metadata endpoints (/api/toolset, tool GET, MCP tools/list) and offline flows can describe tools without source credentials. Resolved metadata for a configured source is unchanged.

Interface (`internal/tools/tools.go`)

Initialize(map[string]sources.Source) → Initialize().
Manifest() → Manifest(map[string]sources.Source) (Manifest, error).
GetParameters() → GetParameters(map[string]sources.Source) (parameters.Parameters, error).

PR Checklist

Thank you for opening a Pull Request! Before submitting your PR, there are a
few things you can do to make sure it goes smoothly:

Make sure you reviewed
CONTRIBUTING.md
Make sure to open an issue as a
bug/issue
before writing your code! That way we can discuss the change, evaluate
designs, and agree on the general idea
Ensure the tests and linter pass
Code coverage does not decrease (if any source code was changed)
Appropriate docs were updated (if necessary)
Make sure to add ! if this involve a breaking change

🛠️ Fixes #<issue_number_goes_here>

gemini-code-assist

Code Review

This pull request refactors the tool initialization and parameter resolution architecture across the codebase. The Initialize method on tool configurations has been simplified to no longer require a map of sources, deferring parameter and manifest resolution to runtime by passing a SourceProvider to the updated GetParameters and Manifest methods. Feedback from the review highlights a critical parameter name mismatch ("project" vs "projectId") in the cloudsqlgetinstances tool that could break clients. Additionally, the reviewer recommended improving robustness in the MCP manifest generation by skipping tools that fail to resolve rather than failing the entire list, and refactoring unidiomatic pointers to interfaces (*tools.Tool) to use standard interface slices.

…arameters ToolConfig.Initialize no longer takes a sources map. Tool.Manifest and Tool.GetParameters now take the sources map and return an error. Source lookups that previously happened at init move to where the source is actually needed: dynamic parameters and manifests resolve at request time, and tools that captured source resources now acquire them in Invoke. As a result, metadata endpoints and offline flows no longer require live source credentials at init.

…fest Validate-only tools now re-check source existence/compatibility lazily in Manifest/GetParameters (via a shared validate helper) instead of dropping the check, preserving fail-fast at metadata time. Add Toolset.BuildManifest to build a toolset's manifest from its tools, replacing the inline loop in toolsetHandler.

…nit-from-sources # Conflicts: # internal/tools/cloudsqladmin/cloudsqladminexecutemany/cloudsqladminexecutemany.go # internal/tools/cloudsqladmin/cloudsqladminsqlmany/cloudsqladminsqlmany.go # internal/tools/cloudsqlpg/vectorassistdeletespec/vectorassistdeletespec.go # internal/tools/cloudsqlpg/vectorassistgetspec/vectorassistgetspec.go # internal/tools/cloudsqlpg/vectorassistimprovequeryrecall/vectorassistimprovequeryrecall.go # internal/tools/cloudsqlpg/vectorassistlistspecs/vectorassistlistspecs.go # internal/tools/datalineage/datalineagesearchlineage/datalineagesearchlineage.go # internal/tools/spanner/spannersearchcatalog/spannersearchcatalog.go

… tools

Dead code superseded by GetCompatibleSourceFromMap type-assertion compatibility; the var _ compatibleSource assertions remain as the real compile-time check.

twishabansal · 2026-06-10T09:08:42Z

/gemini review

gemini-code-assist

Code Review

This pull request refactors the tool initialization and manifest generation process across all database tools. It removes the sources map parameter from the Initialize method of the ToolConfig interface, moving the resolution of source-dependent parameters lazily to the GetParameters and Manifest methods of the Tool interface. A critical issue was identified in the refactored parameter resolution logic where propagating errors when the sources map is nil or a source is missing breaks offline manifest generation (which passes nil to Manifest). It is recommended to gracefully degrade by falling back to default parameters instead of returning an error.

Yuan325

Reviewed all codes except for the individual tools/... (assuming all are similar). Thank you!

github-actions · 2026-06-12T11:47:53Z

🧨 Preview deployments removed.

Cloudflare Pages environments for pr-3355 have been deleted.

