Address direct tool scope review feedback

Author: muxammadreza

internal/server/mcp_direct_scope.go

@@ -11,12 +11,14 @@ import (
 )
 
 func requiredPermissionForDirectTool(annotations *config.ToolAnnotations) string {
-	requiredVariant := contracts.DeriveCallWith(annotations)
-	requiredPerm := contracts.ToolVariantToOperationType[requiredVariant]
-	if requiredPerm == "" {
-		return contracts.OperationTypeRead
+	switch contracts.DeriveCallWith(annotations) {
+	case contracts.ToolVariantWrite:
+		return auth.PermWrite
+	case contracts.ToolVariantDestructive:
+		return auth.PermDestructive
+	default:
+		return auth.PermRead
 	}
-	return requiredPerm
 }
 
 func (p *MCPProxyServer) setDirectToolPermissions(perms map[string]string) {
@@ -28,7 +30,11 @@ func (p *MCPProxyServer) setDirectToolPermissions(perms map[string]string) {
 		return
 	}
 
-	p.directToolPerms = perms
+	copied := make(map[string]string, len(perms))
+	for name, perm := range perms {
+		copied[name] = perm
+	}
+	p.directToolPerms = copied
 }
 
 func (p *MCPProxyServer) lookupDirectToolPermission(directName string) (string, bool) {
@@ -56,7 +62,7 @@ func (p *MCPProxyServer) filterDirectModeToolsForAuth(ctx context.Context, tools
 		return tools
 	}
 
-	filtered := tools[:0]
+	filtered := make([]mcp.Tool, 0, len(tools))
 	for _, tool := range tools {
 		serverName, _, ok := ParseDirectToolName(tool.Name)
 		if !ok {

internal/server/mcp_routing_test.go

@@ -366,6 +366,101 @@ func TestDirectModeHandler_DestructiveToolNeedsDestructivePermission(t *testing.
 	assert.Contains(t, result.Content[0].(mcp.TextContent).Text, "destructive")
 }
 
+func TestRequiredPermissionForDirectTool_MapsAnnotationsToAuthPermissions(t *testing.T) {
+	readOnly := true
+	write := false
+	destructive := true
+
+	tests := []struct {
+		name        string
+		annotations *config.ToolAnnotations
+		want        string
+	}{
+		{
+			name: "nil annotations default to read",
+			want: auth.PermRead,
+		},
+		{
+			name: "read only hint maps to read",
+			annotations: &config.ToolAnnotations{
+				ReadOnlyHint: &readOnly,
+			},
+			want: auth.PermRead,
+		},
+		{
+			name: "read only false maps to write",
+			annotations: &config.ToolAnnotations{
+				ReadOnlyHint: &write,
+			},
+			want: auth.PermWrite,
+		},
+		{
+			name: "destructive hint maps to destructive",
+			annotations: &config.ToolAnnotations{
+				DestructiveHint: &destructive,
+			},
+			want: auth.PermDestructive,
+		},
+		{
+			name: "destructive hint takes precedence over read only hint",
+			annotations: &config.ToolAnnotations{
+				ReadOnlyHint:    &readOnly,
+				DestructiveHint: &destructive,
+			},
+			want: auth.PermDestructive,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, requiredPermissionForDirectTool(tt.annotations))
+		})
+	}
+}
+
+func TestSetDirectToolPermissions_DefensivelyCopiesMap(t *testing.T) {
+	proxy := &MCPProxyServer{}
+	toolName := FormatDirectToolName("github", "get_issue")
+	perms := map[string]string{
+		toolName: auth.PermRead,
+	}
+
+	proxy.setDirectToolPermissions(perms)
+	perms[toolName] = auth.PermDestructive
+
+	got, ok := proxy.lookupDirectToolPermission(toolName)
+	require.True(t, ok)
+	assert.Equal(t, auth.PermRead, got)
+}
+
+func TestFilterDirectModeToolsForAuth_DoesNotMutateInputSlice(t *testing.T) {
+	proxy := &MCPProxyServer{}
+	allowed := FormatDirectToolName("github", "get_issue")
+	denied := FormatDirectToolName("gitlab", "get_issue")
+	tools := []mcp.Tool{
+		{Name: allowed},
+		{Name: denied},
+	}
+	original := append([]mcp.Tool(nil), tools...)
+
+	proxy.setDirectToolPermissions(map[string]string{
+		allowed: auth.PermRead,
+		denied:  auth.PermRead,
+	})
+
+	ctx := auth.WithAuthContext(context.Background(), &auth.AuthContext{
+		Type:           auth.AuthTypeAgent,
+		AgentName:      "test-agent",
+		AllowedServers: []string{"github"},
+		Permissions:    []string{auth.PermRead},
+	})
+
+	filtered := proxy.filterDirectModeToolsForAuth(ctx, tools)
+
+	assert.Equal(t, []string{allowed}, directToolNamesForTest(filtered))
+	assert.Equal(t, original, tools)
+}
+
 func TestFilterDirectModeToolsForAuth_AgentServerAndPermissionScope(t *testing.T) {
 	proxy := &MCPProxyServer{}