Function DefaultInventoryFactory

pkg/http/handler.go:248–296

DefaultInventoryFactory creates the default inventory factory for HTTP mode. When the ServerConfig includes static flags (--toolsets, --read-only, etc.), a static inventory is built once at factory creation to pre-filter the tool universe. Per-request headers can only narrow within these bounds.

(cfg *ServerConfig, t translations.TranslationHelperFunc, featureChecker inventory.FeatureFlagChecker, scopeFetcher scopes.FetcherInterface)

// a static inventory is built once at factory creation to pre-filter the tool
// universe. Per-request headers can only narrow within these bounds.
func DefaultInventoryFactory(cfg *ServerConfig, t translations.TranslationHelperFunc, featureChecker inventory.FeatureFlagChecker, scopeFetcher scopes.FetcherInterface) InventoryFactoryFunc {
	// Build the static tool/resource/prompt universe from CLI flags.
	// This is done once at startup and captured in the closure.
	staticTools, staticResources, staticPrompts := buildStaticInventory(cfg, t)
	hasStaticFilters := hasStaticConfig(cfg)

	// Pre-compute valid tool names for filtering per-request tool headers.
	// When a request asks for a tool by name that's been excluded from the
	// static universe, we silently drop it rather than returning an error.
	validToolNames := make(map[string]bool, len(staticTools))
	for i := range staticTools {
		validToolNames[staticTools[i].Tool.Name] = true
	}

	return func(r *http.Request) (*inventory.Inventory, error) {
		b := inventory.NewBuilder().
			SetTools(staticTools).
			SetResources(staticResources).
			SetPrompts(staticPrompts).
			WithDeprecatedAliases(github.DeprecatedToolAliases).
			WithFeatureChecker(featureChecker)

		// When static flags constrain the universe, default to showing
		// everything within those bounds (per-request filters narrow further).
		// When no static flags are set, preserve existing behavior where
		// the default toolsets apply.
		if hasStaticFilters {
			b = b.WithToolsets([]string{"all"})
		}

		// Static read-only is an upper bound — enforce before request filters
		if cfg.ReadOnly {
			b = b.WithReadOnly(true)
		}

		// Filter request tool names to only those in the static universe,
		// so requests for statically-excluded tools degrade gracefully.
		if hasStaticFilters {
			r = filterRequestTools(r, validToolNames)
		}

		b = InventoryFiltersForRequest(r, b)
		b = PATScopeFilter(b, r, scopeFetcher)

		b.WithServerInstructions()

		return b.Build()
	}
}

// filterRequestTools returns a shallow copy of the request with any per-request
// tool names (from X-MCP-Tools header) filtered to only include tools that exist