refactor: specialize tool gating to report-problem

Only report-problem is conditionally served, so replace the generic
tool-gating machinery with a report-problem-specific check. This removes
the trap where a second TOOL_CLIENT_BLOCKLIST row would be silently
ignored, since gating logic now runs the full chain rather than just the
server filter.

- server.ts: isToolServable(toolName) -> isReportProblemServable()
- const.ts: TOOL_CLIENT_BLOCKLIST record -> REPORT_PROBLEM_BLOCKED_CLIENTS
- mcp_clients.ts: isToolBlockedForClient -> isReportProblemBlockedForClient;
  drop now-unused isClientGatedTool

No behavior change.

Author: RobertCrupa

src/const.ts

@@ -59,16 +59,13 @@ export const HELPER_TOOLS = {
 export type HelperToolName = (typeof HELPER_TOOLS)[keyof typeof HELPER_TOOLS];
 
 /**
- * Tools hidden from specific MCP clients, keyed by tool name → client-name substrings
- * (lowercased, matched against `clientInfo.name`). Applied once per connection in the compose
- * step, where the client is known. `report-problem` is hidden from Anthropic surfaces
- * (Claude.ai / Claude Desktop / Claude Code) pending the directory review. Substring matching
- * covers new client builds without a maintained allowlist; over-matching only hides an optional
- * tool, which is the safe failure mode.
+ * Client-name substrings (lowercased, matched against `clientInfo.name`) that `report-problem` is
+ * hidden from. Applied once per connection in the compose step, where the client is known.
+ * `report-problem` is hidden from Anthropic surfaces (Claude.ai / Claude Desktop / Claude Code)
+ * pending the directory review. Substring matching covers new client builds without a maintained
+ * allowlist; over-matching only hides an optional tool, which is the safe failure mode.
  */
-export const TOOL_CLIENT_BLOCKLIST: Record<string, string[]> = {
-    [HELPER_TOOLS.PROBLEM_REPORT]: ['claude', 'anthropic'],
-};
+export const REPORT_PROBLEM_BLOCKED_CLIENTS: string[] = ['claude', 'anthropic'];
 
 export const RAG_WEB_BROWSER = 'apify/rag-web-browser';
 export const RAG_WEB_BROWSER_WHITELISTED_FIELDS = ['query', 'maxResults', 'outputFormats'];

src/mcp/server.ts

@@ -91,7 +91,7 @@ import {
     computeToolResponseBytes,
     getToolCallErrorUserText,
 } from '../utils/mcp.js';
-import { isClientGatedTool, isToolBlockedForClient } from '../utils/mcp_clients.js';
+import { isReportProblemBlockedForClient } from '../utils/mcp_clients.js';
 import { buildPaymentRequiredResponse, isX402PaymentRequiredError } from '../utils/payment_errors.js';
 import { createProgressTracker } from '../utils/progress.js';
 import { getServerInstructions } from '../utils/server-instructions/index.js';
@@ -369,32 +369,34 @@ export class ActorsMcpServer {
     }
 
     /**
-     * Compose the tool list for the current connection: resolve mode-specific tools, then drop any
-     * not currently servable (see {@link isToolServable}). Client-agnostic tools compose eagerly, so
-     * a recovery/rehydration load without an initialize still restores them. Client-gated tools are
-     * withheld until the client is known and re-added by the initialize flush. Used by every
-     * input-driven load path and the flush. (loadActorsAsTools upserts actor tools directly; actor
-     * tools are never client-gated, so they need no filtering.)
+     * Compose the tool list for the current connection: resolve mode-specific tools, then drop
+     * report-problem unless it is currently servable (see {@link isReportProblemServable}). Every
+     * other tool composes eagerly, so a recovery/rehydration load without an initialize still
+     * restores them. report-problem is withheld until the client is known and re-added by the
+     * initialize flush. Used by every input-driven load path and the flush. (loadActorsAsTools
+     * upserts actor tools directly; actor tools are never gated, so they need no filtering.)
      */
     private composeToolsForClient(input: Input, actorTools: ToolEntry[]): ToolEntry[] {
-        return getToolsForServerMode(input, actorTools, this.serverMode).filter((tool) =>
-            this.isToolServable(tool.name),
+        return getToolsForServerMode(input, actorTools, this.serverMode).filter(
+            (tool) => tool.name !== HELPER_TOOLS.PROBLEM_REPORT || this.isReportProblemServable(),
         );
     }
 
