coilysiren/cli-mcp
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Flag-level filtering API: ExcludeFlags / persistent-flag drop #9

New issue
Closed
opened 2026-05-23 20:53:53 +00:00 by coilysiren · 0 comments
coilysiren commented 2026-05-23 20:53:53 +00:00
Owner
Copy link

Originally filed by @coilysiren on 2026-05-13T14:19:48Z - https://github.com/coilysiren/cli-mcp/issues/33

Comparison with njayp/ophis surfaced a gap in cli-mcp's projection filtering surface.

ophis exposes:

  • ExcludeFlags() - hide named flags (typical use: tokens, secrets, internal toggles)
  • NoFlags - drop persistent inherited flags entirely
  • AllowCmdsContaining() - opt-in filter

cli-mcp today has Options.SkipPaths, Options.IncludeGroups, and auto-skips hidden commands, but nothing at the flag level. Sensitive-flag stripping is implicitly delegated to cli-guard's argv validation.

When cli-mcp is consumed without cli-guard, this is a real gap. A leaf command with a --token flag will surface it in the MCP schema, which agents will then try to fill.

Proposal: extend Options with ExcludeFlags []string (matched by name or alias) and DropPersistentFlags bool. Keep the cli-guard pathway as the recommended default for full safety, but give standalone users the local knob.

Note urfave/cli v3's persistent-flag model is shallower than cobra's, so DropPersistentFlags may have a smaller practical footprint than ophis's NoFlags. Worth measuring on a real tree before committing to the name.

_Originally filed by @coilysiren on 2026-05-13T14:19:48Z - [https://github.com/coilysiren/cli-mcp/issues/33](https://github.com/coilysiren/cli-mcp/issues/33)_ Comparison with [njayp/ophis](https://github.com/njayp/ophis) surfaced a gap in cli-mcp's projection filtering surface. ophis exposes: - `ExcludeFlags()` - hide named flags (typical use: tokens, secrets, internal toggles) - `NoFlags` - drop persistent inherited flags entirely - `AllowCmdsContaining()` - opt-in filter cli-mcp today has `Options.SkipPaths`, `Options.IncludeGroups`, and auto-skips hidden commands, but nothing at the flag level. Sensitive-flag stripping is implicitly delegated to cli-guard's argv validation. When cli-mcp is consumed *without* cli-guard, this is a real gap. A leaf command with a `--token` flag will surface it in the MCP schema, which agents will then try to fill. Proposal: extend `Options` with `ExcludeFlags []string` (matched by name or alias) and `DropPersistentFlags bool`. Keep the cli-guard pathway as the recommended default for full safety, but give standalone users the local knob. Note urfave/cli v3's persistent-flag model is shallower than cobra's, so `DropPersistentFlags` may have a smaller practical footprint than ophis's `NoFlags`. Worth measuring on a real tree before committing to the name.
coilysiren added
P3
 and removed
P2
 labels 2026-06-17 08:40:38 +00:00
Commenting is not possible because the repository is archived.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels   
burndown-2026-06
Backlog burndown June 2026

  
icebox
Closed in the 2026-05-29 backlog burn-down; reopen if it becomes real

  
P0
now / blocking / urgent

  
P1
next / important

  
P2
backlog / will do

  
P3
someday / low

  
P4
P4

No labels
burndown-2026-06
icebox
P0
P1
P2
P3
P4
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
coilysiren/cli-mcp#9
No description provided.