Draft: remove tools if permissions are missing

[GG-HH]

If permissions are not granted, do not display tools

[timothedelion]

@GG-HH From my experience, the problem was not registering unusable tools, but just being blocked in the browser authentication flow (not able to click Continue) because we trigger it with permissions I can't obtain.

Does this fix solve this problem ?

[GG-HH]

No it doesn't, this is mostly a UX improvement but I don't know if we want to do this as it removes visibility over these tools.
I am also working on the server side to unblock the creation of a token if permissions are missing.

[cursor]

This PR is being reviewed by Cursor Bugbot

Details

Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

[cursor]

Bug: Scope Delegation Causes Authentication Failures

The get_developer_scopes() function now delegates to get_secops_scopes(), causing it to request honeytoken scopes for SaaS instances. This can lead to OAuth authentication failures if developers lack permission to grant these scopes, preventing them from using the application. This behavior goes against the intent to hide unavailable tools after successful authentication.

 

[cursor]

Bug: Static Scopes Misalignment Across Client Instances

The default DEVELOPER_SCOPES are determined at module import time, not dynamically per client instance. This can lead to incorrect scopes being applied if a client's api_url (e.g., for self-hosted instances) differs from the environment's configuration. The module-level import of DEVELOPER_SCOPES is also unused.

 

[timothedelion]

Works well :