[jdx]

https://entire.io/gh/jdx/mise/trails/530

The MCP server (mise mcp) had three problems:

• run_task trusted projects on the client's behalf. It ran mise run with MISE_YES=1 and implicit trust, so an AI client could run tasks, and render templates, from a project you had never trusted. Trusting it as a side effect meant later commands trusted it too.
• install_tool was a stub that always returned "Tool installation not yet implemented".
• The mise://tasks resource reported an empty env for every task.

What changes

Trust. run_task and install_tool now refuse to act in a project whose config is not trusted, and tell the client which command to show you:

Refusing to act on untrusted config. The MCP server does not trust config on a client's behalf. Ask the user to review it and run:
  mise trust /path/to/project

The mise processes the server starts never trust anything themselves. This covers config the early check does not look at, such as a templated task include in a subdirectory or a nested mise call from a task: it fails with the usual "not trusted" error rather than being trusted silently. Refusing does not trust anything. Run mise trust yourself and the request goes through.

install_tool now installs the way mise install does:

{"tool": "node", "version": "22"}

returns

{"tool": "node@22", "version": "22.11.0", "install_path": "/home/me/.local/share/mise/installs/node/22.11.0", "output": "..."}

With no version, it installs the version configured for that tool, or latest if the tool is not configured. A failed install comes back as an error result that includes mise's output. Installs have no time limit; run_task still respects task_timeout.

mise://tasks reports each task's env directives, using the same format as mise tasks ls --json. This changes the env field's type from an object to an array of strings:

"env": ["MCP_TASK_ENV=task_value", "_.file = \".env\""]

Clients that read env as an object need to update.

AI-assisted — Tool: Claude Code; model: anthropic/claude-opus-5-5; version: claude-code_2-1-289_agent.

🤖 Generated with Claude Code

---

Note

High Risk
Changes MCP execution and install paths to enforce explicit config trust and enable real tool installs via assistants—security-critical behavior with a breaking JSON shape change for task env.

Overview
MCP security and capabilities: run_task and install_tool now block until the project config is explicitly trusted (mise trust), with messages listing the trust commands. Child mise processes spawned for installs and task runs set __MISE_REQUIRE_EXPLICIT_TRUST, so implicit trust and yes cannot approve config on an AI client’s behalf—including nested or subdirectory config.

install_tool is fully implemented: it runs mise install in a subprocess and returns JSON (tool, resolved version, install_path, install output). Failures surface as tool errors.

mise://tasks: the env field changes from an empty object to a string array of undeclared env directives (aligned with mise tasks ls --json); MCP clients that assumed an object need updating.

Docs, man page, usage spec, protocol e2e tests, and a new test_mcp_trust e2e cover install success/failure, task env reporting, and trust refusal behavior.

^{Reviewed by Cursor Bugbot for commit 285d7ef. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• New Features
  • MCP install_tool requests can now install configured or latest tool versions and return installation details.
  • Task resources now report declared and overlay environment variable names.
• Security
  • MCP tool installations and task runs are blocked for untrusted project configuration until you explicitly run mise trust. Confirmation settings do not bypass this requirement.
• Documentation
  • Updated MCP help and guides to describe tool installation and trust requirements.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 29 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: 31408718-c07d-4c98-84c4-0806f4a8b037

📥 Commits

Reviewing files that changed from the base of the PR and between 73dcec8 and 285d7ef.

📒 Files selected for processing (2)

• docs/mcp.md
• src/cli/mcp.rs

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: aec8d06a-13e5-48ff-a259-b7d1d09d42b1

📥 Commits

Reviewing files that changed from the base of the PR and between 4a98b02 and 73dcec8.

📒 Files selected for processing (7)

• docs/cli/mcp.md
• e2e/cli/test_mcp_protocol
• e2e/cli/test_mcp_trust
• man/man1/mise.1
• mise.usage.kdl
• src/cli/mcp.rs
• src/config/config_file/mod.rs

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 2 remain after this review.

---

📝 Walkthrough

Walkthrough

The MCP server now installs requested tool versions and applies explicit config trust checks to project operations. Task resources now report declared and overlay environment entries. Documentation and end-to-end tests describe and verify these changes.

Changes

MCP behavior

Layer / File(s)	Summary
Explicit config trust policy src/config/config_file/mod.rs	The trust checks disable implicit config trust when explicit trust is required. An untrusted config returns UntrustedConfig before the prompt or automatic-yes flow.
MCP task execution and trust checks src/cli/mcp.rs, e2e/cli/test_mcp_trust, e2e/cli/test_mcp_protocol	Task execution uses child processes that require explicit config trust. Task resources report declared and overlay environment entries. End-to-end tests check trust enforcement, task execution, and resource environment data.
Tool installation through MCP src/cli/mcp.rs, e2e/cli/test_mcp_protocol, docs/cli/mcp.md, man/man1/mise.1, mise.usage.kdl	install_tool validates tool specifications, runs installation, locates the result, and returns installation details or errors. Tests and help text cover installation, version defaults, trust restrictions, and unknown tools.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant MCP client
  participant MCP server
  participant mise install
  participant mise where
  MCP client->>MCP server: Call install_tool
  MCP server->>mise install: Install tool version
  mise install-->>MCP server: Installation output and status
  MCP server->>mise where: Resolve installation path
  mise where-->>MCP server: Installation path
  MCP server-->>MCP client: Return tool version, path, and output

Loading

Suggested reviewers: risu729

Merge Risk: ⚪ Minimal · up to 73dce

No actionable merge-blocking risk remains. An OS-excluded tool request can produce a misleading installation error, but it does not prevent a supported installation.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 61.11% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 18 functions across 2 files. (5 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: implementing install_tool and requiring project trust for run_task.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 61.11% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 18 functions across 2 files. (5 skipped: 5 unsupported.)

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 73dcec8. Configure here.}

[greptile-apps]

Confidence Score: 5/5

[Critical risk] Implements tool installation and trust checks for MCP server.

The changes appear safe to merge; no blocking issue remains from this review.

What we checked:

• Waiting does not hold a lock: RunningPidGuard stores only a process ID. Registration releases its lock before the child is awaited.

Summary

Implements install_tool, requires trusted project config for MCP actions, and exposes task env directives.

• The latest changes register install processes for shutdown cleanup and update the MCP guide.
• Both previous, unnumbered findings are addressed: run_mise retains a RunningPidGuard, and the guide documents installation, trust requirements, and the env array.
• No new actionable issues or mounted-rule violations were found.

_{Reviews (2) · Last reviewed commit: "fix(mcp): stop install_tool children wit..." · Reviewed by Greptile}

[github-actions]

Instruction counts

benchmark	trend	instructions	Δ	wall (min)	Δ
env	▃█▁▅	27,605,813 → 27,616,265	+0.04%	20.23 → 19.76ms	-2.33%
hook-env	▁█▄█	29,602,412 → 29,616,979	+0.05%	20.70 → 20.60ms	-0.48%
ls	▅█▁▄	31,376,197 → 31,381,343	+0.02%	21.37 → 21.46ms	+0.42%
registry	█▇▄▁	39,967,458 → 39,896,985	-0.18%	17.58 → 17.88ms	+1.70%
startup	▄█▃▁	10,947,181 → 10,944,780	-0.02%	12.30 → 12.42ms	+0.96%

No instruction-count regression above 1%.

_{Only instruction counts gate. Wall clock is shown for context — on identical hardware it moves 4-20% run to run.}

_{Measured by tak — instruction-counted CLI benchmarks, stored in this repository's git notes.}

_{285d7ef69480 vs 4a921544978c · measured on the runner, not pushed to the history.}