     /**
-     * Whether a tool may be served on this connection right now:
-     * - report-problem's only function is forwarding submissions via telemetry, so it is never
-     *   servable when telemetry is disabled (it would just fake an acknowledgement into the void).
-     * - A client-gated tool (has a {@link TOOL_CLIENT_BLOCKLIST} rule) cannot be judged until the
-     *   client is known, so it is withheld until then — the initialize flush re-composes and adds it
-     *   if the client allows. Client-agnostic tools are always servable, so they compose eagerly and
-     *   survive a recovery load that never sees an initialize.
+     * Whether report-problem may be served on this connection right now:
+     * - Its only function is forwarding submissions via telemetry, so it is never servable when
+     *   telemetry is disabled (it would just fake an acknowledgement into the void).
+     * - It cannot be judged until the connecting client is known, so it is withheld until then;
+     *   the initialize flush re-composes and adds it if the client allows.
+     * Every other tool is unconditionally servable, so recovery loads compose them eagerly and they
+     * survive a load that never sees an initialize.
      */
-    private isToolServable(toolName: string): boolean {
-        if (toolName === HELPER_TOOLS.PROBLEM_REPORT && !this.telemetryEnabled) return false;
-        if (isClientGatedTool(toolName) && !this.clientKnown) return false;
-        return !isToolBlockedForClient(toolName, this.options.initializeRequestData);
+    private isReportProblemServable(): boolean {
+        return (
+            !!this.telemetryEnabled &&
+            this.clientKnown &&
+            !isReportProblemBlockedForClient(this.options.initializeRequestData)
+        );
     }
 
     private composePendingToolsForClient(): void {
@@ -896,7 +898,7 @@ export class ActorsMcpServer {
             const captureResult = <T>(r: T): T => {
                 // On a failed result, nudge the agent to report the blocker via report-problem at the
                 // moment it decides what to do next. Gated on the tool actually being served (see
-                // isToolServable), so clients where it is blocklisted or telemetry is off never see it.
+                // isReportProblemServable), so clients where it is blocklisted or telemetry is off never see it.
                 const augmented = appendReportProblemNudge(r, {
                     failingToolName: resolvedToolName,
                     available: this.tools.has(HELPER_TOOLS.PROBLEM_REPORT),

src/utils/mcp_clients.ts

@@ -1,29 +1,18 @@
 import type { InitializeRequest } from '@modelcontextprotocol/sdk/types.js';
 import { mcpClients } from 'mcp-client-capabilities';
 
-import { TOOL_CLIENT_BLOCKLIST } from '../const.js';
+import { REPORT_PROBLEM_BLOCKED_CLIENTS } from '../const.js';
 
