modified according to code rabbit suggestions

Author: sondermanish

app/client/packages/mcp/src/gates.test.ts

@@ -3,6 +3,7 @@ import {
   apiBaseUrlFromEnv,
   elicitationTimeoutFromEnv,
   gateEnabled,
+  gateEnabledUnlessFalse,
   parsePositiveInt,
   publicOriginFromEnv,
   sessionLimitsFromEnv,
@@ -66,6 +67,26 @@ describe("gateEnabled — opt-in gate parsing (data/JS layers)", () => {
   });
 });
 
+describe("gateEnabledUnlessFalse — default-on until false", () => {
+  it.each(["false", "FALSE", "False", " false "])(
+    "disables for %j",
+    (value) => {
+      expect(gateEnabledUnlessFalse(value)).toBe(false);
+    },
+  );
+
+  it.each(["0", "off", "no", "disabled", "true", "1", "", "  "])(
+    "stays on for %j",
+    (value) => {
+      expect(gateEnabledUnlessFalse(value)).toBe(true);
+    },
+  );
+
+  it("stays on when the variable is unset", () => {
+    expect(gateEnabledUnlessFalse(undefined)).toBe(true);
+  });
+});
+
 describe("parsePositiveInt — session cap/TTL env overrides", () => {
   it.each([
     ["25", 25],

app/client/packages/mcp/src/gates.ts

@@ -8,6 +8,12 @@ export function gateEnabled(value: string | undefined): boolean {
   return value !== undefined && /^(1|true|yes|on)$/i.test(value.trim());
 }
 
+// Default-ON counterpart for capabilities whose server-side opt-in flags were removed. Enabled unless the env
+// value is "false" (trim + case-insensitive); "0", "off", blank, and unset all stay enabled.
+export function gateEnabledUnlessFalse(value: string | undefined): boolean {
+  return value === undefined || value.trim().toLowerCase() !== "false";
+}
+
 // Positive-integer env override (session caps, TTLs). Unset, non-numeric, fractional, zero, or negative values fall
 // back to the built-in default rather than failing startup or silently disabling a limit.
 export function parsePositiveInt(

app/client/packages/mcp/src/server.ts

@@ -9,6 +9,7 @@ import {
   apiBaseUrlFromEnv,
   elicitationTimeoutFromEnv,
   gateEnabled,
+  gateEnabledUnlessFalse,
   publicOriginFromEnv,
   sessionLimitsFromEnv,
 } from "./gates.js";
@@ -23,10 +24,12 @@ const apiBaseUrl = apiBaseUrlFromEnv(
   process.env.APPSMITH_API_BASE_URL ?? "http://127.0.0.1:8080",
 );
 
-// Temporarily keep these capabilities enabled while their server-side configuration flags are unavailable.
-// Governed/destructive tools still require Mongo+Redis and register only when that infrastructure is present.
-const dataEnabled = true;
-const jsEnabled = true;
+// Data and JS stay on unless an operator explicitly sets the env var to "false". Governed/destructive tools
+// still require Mongo+Redis and register only when that infrastructure is present.
+const dataEnabled = gateEnabledUnlessFalse(
+  process.env.APPSMITH_MCP_DATA_ENABLED,
+);
+const jsEnabled = gateEnabledUnlessFalse(process.env.APPSMITH_MCP_JS_ENABLED);
 
 // Optional Host-header allowlist (comma-separated hostnames) enforced on /mcp. Unset by default: this service is
 // fronted by Caddy which preserves the original Host, so a default loopback list would reject the proxied public