fix(mcp): remove dead agentic tool imports (B11)#16
Merged
Conversation
Three agentic tools were imported but never added to the served tools array, making them unreachable dead code: convene_llm_council and draft_care_action (src/tools/actions.ts) and generate_pas_payload (src/tools/da_vinci.ts). The adding commits stopped short of the array, shipped no tests, no CHANGELOG, and no README — staged-but-unfinished, not finished-and-forgotten. Removed rather than registered: convene_llm_council and draft_care_action forward to upstream-data endpoints that call frontier LLMs through OpenRouter (no HIPAA BAA), and the council endpoint runs no DLP scrub on its input, so exposing them on a public MCP client would re-open the PHI boundary the dataset tools were re-derived to close. git history retains the source if a properly bounded, tested version is wired in later.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Removes three agentic tools that were imported but never registered in the served tools array, leaving them as unreachable dead code:
Why remove rather than register
Git intent — staged-but-unfinished, not finished-and-forgotten. The adding commits (`1e59893`, `fe9cd7d`) added the import line and the tool files but deliberately stopped short of the `tools` array in `src/index.ts`. They shipped with zero tests, no CHANGELOG entry (the `[Unreleased]` block meticulously documents the neighbouring dataset re-derivation), and no README. The same author wrote thorough tests for every other registered tool. A finished MCP tool's whole point is the array line.
PHI boundary — the deciding factor. The backing endpoints are real on the upstream-data service, but two of them (`/api/v1/score/council`, `/api/v1/actions/draft`) call frontier LLMs through OpenRouter, which has no HIPAA BAA. The council endpoint runs no DLP scrub on its input before forwarding (only `draft` does). This MCP is a public npm client — nothing forces synthetic input — so registering `convene_llm_council` as-is would route arbitrary developer input straight to a no-BAA provider, re-opening the exact PHI boundary the dataset tools were re-derived to close.
Removed, not registered. Git history retains the source if a properly bounded, tested, documented version is wired in later (only `generate_pas_payload` is self-contained / no OpenRouter tail).
Scope
Pure removal: dead import line + two orphan files (+CHANGELOG `Removed` note). No registered tools touched, nothing renamed.
Verification
🤖 Generated with Claude Code