CalmHub MCP Default Off (finos#2533)

* fix(calm-hub): default calm.mcp.enabled to false (experimental feature)

* fix(calm-hub): default calm.mcp.enabled to false in TimelineTools (experimental feature)

* fix(calm-hub): enable calm.mcp.enabled in MCP integration test profiles

* docs(calm-hub): clarify calm.mcp.enabled gates tool invocations not HTTP endpoint

Author: jpgough-ms

calm-hub/README.md

@@ -214,18 +214,18 @@ at [http://localhost:8080/q/dev-ui](http://localhost:8080/q/dev-ui).
 
 #### Enabling / disabling
 
-The whole MCP surface is gated by a single config property (default `true`):
+MCP is an **experimental feature** and is disabled by default. `calm.mcp.enabled` gates **tool invocations** — when `false`, every `@Tool` method returns a disabled error to the MCP client. The `/mcp` HTTP endpoint itself remains reachable regardless of this flag; network-level controls or authentication are needed to restrict endpoint access.
 
 ```properties
-calm.mcp.enabled=true
+calm.mcp.enabled=false
 ```
 
-Disable it from the command line or environment:
+Enable it from the command line or environment:
 
 ```shell
-../mvnw quarkus:dev -Dcalm.mcp.enabled=false
+../mvnw quarkus:dev -Dcalm.mcp.enabled=true
 # or
-export CALM_MCP_ENABLED=false
+export CALM_MCP_ENABLED=true
 ```
 
 #### Exposing your local MCP via ngrok
@@ -249,7 +249,7 @@ local CalmHub:
 
 The ngrok URL changes each session unless you use a reserved domain.
 
-> **⚠ Security note** — under the default profile the MCP endpoint runs
+> **⚠ Security note** — when enabled, under the default profile the MCP endpoint runs
 > **without authentication**, the same as the default-profile REST API. The
 > `secure` profile enforces JWT authentication on `/mcp/*` (see
 > `application-secure.properties`), but does **not** yet apply per-tool
@@ -258,8 +258,8 @@ The ngrok URL changes each session unless you use a reserved domain.
 > follow-up. Exposing CalmHub through ngrok publishes the endpoint to the
 > public internet, so when demoing protect the tunnel with ngrok-side controls
 > (for example `ngrok http 8080 --basic-auth 'user:password'`, an OAuth edge,
-> or an IP allowlist), tear the tunnel down when you're done, or set
-> `calm.mcp.enabled=false` while the server is reachable.
+> or an IP allowlist), tear the tunnel down when you're done, or keep
+> `calm.mcp.enabled=false` (the default) while the server is reachable.
 
 ### Building for Deployment
 

calm-hub/src/integration-test/java/integration/IntegrationTestProfile.java

@@ -25,7 +25,10 @@ public String getConfigProfile() {
     public Map<String, String> getConfigOverrides() {
         // Enable the PUT/upsert paths so the MCP updateArchitecture tool and the
         // equivalent REST PUT endpoint can be exercised by the integration suite.
-        return Map.of("allow.put.operations", "true");
+        return Map.of(
+                "allow.put.operations", "true",
+                "calm.mcp.enabled", "true"
+        );
     }
 }
 

calm-hub/src/integration-test/java/integration/NitriteIntegrationTestProfile.java

@@ -25,6 +25,9 @@ public List<TestResourceEntry> testResources() {
 
     @Override
     public Map<String, String> getConfigOverrides() {
-        return Map.of("allow.put.operations", "true");
+        return Map.of(
+                "allow.put.operations", "true",
+                "calm.mcp.enabled", "true"
+        );
     }
 }

calm-hub/src/main/java/org/finos/calm/mcp/tools/AdrTools.java

@@ -38,7 +38,7 @@ public class AdrTools {
     private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper().registerModule(new JavaTimeModule());
 
     @Inject
-    @ConfigProperty(name = "calm.mcp.enabled", defaultValue = "true")
+    @ConfigProperty(name = "calm.mcp.enabled", defaultValue = "false")
     boolean mcpEnabled;
 
     @Inject

calm-hub/src/main/java/org/finos/calm/mcp/tools/ArchitectureTools.java

@@ -30,7 +30,7 @@ public class ArchitectureTools {
     private static final Logger logger = LoggerFactory.getLogger(ArchitectureTools.class);
 
     @Inject
-    @ConfigProperty(name = "calm.mcp.enabled", defaultValue = "true")
+    @ConfigProperty(name = "calm.mcp.enabled", defaultValue = "false")
     boolean mcpEnabled;
 
     @Inject

calm-hub/src/main/java/org/finos/calm/mcp/tools/ControlTools.java

@@ -30,7 +30,7 @@ public class ControlTools {
     private static final Logger logger = LoggerFactory.getLogger(ControlTools.class);
 
     @Inject
-    @ConfigProperty(name = "calm.mcp.enabled", defaultValue = "true")
+    @ConfigProperty(name = "calm.mcp.enabled", defaultValue = "false")
     boolean mcpEnabled;
 
     @Inject

calm-hub/src/main/java/org/finos/calm/mcp/tools/DecoratorTools.java

@@ -27,7 +27,7 @@ public class DecoratorTools {
     private static final Logger logger = LoggerFactory.getLogger(DecoratorTools.class);
 
     @Inject
-    @ConfigProperty(name = "calm.mcp.enabled", defaultValue = "true")
+    @ConfigProperty(name = "calm.mcp.enabled", defaultValue = "false")
     boolean mcpEnabled;
 
     @Inject

calm-hub/src/main/java/org/finos/calm/mcp/tools/DomainTools.java

@@ -25,7 +25,7 @@ public class DomainTools {
     private static final Logger logger = LoggerFactory.getLogger(DomainTools.class);
 
     @Inject
-    @ConfigProperty(name = "calm.mcp.enabled", defaultValue = "true")
+    @ConfigProperty(name = "calm.mcp.enabled", defaultValue = "false")
     boolean mcpEnabled;
 
     @Inject

calm-hub/src/main/java/org/finos/calm/mcp/tools/InterfaceTools.java

@@ -31,7 +31,7 @@ public class InterfaceTools {
     private static final Logger logger = LoggerFactory.getLogger(InterfaceTools.class);
 
     @Inject
-    @ConfigProperty(name = "calm.mcp.enabled", defaultValue = "true")
+    @ConfigProperty(name = "calm.mcp.enabled", defaultValue = "false")
     boolean mcpEnabled;
 
     @Inject

calm-hub/src/main/java/org/finos/calm/mcp/tools/NamespaceTools.java

@@ -25,7 +25,7 @@ public class NamespaceTools {
     private static final Logger logger = LoggerFactory.getLogger(NamespaceTools.class);
 
     @Inject
-    @ConfigProperty(name = "calm.mcp.enabled", defaultValue = "true")
+    @ConfigProperty(name = "calm.mcp.enabled", defaultValue = "false")
     boolean mcpEnabled;
 
     @Inject