…#3388) ## Description Stacked on top of #3355 (`feat/tools-decouple-init-from-sources`). Makes `skills-generate` run without live database credentials. Changes: - **`server.InitializeOfflineConfigs`** — a source-agnostic init path that initializes only tools and toolsets, skipping sources, auth services, and embedding models. - **`skills-generate`** now uses the offline init path in `collectTools`; it no longer connects to any source. --------- Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

🤖 I have created a release *beep* *boop* --- ## [1.5.0](v1.4.0...v1.5.0) (2026-06-18) ### Features * **auth/google:** Require audience or clientId for mcpEnabled ([#3450](#3450)) ([59f7b6e](59f7b6e)) * Enable per source level flags for sql commenter ([#3465](#3465)) ([ecce6b7](ecce6b7)) * **mcp:** Add URL parameter binding for HTTP transport ([#3112](#3112)) ([0cc7b37](0cc7b37)) * **scylladb:** Adding support for ScyllaDB source and tool ([#3119](#3119)) ([2dada83](2dada83)) * **server:** Add support for toolset filtering in prebuilt CLI flag ([#3245](#3245)) ([7cc4f65](7cc4f65)) * **skills:** Generate skills offline without live source connections ([#3388](#3388)) ([4c860b6](4c860b6)) * **skills:** Tolerate missing env vars during offline skills-generate ([#3399](#3399)) ([ea5d3e5](ea5d3e5)) * **source/cloud-storage:** Restrict bucket and local path access ([#3454](#3454)) ([2c3ca5d](2c3ca5d)) * **tools/bigquery:** Add per tool query label in BigQuery jobs ([#1975](#1975)) ([3f6a49f](3f6a49f)) * **tools/dataplex:** Add tools to support metadata enrichment workflow ([#3270](#3270)) ([05289aa](05289aa)) * **tools/mysql:** Add show-query-stats and list-all-locks tools for MySQL and Cloud SQL MySQL source ([#2954](#2954)) ([a9693bd](a9693bd)) * **tools:** Decouple tool initialization from sources ([#3355](#3355)) ([32a24e3](32a24e3)) ### Bug Fixes * **auth/dataplex:** Fix failing source with service account credentials ([#3369](#3369)) ([ba4deef](ba4deef)) * **bigquery:** Wire maximumBytesBilled into prebuilt config ([#3385](#3385)) ([4abbf6e](4abbf6e)) * Bound MCP HTTP body size ([#3216](#3216)) ([d4f4342](d4f4342)) * **config:** Add doc/line context to parse errors ([#2957](#2957)) ([4b097da](4b097da)) * Escape delimiter characters in applyEscape to prevent SQL injection ([#2811](#2811)) ([932519a](932519a)) * **npm:** Source binary version from cmd/version.txt ([#3417](#3417)) ([6ffbdec](6ffbdec)) * **prebuilt/alloydb-omni:** Require password env var explicitly ([#3398](#3398)) ([fcbe3e7](fcbe3e7)) * **server:** Fail if MCP auth is enabled together with enable-api ([#3435](#3435)) ([a6ff910](a6ff910)) * **server:** Return errors instead of panicking in InitializeConfigs ([#3397](#3397)) ([f48b01d](f48b01d)) * **source/cloudhealthcare:** Validate pageURL parameter to prevent SSRF ([#3453](#3453)) ([9abf47d](9abf47d)) * **source/dataplex,source/datalineage:** Specify cloud-platform scope for default credentials ([#3376](#3376)) ([13e8c36](13e8c36)) * **source/http:** Implement SSRF guard ([#3448](#3448)) ([24d7d29](24d7d29)) * **tool/bigquery-execute-sql:** Prevent dataset restriction bypass ([#3452](#3452)) ([ca6d5e3](ca6d5e3)) * **tool/mysql-get-query-plan:** Prevent query execution bypass and statement injection ([#3235](#3235)) ([7ed1e7b](7ed1e7b)) * **tool/spanner-sql,tool/spanner-execute-sql:** Use read-only annotations when readOnly is set ([#3338](#3338)) ([8bde0ec](8bde0ec)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> Co-authored-by: Yuan Teoh <[email protected]>

