lizhimins opened a new issue, #4307: URL: https://github.com/apache/rocketmq-dashboard/issues/4307
### Motivation Today the instance a tool operates on is ambient: it is derived from the MCP target rather than declared as a parameter of the tool. That has several consequences: - **Callers cannot see the requirement.** Because `instanceId` is not in the tool schema, a client reading the catalog has no way to know that a tool is instance-scoped, or what to pass. Per `docs/studio-instance-model-spec.md` the parameter has to be listed explicitly in the schema — "supplied by the context" is not an acceptable substitute, because the tool surface is the contract. - **No cross-check.** The executor cannot compare an instance supplied in the arguments against the instance the caller actually authenticated for, so a mismatch is undetectable rather than a 4xx. - **`cluster` doubles as the instance parameter name.** The tool layer addresses instances by `cluster`, which conflates the physical cluster with the Studio-side ownership concept. `cluster`/`clusterId` need to stay for genuine physical-cluster semantics (`cluster.list`, `TopicVO.clusterId`), while instance addressing uses `instanceId`. - **Platform-level tools are not distinguishable.** The eleven tools that legitimately have no instance (discovery plus the infrastructure tools addressed by physical `clusterName`) go through the same path as instance-scoped ones, so there is no place to express the exemption. - **Console global scope.** The web console lists the available tools without a target; that path has to keep working rather than 400. ### Expected - `instanceId` becomes an explicit required parameter of every instance-scoped tool, declared in its schema - the MCP header carrying it is `x-rmq-instance-id` - `ToolExecutionContext` and `McpAuthentication` expose `instanceId()` - the executor requires `instanceId` in the tool arguments and cross-checks it against the authenticated target - the eleven platform-level tools skip both checks, validated by the catalog rather than by convention - tool discovery keeps returning an empty list for a blank target so the console can still list the global tools -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