 /**
- * True when `toolName` is blocklisted for the connecting client (see {@link TOOL_CLIENT_BLOCKLIST}).
- * Matches any configured client-name substring against the self-reported `clientInfo.name`
- * (lowercased), so new client builds are covered without a maintained allowlist; over-matching
- * only hides an optional tool, which is the safe failure mode. An unknown or absent client is
- * never blocked.
+ * True when `report-problem` is blocklisted for the connecting client (see
+ * {@link REPORT_PROBLEM_BLOCKED_CLIENTS}). Matches any configured client-name substring against the
+ * self-reported `clientInfo.name` (lowercased), so new client builds are covered without a
+ * maintained allowlist; over-matching only hides an optional tool, which is the safe failure mode.
+ * An unknown or absent client is never blocked.
  */
-export function isToolBlockedForClient(toolName: string, initializeRequestData?: InitializeRequest): boolean {
-    const blockedClients = TOOL_CLIENT_BLOCKLIST[toolName];
-    if (!blockedClients) return false;
+export function isReportProblemBlockedForClient(initializeRequestData?: InitializeRequest): boolean {
     const clientName = initializeRequestData?.params?.clientInfo?.name?.toLowerCase() ?? '';
-    return blockedClients.some((blocked) => clientName.includes(blocked));
-}
-
-/**
- * True when `toolName` has any client-gating rule in {@link TOOL_CLIENT_BLOCKLIST}. Such a tool
- * cannot be judged until the connecting client is known, so composition withholds it until then;
- * tools with no rule are client-agnostic and compose immediately.
- */
-export function isClientGatedTool(toolName: string): boolean {
-    return TOOL_CLIENT_BLOCKLIST[toolName] !== undefined;
+    return REPORT_PROBLEM_BLOCKED_CLIENTS.some((blocked) => clientName.includes(blocked));
 }
 
 /**

tests/integration/suite.ts

@@ -28,7 +28,7 @@ import { assertStatusMessagePropagated, captureInflightActorRunId, waitForRunAbo
 const AUTO_INJECTED_TOOL_NAMES = AUTO_INJECTED_TOOLS.map((t) => t.name);
 
 // report-problem is served only when telemetry is enabled — its sole function is forwarding
-// submissions via telemetry (see isToolServable in mcp/server.ts). This suite runs with telemetry
+// submissions via telemetry (see isReportProblemServable in mcp/server.ts). This suite runs with telemetry
 // off (the helper default, so runs emit no Sentry/Segment data), so report-problem is absent from
 // the served default set here. Its served/hidden/acknowledge behavior is covered by the unit tests
 // (tests/unit/mcp.server.report_problem_gating.test.ts, tests/unit/tools.report_problem.test.ts).

tests/unit/mcp_clients.test.ts

@@ -1,8 +1,7 @@
 import type { InitializeRequest } from '@modelcontextprotocol/sdk/types.js';
 import { describe, expect, it } from 'vitest';
 
-import { HELPER_TOOLS } from '../../src/const.js';
-import { isToolBlockedForClient } from '../../src/utils/mcp_clients.js';
+import { isReportProblemBlockedForClient } from '../../src/utils/mcp_clients.js';
 
 function initRequest(clientName?: string): InitializeRequest | undefined {
     if (clientName === undefined) return undefined;
@@ -16,26 +15,22 @@ function initRequest(clientName?: string): InitializeRequest | undefined {
     } as InitializeRequest;
 }
 
-describe('isToolBlockedForClient', () => {
+describe('isReportProblemBlockedForClient', () => {
     it.each(['claude-ai', 'claude-code', 'Claude Desktop', 'Anthropic', 'anthropic-sdk'])(
         'blocks report-problem for the Anthropic client "%s"',
         (clientName) => {
-            expect(isToolBlockedForClient(HELPER_TOOLS.PROBLEM_REPORT, initRequest(clientName))).toBe(true);
+            expect(isReportProblemBlockedForClient(initRequest(clientName))).toBe(true);
         },
     );
 
     it.each(['cursor', 'test-client', 'vscode', ''])(
         'serves report-problem to the non-Anthropic client "%s"',
         (clientName) => {
-            expect(isToolBlockedForClient(HELPER_TOOLS.PROBLEM_REPORT, initRequest(clientName))).toBe(false);
+            expect(isReportProblemBlockedForClient(initRequest(clientName))).toBe(false);
         },
     );
 
     it('does not block when there is no initialize request data', () => {
-        expect(isToolBlockedForClient(HELPER_TOOLS.PROBLEM_REPORT, undefined)).toBe(false);
-    });
-
-    it('does not block a tool that is absent from the blocklist, even for an Anthropic client', () => {
-        expect(isToolBlockedForClient(HELPER_TOOLS.ACTOR_CALL, initRequest('claude-ai'))).toBe(false);
+        expect(isReportProblemBlockedForClient(undefined)).toBe(false);
     });
 });