fix: scope catalog reads to request context

Conceived by Romuald Członkowski - www.aiadvisors.pl/en

Author: justadityaraj

src/mcp/handlers-official-tools.ts

@@ -170,10 +170,13 @@ export async function handleListCatalog(args: unknown, context?: InstanceContext
     return { success: false, code: 'INVALID_ARGS', error: parsed.error.issues.map(i => `${i.path.join('.') || 'input'}: ${i.message}`).join('; ') };
   }
   const { kind, query, limit } = parsed.data;
-  const api = getN8nApiClient(context);
-  if (!api) return { success: false, code: 'NOT_CONFIGURED', error: 'n8n API not configured. Set N8N_API_URL and N8N_API_KEY.' };
 
   if (kind === 'tags') {
+    if (!publicApiMatchesContext(context)) {
+      return { success: false, kind, code: 'NOT_CONFIGURED', error: PUBLIC_API_CONTEXT_HINT } as McpToolResponse;
+    }
+    const api = getN8nApiClient(context);
+    if (!api) return { success: false, kind, code: 'NOT_CONFIGURED', error: 'n8n API not configured. Set N8N_API_URL and N8N_API_KEY.' } as McpToolResponse;
     try {
       const tags = (await api.listTags({ limit: 250 })).data.map(t => ({ id: String(t.id), name: t.name }));
       return { success: true, kind, backend: 'public-api', data: { items: filterItems(tags, query, limit) } } as McpToolResponse;

tests/unit/mcp/handlers-official-tools.test.ts

@@ -5,6 +5,7 @@ vi.mock('@/mcp/official-mcp-access', async (orig) => ({ ...(await orig<any>()),
 const api = vi.hoisted(() => ({ getN8nApiClient: vi.fn() }));
 vi.mock('@/mcp/handlers-n8n-manager', () => ({ getN8nApiClient: api.getN8nApiClient }));
 import { handleExploreNodeResources, handleListCatalog, callOfficialTool, resolveProjectChoices } from '@/mcp/handlers-official-tools';
+import { PUBLIC_API_CONTEXT_HINT } from '@/services/mcp-exposure';
 import { N8nApiError } from '@/utils/n8n-errors';
 import { N8nOfficialMcpClient } from '@/services/n8n-official-mcp-client';
 import { startFakeOfficialMcp, FakeOfficialMcp, FakeTool } from '../../helpers/fake-official-mcp-server';
@@ -174,6 +175,28 @@ describe('handleListCatalog', () => {
     const r = await handleListCatalog({ kind: 'tags', query: 'prod', limit: 1 });
     expect(r).toMatchObject({ success: true, kind: 'tags', backend: 'public-api', data: { items: [{ id: 't1', name: 'Prod' }] } });
   });
+  it('does not fall back to the environment API for tags on a url + token context', async () => {
+    api.getN8nApiClient.mockReturnValue({ listTags: vi.fn() });
+
+    const r = await handleListCatalog(
+      { kind: 'tags' },
+      { n8nApiUrl: 'https://other.test.com', n8nMcpAccessToken: 'tok' }
+    );
+
+    expect(api.getN8nApiClient).not.toHaveBeenCalled();
+    expect(r).toMatchObject({ success: false, code: 'NOT_CONFIGURED', error: PUBLIC_API_CONTEXT_HINT });
+  });
+  it('uses the context-specific hint when projects have no matching client', async () => {
+    api.getN8nApiClient.mockReturnValue(null);
+    access.getOfficialMcpClient.mockReturnValue(null);
+
+    const r = await handleListCatalog(
+      { kind: 'projects' },
+      { n8nApiUrl: 'https://other.test.com', n8nMcpAccessToken: 'tok' }
+    );
+
+    expect(r).toMatchObject({ success: false, code: 'NOT_CONFIGURED', error: PUBLIC_API_CONTEXT_HINT });
+  });
   it('rejects unknown kinds', async () => {
     expect(await handleListCatalog({ kind: 'users' })).toMatchObject({ success: false, code: 'INVALID_ARGS' });
   });