Merge branch 'main' into bkellam/agent-improvements

Author: brendan-kellam

CHANGELOG.md

@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [4.15.9] - 2026-03-17
+
+### Added
+- Added read-only annotations to MCP tools for compatibility with Cursor Ask mode and other MCP clients that restrict tool usage based on behavior hints. [#1013](https://github.com/sourcebot-dev/sourcebot/pull/1013)
+
 ## [4.15.8] - 2026-03-17
 
 ### Added

docs/api-reference/sourcebot-public.openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.0.3",
   "info": {
     "title": "Sourcebot Public API",
-    "version": "v4.15.8",
+    "version": "v4.15.9",
     "description": "OpenAPI description for the public Sourcebot REST endpoints used for search, repository listing, and file browsing."
   },
   "tags": [

packages/mcp/src/index.ts

@@ -69,6 +69,7 @@ server.tool(
             .transform((val) => (val < env.DEFAULT_MINIMUM_TOKENS ? env.DEFAULT_MINIMUM_TOKENS : val))
             .optional(),
     },
+    { readOnlyHint: true },
     async ({
         query,
         filterByRepos: repos = [],
@@ -186,6 +187,7 @@ server.tool(
     "list_commits",
     dedent`Get a list of commits for a given repository.`,
     listCommitsQueryParamsSchema.shape,
+    { readOnlyHint: true },
     async (request: ListCommitsQueryParamsSchema) => {
         const result = await listCommits(request);
 
@@ -201,6 +203,7 @@ server.tool(
     "list_repos",
     dedent`Lists repositories in the organization with optional filtering and pagination.`,
     listReposQueryParamsSchema.shape,
+    { readOnlyHint: true },
     async (request: ListReposQueryParams) => {
         const result = await listRepos(request);
 
@@ -226,6 +229,7 @@ server.tool(
     "read_file",
     dedent`Reads the source code for a given file.`,
     fileSourceRequestSchema.shape,
+    { readOnlyHint: true },
     async (request: FileSourceRequest) => {
         const response = await getFileSource(request);
 
@@ -249,6 +253,7 @@ server.tool(
     Returns a flat list of entries with path metadata and depth relative to the requested path.
     `,
     listTreeRequestSchema.shape,
+    { readOnlyHint: true },
     async ({
         repo,
         path = '',
@@ -395,6 +400,7 @@ server.tool(
     "list_language_models",
     dedent`Lists the available language models configured on the Sourcebot instance. Use this to discover which models can be specified when calling ask_codebase.`,
     {},
+    { readOnlyHint: true },
     async () => {
         const models = await listLanguageModels();
 
@@ -424,6 +430,7 @@ server.tool(
     This is a blocking operation that may take 30-60+ seconds for complex questions as the agent researches the codebase.
     `,
     askCodebaseRequestSchema.shape,
+    { readOnlyHint: true },
     async (request: AskCodebaseRequest) => {
         const response = await askCodebase(request);
 

packages/shared/src/version.ts

@@ -1,2 +1,2 @@
 // This file is auto-generated by .github/workflows/release-sourcebot.yml
-export const SOURCEBOT_VERSION = "v4.15.8";
+export const SOURCEBOT_VERSION = "v4.15.9";

packages/web/src/features/mcp/server.ts

@@ -29,6 +29,10 @@ export function createMcpServer(): McpServer {
         "list_language_models",
         {
             description: dedent`Lists the available language models configured on the Sourcebot instance. Use this to discover which models can be specified when calling ask_codebase.`,
+            annotations: {
+                readOnlyHint: true,
+                idempotentHint: true,
+            }
         },
         async () => {
             const models = await getConfiguredLanguageModelsInfo();
@@ -61,6 +65,9 @@ export function createMcpServer(): McpServer {
                 languageModel: languageModelInfoSchema.optional().describe("The language model to use. If not provided, defaults to the first model in the config."),
                 visibility: z.enum(['PRIVATE', 'PUBLIC']).optional().describe("The visibility of the chat session. Defaults to PRIVATE for authenticated users."),
             }),
+            annotations: {
+                readOnlyHint: true,
+            }
         },
         async (request) => {
             const result = await askCodebase({