McpAgentTools.h header

QString ew::app::ai::agent::mcpAgentSystemPrompt(bool allowWrites)

What the assistant is told about the project and its tools, for a session that may write when allowWrites is true and may only read otherwise.

It states the addressing idiom and the undo model, like the MCP server's own instructions, and in read-only mode says plainly that the write tools are absent – so a model asked to make a change explains that the switch is off instead of hunting for a tool that will never appear.

std::vector< AiToolSpec > ew::app::ai::agent::mcpAgentTools(const mcp::McpServer &server, bool allowWrites)

The tools server advertises, as provider-agnostic AiToolSpecs to attach to an AiRequest. With allowWrites false, only readOnlyMcpToolNames are included.

This is what gives the in-app assistant the same reach as the MCP server rather than a hand-picked subset of it. Bridging the catalogue instead of re-declaring it is the point: the assistant used to have three read tools and could not see a document at all, so asked to summarize the manuscript it searched the codex for something called "documents" and then invented a category. Any tool added to the server from now on reaches the assistant with it, and the two cannot drift.

Each MCP input schema becomes the AiToolSpec's parameters verbatim – both are JSON Schema, so nothing is translated and nothing can be lost in translating it.

const QSet< QString > & ew::app::ai::agent::readOnlyMcpToolNames()

The MCP tools the assistant may use when it has NOT been given permission to change the project: pure reads, and generators that compute an answer without touching anything.

Named explicitly rather than derived, because nothing about a registration reliably says whether its tool writes. The obvious test – does the handler reach runMcpMutation – is wrong: several tools, find_replace among them, delegate to a helper that calls it, so the handler body looks read-only while the tool rewrites prose across the whole manuscript. Guessing that wrong would let the assistant edit a project whose owner had switched that off, which is the one thing the switch exists to prevent.

A tool NOT in this set requires act mode. That is the safe direction, and it is deliberate: a tool added later that nobody classifies is unavailable in read-only chat rather than silently able to write. It also covers tools that change nothing in the project but still write to disk – the exports, backup_project, save_content_pack – and undo_last, which changes the project by taking a change away.