Follow-up from #1407, which added the io.kubernetes-mcp-server/rbac metadata to tools (starting with the core toolset). Other toolsets will get this metadata in follow-up PRs.
The gap: right now, if a tool doesn't set RBAC, nothing fails — it just silently ships without RBAC metadata. There's no way to tell "nobody added this yet" apart from "this tool intentionally needs no RBAC."
Proposal: once all toolsets have RBAC metadata, add a test (e.g. TestAllToolsHaveRBACMetadata) that loops through every registered tool and fails if any of them have RBAC == nil. This way, if someone adds a new tool later and forgets to set RBAC, CI catches it instead of it slipping through review.
cc @Cali0707
Follow-up from #1407, which added the
io.kubernetes-mcp-server/rbacmetadata to tools (starting with thecoretoolset). Other toolsets will get this metadata in follow-up PRs.The gap: right now, if a tool doesn't set
RBAC, nothing fails — it just silently ships without RBAC metadata. There's no way to tell "nobody added this yet" apart from "this tool intentionally needs no RBAC."Proposal: once all toolsets have RBAC metadata, add a test (e.g.
TestAllToolsHaveRBACMetadata) that loops through every registered tool and fails if any of them haveRBAC == nil. This way, if someone adds a new tool later and forgets to set RBAC, CI catches it instead of it slipping through review.cc @Cali0707