Fix Claude tool schema compatibility

[mohanagy]

What changed

• preserve JSON Schema structure when tool property names look credential-related
• continue redacting configured secrets, bearer values, and recognized provider tokens from schema text
• normalize schema-valued boolean true to equivalent {} for Claude Desktop proxy compatibility
• retain boolean false constraints and ordinary boolean values
• add exact Vercel, Firebase, and Stripe regression fixtures

Root cause

The generic audited-result redactor treated names inside JSON Schema properties maps as ordinary structured-data keys. Names such as tokens, passwordProtection, and page_token therefore caused their schema definitions to be replaced with "[REDACTED]", invalidating tools/list before any upstream tool call. Separately, Claude Desktop's local proxy converter rejects valid schema-valued boolean true in exposed output schemas.

User impact

Claude Desktop can discover the affected Vercel, Firebase, and Stripe tool catalogs through Miftah. MongoDB behavior is unchanged; it was verified healthy during diagnosis.

Validation

• red-to-green MCP SDK regression for the exact rejected fields
• real local config replay: Vercel 47 tools, Firebase 36 tools, Stripe 22 tools
• full Vitest suite: 1,948 passed, 34 skipped, 0 failed
• focused wrapper and secret suite: 121 passed
• package contract: 31 passed
• MCP Inspector 2.1.0 interoperability
• 57-file pack contract
• typecheck
• lint
• build
• generated fixture reproducibility

Closes #397

Summary by CodeRabbit

• Bug Fixes
  • Improved tool-list redaction to preserve JSON Schema structure, property names, defaults, and validation behavior.
  • Sensitive textual metadata is redacted without altering valid schema values.
  • Open boolean schemas are normalized for improved compatibility with Claude Desktop proxy integrations.
• Compatibility
  • Improved compatibility with Vercel, Firebase, Stripe, and other tools that rely on detailed input and output schemas.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 25 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 5ef5aa1e-65b1-48be-94ea-2763b8bf22ae

📥 Commits

Reviewing files that changed from the base of the PR and between b24f578 and bdeb3be.

📒 Files selected for processing (4)

• src/mcp/server/miftah-server.ts
• tests/fixtures/fake-upstream-bundled.mjs
• tests/fixtures/fake-upstream-runtime.mjs
• tests/mcp-wrapper.test.ts

📝 Walkthrough

Walkthrough

The change adds schema-aware redaction for tools/list. It preserves JSON Schema structure, redacts sensitive metadata, normalizes true schemas to {}, and adds compatibility fixtures and integration coverage.

Changes

Schema redaction and compatibility validation

Layer / File(s)	Summary
Schema-aware redaction pipeline src/mcp/server/miftah-server.ts	tools/list uses an optional result redactor. The new helpers preserve JSON Schema properties and structure while redacting sensitive values and normalizing boolean schemas.
Compatibility fixtures and regression coverage tests/fixtures/fake-upstream-runtime.mjs, tests/mcp-wrapper.test.ts, CHANGELOG.md	Optional Vercel, Firebase, and Stripe schema fixtures support integration tests for schema preservation, redaction, and boolean-schema normalization. The changelog records the fix.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant MCPClient
  participant MiftahServer
  participant runAudited
  participant SchemaRedactor
  MCPClient->>MiftahServer: Request tools/list
  MiftahServer->>runAudited: Execute with schema-aware result redactor
  runAudited->>SchemaRedactor: Redact tool metadata and schemas
  SchemaRedactor-->>runAudited: Preserve schema structure and normalize true
  runAudited-->>MCPClient: Return sanitized tools/list

Loading

Possibly related PRs

• mohanagy/miftah#308: Overlaps with audit-redaction changes for credential-shaped input data.

Poem

A rabbit checked each schema’s gate,
And kept the shapes both sound and straight.
Secret tokens hid from sight,
True became an empty {} just right.
Vercel, Firebase, Stripe now hop with care.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the primary Claude tool schema compatibility fix.
Description check	✅ Passed	The description covers the change, root cause, impact, validation, and linked issue, but omits dedicated Summary and Security impact sections.
Linked Issues check	✅ Passed	The changes address the linked issue by preserving schemas, redacting sensitive metadata, normalizing boolean true, adding fixtures, and reporting required validation.
Out of Scope Changes check	✅ Passed	The changelog, implementation, fixtures, and tests are directly related to the linked compatibility and redaction objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/397-tool-schema-compat

---

_{Comment @coderabbitai help to get the list of available commands.}

[mohanagy]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[mohanagy]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/mcp/server/miftah-server.ts`:
- Around line 3710-3718: Update redactClientVisibleSchema for the
jsonSchemaMapKeywords branches and the corresponding properties, $defs,
dependencies, default, and examples handling so each copied object key passes
through the existing scalar redaction logic while preserving ordinary names such
as tokens. Add a regression fixture using API_TOKEN as a schema property key and
verify configured-secret, bearer, and provider-token values are redacted from
the client-visible schema.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 21fb2d14-05da-49ee-b949-76982c628c59

📥 Commits

Reviewing files that changed from the base of the PR and between b5dc8d7 and b24f578.

📒 Files selected for processing (5)

• CHANGELOG.md
• src/mcp/server/miftah-server.ts
• tests/fixtures/fake-upstream-bundled.mjs
• tests/fixtures/fake-upstream-runtime.mjs
• tests/mcp-wrapper.test.ts