🤖 I have created a release *beep* *boop* --- ## [1.5.0](v1.4.0...v1.5.0) (2026-06-18) ### Features * **auth/google:** Require audience or clientId for mcpEnabled ([#3450](#3450)) ([59f7b6e](59f7b6e)) * Enable per source level flags for sql commenter ([#3465](#3465)) ([ecce6b7](ecce6b7)) * **mcp:** Add URL parameter binding for HTTP transport ([#3112](#3112)) ([0cc7b37](0cc7b37)) * **scylladb:** Adding support for ScyllaDB source and tool ([#3119](#3119)) ([2dada83](2dada83)) * **server:** Add support for toolset filtering in prebuilt CLI flag ([#3245](#3245)) ([7cc4f65](7cc4f65)) * **skills:** Generate skills offline without live source connections ([#3388](#3388)) ([4c860b6](4c860b6)) * **skills:** Tolerate missing env vars during offline skills-generate ([#3399](#3399)) ([ea5d3e5](ea5d3e5)) * **source/cloud-storage:** Restrict bucket and local path access ([#3454](#3454)) ([2c3ca5d](2c3ca5d)) * **tools/bigquery:** Add per tool query label in BigQuery jobs ([#1975](#1975)) ([3f6a49f](3f6a49f)) * **tools/dataplex:** Add tools to support metadata enrichment workflow ([#3270](#3270)) ([05289aa](05289aa)) * **tools/mysql:** Add show-query-stats and list-all-locks tools for MySQL and Cloud SQL MySQL source ([#2954](#2954)) ([a9693bd](a9693bd)) * **tools:** Decouple tool initialization from sources ([#3355](#3355)) ([32a24e3](32a24e3)) ### Bug Fixes * **auth/dataplex:** Fix failing source with service account credentials ([#3369](#3369)) ([ba4deef](ba4deef)) * **bigquery:** Wire maximumBytesBilled into prebuilt config ([#3385](#3385)) ([4abbf6e](4abbf6e)) * Bound MCP HTTP body size ([#3216](#3216)) ([d4f4342](d4f4342)) * **config:** Add doc/line context to parse errors ([#2957](#2957)) ([4b097da](4b097da)) * Escape delimiter characters in applyEscape to prevent SQL injection ([#2811](#2811)) ([932519a](932519a)) * **npm:** Source binary version from cmd/version.txt ([#3417](#3417)) ([6ffbdec](6ffbdec)) * **prebuilt/alloydb-omni:** Require password env var explicitly ([#3398](#3398)) ([fcbe3e7](fcbe3e7)) * **server:** Fail if MCP auth is enabled together with enable-api ([#3435](#3435)) ([a6ff910](a6ff910)) * **server:** Return errors instead of panicking in InitializeConfigs ([#3397](#3397)) ([f48b01d](f48b01d)) * **source/cloudhealthcare:** Validate pageURL parameter to prevent SSRF ([#3453](#3453)) ([9abf47d](9abf47d)) * **source/dataplex,source/datalineage:** Specify cloud-platform scope for default credentials ([#3376](#3376)) ([13e8c36](13e8c36)) * **source/http:** Implement SSRF guard ([#3448](#3448)) ([24d7d29](24d7d29)) * **tool/bigquery-execute-sql:** Prevent dataset restriction bypass ([#3452](#3452)) ([ca6d5e3](ca6d5e3)) * **tool/mysql-get-query-plan:** Prevent query execution bypass and statement injection ([#3235](#3235)) ([7ed1e7b](7ed1e7b)) * **tool/spanner-sql,tool/spanner-execute-sql:** Use read-only annotations when readOnly is set ([#3338](#3338)) ([8bde0ec](8bde0ec)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> Co-authored-by: Yuan Teoh <[email protected]> 45c0f86

