From 5809b8354a3b02be438c7e909f8b4204495e3a5d Mon Sep 17 00:00:00 2001
From: Adwait Kumar Singh <adwsingh@amazon.com>
Date: Wed, 11 Jun 2025 17:06:00 -0700
Subject: [PATCH] If allowedApis is provided respect that always

---
 .../mcp/cli/commands/AddAwsServiceBundle.java | 22 ++++++++++++-------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/aws/aws-mcp-cli-commands/src/main/java/software/amazon/smithy/java/aws/mcp/cli/commands/AddAwsServiceBundle.java b/aws/aws-mcp-cli-commands/src/main/java/software/amazon/smithy/java/aws/mcp/cli/commands/AddAwsServiceBundle.java
index fe9946625c..ee3fee1178 100644
--- a/aws/aws-mcp-cli-commands/src/main/java/software/amazon/smithy/java/aws/mcp/cli/commands/AddAwsServiceBundle.java
+++ b/aws/aws-mcp-cli-commands/src/main/java/software/amazon/smithy/java/aws/mcp/cli/commands/AddAwsServiceBundle.java
@@ -35,22 +35,28 @@ public class AddAwsServiceBundle extends AbstractAddBundle {
     protected Set<String> blockedApis;
 
     @Option(names = "--read-only-apis",
-            description = "Include read only APIs in the MCP server",
-            defaultValue = "true")
-    protected boolean readOnlyApis;
+            description = "Include read only APIs in the MCP server")
+    protected Boolean readOnlyApis;
 
     @Override
     protected CliBundle getNewToolConfig() {
         var bundleBuilder = AwsServiceBundler.builder()
                 .serviceName(awsServiceName);
-        if (readOnlyApis) {
-            // Include read-only apis unless disabled
-            bundleBuilder.readOnlyOperations();
-        }
         if (allowedApis != null) {
-            // User explicitly specified allowed APIs - use only those
+            // User explicitly specified allowed APIs
             bundleBuilder.exposedOperations(allowedApis);
+            // If readOnlyApis is also requested, include those as well
+            if (Boolean.TRUE.equals(readOnlyApis)) {
+                bundleBuilder.readOnlyOperations();
+            }
+        } else if (!Boolean.FALSE.equals(readOnlyApis)) {
+            //If nothing is specified then default to only readOnlyOperations.
+            bundleBuilder.readOnlyOperations();
+        } else {
+            throw new IllegalArgumentException("You have turned off readOnlyApis and also not specified any " +
+                    "allowedApis so there are no operations to create a bundle for.");
         }
+
         if (blockedApis != null) {
             // Always apply blocked operations if specified
             bundleBuilder.blockedOperations(blockedApis);