ListTools#invoke does not alias-resolve allowed_tools

Summary

Mcp::Tools::Handlers::ListTools#invoke does not resolve aliases in its allowed_tools input. When the X-Gitlab-Enabled-Mcp-Server-Tools header contains an alias name (e.g. gitlab_search instead of search), the tool is silently filtered out.

This is the same bug class as #606029 (closed) but one layer up — McpConfigService builds the header value, and ListTools#invoke consumes it. !249839 (merged) fixes the McpConfigService side so aliases are resolved before they reach the header, but ListTools#invoke itself is still vulnerable if any other caller sends alias names directly.

This also matters during rolling deploys: a session whose header was built by a pre-rename node sends old names, and a post-rename node's ListTools#invoke filters them out.

Current behavior

An alias in allowed_tools is treated as unknown (logged as such) and the corresponding tool is excluded from the response.

Expected behavior

ListTools#invoke should resolve aliases in allowed_tools to their canonical names before filtering, so aliased tool names are retained.

Relevant code

  • lib/api/mcp/handlers/list_tools.rb — the invoke method, specifically the allowed_tools.exclude?(name) check
  • app/services/mcp/tools/manager.rb — resolve_alias (made public in !249839 (merged))

References

Edited by 🤖 GitLab Bot 🤖