🤖 I have created a release *beep* *boop* --- ## [1.5.0](googleapis/mcp-toolbox@v1.4.0...v1.5.0) (2026-06-18) ### Features * **auth/google:** Require audience or clientId for mcpEnabled ([googleapis#3450](googleapis#3450)) ([59f7b6e](googleapis@59f7b6e)) * Enable per source level flags for sql commenter ([googleapis#3465](googleapis#3465)) ([ecce6b7](googleapis@ecce6b7)) * **mcp:** Add URL parameter binding for HTTP transport ([googleapis#3112](googleapis#3112)) ([0cc7b37](googleapis@0cc7b37)) * **scylladb:** Adding support for ScyllaDB source and tool ([googleapis#3119](googleapis#3119)) ([2dada83](googleapis@2dada83)) * **server:** Add support for toolset filtering in prebuilt CLI flag ([googleapis#3245](googleapis#3245)) ([7cc4f65](googleapis@7cc4f65)) * **skills:** Generate skills offline without live source connections ([googleapis#3388](googleapis#3388)) ([4c860b6](googleapis@4c860b6)) * **skills:** Tolerate missing env vars during offline skills-generate ([googleapis#3399](googleapis#3399)) ([ea5d3e5](googleapis@ea5d3e5)) * **source/cloud-storage:** Restrict bucket and local path access ([googleapis#3454](googleapis#3454)) ([2c3ca5d](googleapis@2c3ca5d)) * **tools/bigquery:** Add per tool query label in BigQuery jobs ([googleapis#1975](googleapis#1975)) ([3f6a49f](googleapis@3f6a49f)) * **tools/dataplex:** Add tools to support metadata enrichment workflow ([googleapis#3270](googleapis#3270)) ([05289aa](googleapis@05289aa)) * **tools/mysql:** Add show-query-stats and list-all-locks tools for MySQL and Cloud SQL MySQL source ([googleapis#2954](googleapis#2954)) ([a9693bd](googleapis@a9693bd)) * **tools:** Decouple tool initialization from sources ([googleapis#3355](googleapis#3355)) ([32a24e3](googleapis@32a24e3)) ### Bug Fixes * **auth/dataplex:** Fix failing source with service account credentials ([googleapis#3369](googleapis#3369)) ([ba4deef](googleapis@ba4deef)) * **bigquery:** Wire maximumBytesBilled into prebuilt config ([googleapis#3385](googleapis#3385)) ([4abbf6e](googleapis@4abbf6e)) * Bound MCP HTTP body size ([googleapis#3216](googleapis#3216)) ([d4f4342](googleapis@d4f4342)) * **config:** Add doc/line context to parse errors ([googleapis#2957](googleapis#2957)) ([4b097da](googleapis@4b097da)) * Escape delimiter characters in applyEscape to prevent SQL injection ([googleapis#2811](googleapis#2811)) ([932519a](googleapis@932519a)) * **npm:** Source binary version from cmd/version.txt ([googleapis#3417](googleapis#3417)) ([6ffbdec](googleapis@6ffbdec)) * **prebuilt/alloydb-omni:** Require password env var explicitly ([googleapis#3398](googleapis#3398)) ([fcbe3e7](googleapis@fcbe3e7)) * **server:** Fail if MCP auth is enabled together with enable-api ([googleapis#3435](googleapis#3435)) ([a6ff910](googleapis@a6ff910)) * **server:** Return errors instead of panicking in InitializeConfigs ([googleapis#3397](googleapis#3397)) ([f48b01d](googleapis@f48b01d)) * **source/cloudhealthcare:** Validate pageURL parameter to prevent SSRF ([googleapis#3453](googleapis#3453)) ([9abf47d](googleapis@9abf47d)) * **source/dataplex,source/datalineage:** Specify cloud-platform scope for default credentials ([googleapis#3376](googleapis#3376)) ([13e8c36](googleapis@13e8c36)) * **source/http:** Implement SSRF guard ([googleapis#3448](googleapis#3448)) ([24d7d29](googleapis@24d7d29)) * **tool/bigquery-execute-sql:** Prevent dataset restriction bypass ([googleapis#3452](googleapis#3452)) ([ca6d5e3](googleapis@ca6d5e3)) * **tool/mysql-get-query-plan:** Prevent query execution bypass and statement injection ([googleapis#3235](googleapis#3235)) ([7ed1e7b](googleapis@7ed1e7b)) * **tool/spanner-sql,tool/spanner-execute-sql:** Use read-only annotations when readOnly is set ([googleapis#3338](googleapis#3338)) ([8bde0ec](googleapis@8bde0ec)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> Co-authored-by: Yuan Teoh <[email protected]> 45c0f86

gemini-code-assist Bot reviewed Jun 4, 2026

View reviewed changes

Comment thread internal/tools/cloudsql/cloudsqlgetinstances/cloudsqlgetinstances.go Outdated

