Feat: Add --readonly and register tools in two separate locations

internal/config/options.go

@@ -2,6 +2,7 @@ package config
 
 import (
 	"flag"
+	"slices"
 	"strings"
 )
 
@@ -10,6 +11,10 @@ type Options struct {
 	// AllowedContexts is a list of k8s contexts that users are allowed to access
 	// If empty, all contexts are allowed
 	AllowedContexts []string
+
+	// Readonly determine if tools that 'write' to the cluster are
+	// registered and advertised to clients.
+	Readonly bool
 }
 
 // GlobalOptions contains the parsed command line options
@@ -19,6 +24,7 @@ var GlobalOptions = &Options{}
 func ParseFlags() bool {
 	var allowedContextsStr string
 	flag.StringVar(&allowedContextsStr, "allowed-contexts", "", "Comma-separated list of allowed k8s contexts. If empty, all contexts are allowed")
+	flag.BoolVar(&GlobalOptions.Readonly, "readonly", false, "Disables any tool which can write changes to the cluster. If not specified, all tools are allowed")
 
 	// Add other flags here
 
@@ -52,11 +58,5 @@ func IsContextAllowed(contextName string) bool {
 		return true
 	}
 
-	for _, allowed := range GlobalOptions.AllowedContexts {
-		if allowed == contextName {
-			return true
-		}
-	}
-
-	return false
+	return slices.Contains(GlobalOptions.AllowedContexts, contextName)
 }

main.go

@@ -91,10 +91,12 @@ func printHelp() {
 	println("  version: Print the version, commit and date of the server")
 	println("  --allowed-contexts=<ctx1,ctx2,...>: Comma-separated list of allowed k8s contexts")
 	println("      If not specified, all contexts are allowed")
+	println("  --readonly: Disables any tool which can write changes to the cluster")
+	println("      If not specified, all tools are available")
 }
 
 func getApp() *app.Builder {
-	return app.
+	app := app.
 		NewBuilder().
 		WithFxOptions(
 			fx.Provide(func() clientcmd.ClientConfig {
@@ -127,7 +129,6 @@ func getApp() *app.Builder {
 		WithTool(tools.NewGetResourceTool).
 		WithTool(tools.NewListNodesTool).
 		WithTool(tools.NewListEventsTool).
-		WithTool(tools.NewPodExecCommandTool).
 		WithPrompt(prompts.NewListPodsPrompt).
 		WithPrompt(prompts.NewListNamespacesPrompt).
 		WithResourceProvider(resources.NewContextsResourceProvider).
@@ -150,4 +151,12 @@ func getApp() *app.Builder {
 				},
 			)),
 		)
+
+	// Skip registering remaining tools if --readonly detected
+	if config.GlobalOptions.Readonly {
+		println("Mode=Readonly, Skipping remaining tools")
+		return app
+	}
+
+	return app.WithTool(tools.NewPodExecCommandTool)
 }