Fix aws bundle allowlisting

Author: adwsingh

aws/aws-mcp-cli-commands/src/main/java/software/amazon/smithy/java/aws/mcp/cli/commands/AddAwsServiceBundle.java

@@ -5,7 +5,6 @@
 
 package software.amazon.smithy.java.aws.mcp.cli.commands;
 
-import java.util.Collections;
 import java.util.Set;
 import picocli.CommandLine.Command;
 import picocli.CommandLine.Option;
@@ -38,16 +37,23 @@ public class AddAwsServiceBundle extends AbstractAddBundle {
     @Option(names = "--include-write-apis",
             description = "Include write APIs in the MCP server",
             defaultValue = "false")
-    boolean includeWriteApis;
+    Boolean includeWriteApis;
 
     @Override
     protected CliBundle getNewToolConfig() {
         var bundleBuilder = AwsServiceBundler.builder()
-                .serviceName(awsServiceName)
-                .exposedOperations(allowedTools())
-                .blockedOperations(blockedTools());
-        if (!includeWriteApis) {
-            bundleBuilder = bundleBuilder.readOnlyOperations();
+                .serviceName(awsServiceName);
+        //If nothing is specified then default to only readOnlyOperations.
+        if (allowedApis != null) {
+            // User explicitly specified allowed APIs - use only those
+            bundleBuilder.exposedOperations(allowedApis);
+        } else if (includeWriteApis == null || !includeWriteApis) {
+            // Default case or explicit false - read-only operations
+            bundleBuilder.readOnlyOperations();
+        }
+        // Always apply blocked operations if specified
+        if (blockedApis != null) {
+            bundleBuilder.blockedOperations(blockedApis);
         }
         var bundle = bundleBuilder.build().bundle();
 
@@ -76,14 +82,4 @@ protected String getToolBundleName() {
     protected boolean canOverwrite() {
         return overwrite;
     }
-
-    @Override
-    protected Set<String> allowedTools() {
-        return allowedApis == null ? Collections.emptySet() : allowedApis;
-    }
-
-    @Override
-    protected Set<String> blockedTools() {
-        return blockedApis == null ? Collections.emptySet() : blockedApis;
-    }
 }

aws/aws-service-bundler/src/main/java/software/amazon/smithy/java/aws/servicebundle/bundler/AwsServiceBundler.java

@@ -70,10 +70,10 @@ public final class AwsServiceBundler extends ModelBundler {
     private AwsServiceBundler(Builder builder) {
         this.serviceName = builder.serviceName;
         this.resolver = builder.resolver;
-        this.exposedOperations = builder.exposedOperations;
-        this.blockedOperations = builder.blockedOperations;
-        this.allowedPrefixes = builder.allowedPrefixes;
-        this.blockedPrefixes = builder.blockedPrefixes;
+        this.exposedOperations = builder.exposedOperations == null ? Collections.emptySet() : builder.exposedOperations;
+        this.blockedOperations = builder.blockedOperations == null ? Collections.emptySet() : builder.blockedOperations;
+        this.allowedPrefixes = builder.allowedPrefixes == null ? Collections.emptySet() : builder.allowedPrefixes;
+        this.blockedPrefixes = builder.blockedPrefixes == null ? Collections.emptySet() : builder.blockedPrefixes;
     }
 
     public static Builder builder() {

mcp/mcp-cli-api/src/main/java/software/amazon/smithy/java/mcp/cli/AbstractAddBundle.java

@@ -5,7 +5,6 @@
 
 package software.amazon.smithy.java.mcp.cli;
 
-import java.util.Set;
 import software.amazon.smithy.java.mcp.cli.model.Location;
 
 /**
@@ -55,8 +54,4 @@ protected final Location getBundleFileLocation() {
      * @return true if existing tool bundle can be overwritten, false otherwise
      */
     protected abstract boolean canOverwrite();
-
-    protected abstract Set<String> allowedTools();
-
-    protected abstract Set<String> blockedTools();
 }