Comment thread internal/server/mcp/v20241105/manifests.go Outdated

Comment thread internal/server/api.go Outdated

Comment thread internal/tools/toolsets.go

twishabansal changed the base branch from refactor/server-plumb-sourceprovider-metadata to main June 4, 2026 16:54

twishabansal force-pushed the feat/tools-decouple-init-from-sources branch from 7cd5a00 to 6837330 Compare June 8, 2026 09:04

twishabansal and others added 7 commits June 9, 2026 20:56

Merge branch 'main' into feat/tools-decouple-init-from-sources

70d6764

refactor(tools): seed static param skeleton at Initialize for dynamic…

027273e

… tools

fix(tools): remove unused declarations flagged by linter

776f154

Merge branch 'main' into feat/tools-decouple-init-from-sources

9ba5b10

fix(tools): remove remaining unused compatibleSources declarations

a4794bc

Dead code superseded by GetCompatibleSourceFromMap type-assertion compatibility; the var _ compatibleSource assertions remain as the real compile-time check.

gemini-code-assist Bot reviewed Jun 10, 2026

View reviewed changes

Comment thread internal/tools/alloydb/alloydbcreatecluster/alloydbcreatecluster.go

twishabansal mentioned this pull request Jun 10, 2026

feat(skills): generate skills offline without live source connections #3388

Merged

twishabansal marked this pull request as ready for review June 10, 2026 10:14

twishabansal requested review from a team as code owners June 10, 2026 10:14

blunderbuss-gcf Bot assigned duwenxin99 Jun 10, 2026

twishabansal added 2 commits June 11, 2026 10:34

Merge branch 'main' into feat/tools-decouple-init-from-sources

c016e1d

Merge branch 'main' into feat/tools-decouple-init-from-sources

a941bc6

averikitsch approved these changes Jun 11, 2026

View reviewed changes

twishabansal enabled auto-merge (squash) June 11, 2026 18:41

Yuan325 reviewed Jun 11, 2026

View reviewed changes

Comment thread cmd/internal/skills/generator.go

twishabansal disabled auto-merge June 11, 2026 18:57

twishabansal enabled auto-merge (squash) June 11, 2026 19:06

twishabansal requested a review from Yuan325 June 11, 2026 19:17

Yuan325 approved these changes Jun 11, 2026

View reviewed changes

Merge branch 'main' into feat/tools-decouple-init-from-sources

aceddb5

prernakakkar-google approved these changes Jun 12, 2026

View reviewed changes

Merge branch 'main' into feat/tools-decouple-init-from-sources

ca6ff0f

twishabansal merged commit 32a24e3 into main Jun 12, 2026
24 checks passed

twishabansal deleted the feat/tools-decouple-init-from-sources branch June 12, 2026 11:47

release-please Bot mentioned this pull request Jun 12, 2026

chore(main): release 1.5.0 #3379

Merged

BrewTestBot mentioned this pull request Jun 18, 2026

mcp-toolbox 1.5.0 Homebrew/homebrew-core#288736

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(tools): decouple tool initialization from sources#3355

feat(tools): decouple tool initialization from sources#3355
twishabansal merged 12 commits into
mainfrom
feat/tools-decouple-init-from-sources

twishabansal commented Jun 4, 2026 •

edited

Loading

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

twishabansal commented Jun 10, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

Yuan325 left a comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jun 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

twishabansal commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Interface (internal/tools/tools.go)

PR Checklist

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

twishabansal commented Jun 10, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Yuan325 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jun 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

twishabansal commented Jun 4, 2026 •

edited

Loading

Interface (`internal/tools/tools.go`)