fix(mcp): report config:read restriction on llmModels/embeddingModels…

[krishsingh120]

Closes #2942

Problem

pipeshub_sources returns llmModels/embeddingModels as an empty array ([]) with HTTP 200 when the caller's token lacks config:read, instead of surfacing the denial. A client can't distinguish "nothing is configured" from "you're not authorized to see it."

Root cause

The underlying backend routes (GET /aiModelsConfig, GET /ai-models) correctly return a 403 when config:read is missing — the backend itself isn't buggy. The issue is at the MCP tool layer: pipeshub_sources (in this repo, src/mcp-server/tools/pipeshubSources.ts) swallows that 403 and silently returns an empty array instead of propagating the denial.

I initially suspected the fix belonged in the main pipeshub-ai repo's Node.js backend, but traced it through the require-scopes.middleware.ts (working correctly) before finding the actual tool implementation lives in this separate mcp-server repo.

Why not gate the whole tool with config:read (Option A from the issue)?

MCPScope (src/mcp-server/scopes.ts) is auto-generated by Speakeasy ("DO NOT EDIT") and only exposes "read" as a valid scope — there's no way to require config:read specifically at the tool level. So I went with Option B: explicitly flag the restriction in the response instead.

Fix

In pipeshubSources.ts, when a config:read-gated field returns a 403 (checked via APIError.httpMeta.response.status), the tool now returns:

llmModels: [],
llmModelsRestricted: true

instead of silently returning llmModels: [] with no indication of why. Same handling applies to embeddingModels. Any other error status still returns the existing error result unchanged.

This mirrors a workaround already present in the CLI's sources() command (src/cli/commands.ts), which had manually detected this same silent-empty-array behavior for CLI users only — this fix makes the distinction available to all MCP clients (Claude Desktop, Cursor, etc.), not just the CLI.

Testing

• npx tsc --noEmit passes cleanly with no errors.
• Verified the logic against the reproduction steps described in #2942 (5-scope token without config:read vs. full-scope token).
• I was not able to run a full local integration test against a live PipesHub instance with real OAuth scopes — happy to do so if a maintainer can point me to a test setup, or if further verification is needed before merge.

Files changed

• src/mcp-server/tools/pipeshubSources.ts — added APIError import, updated tool description to document the new *Restricted fields, replaced the silent-swallow error branch with explicit 403 detection.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d99edd20-535f-4a2f-9f32-729651d67324

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}