[GH-ISSUE #8254] docs: REA_MCP_TOOL_FAMILIES is documented as current behaviour, but published 6.8.0 does not contain it #6515

New issue

Open

opened 2026-11-01 21:11:49 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:11:49 +00:00

Owner

Originally created by @Jstallings8686 on GitHub (Oct 31, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/8254

What I ran into

Following docs/mcp-contracts.md (lines 1519–1524), I set REA_MCP_TOOL_FAMILIES=session on the MCP server and expected a scoped catalog. The server started normally and advertised all 229 tools. Repeating with five valid family ids and with a deliberately invalid id (not-a-real-family) also produced 229 tools — and the invalid-id case should have failed startup per that same paragraph — so my first read was "the control is broken".

It isn't. The published artifact simply doesn't contain the feature yet:

Item	Value
docs claim on `main`	env var restricts advertised tools; invalid selection fails startup
implementing PR	#7228, merged 2026-10-26T11:50:13Z
release tag `rea-agents-6.8.0`	published 2026-10-25T08:36:02Z
npm tarball `rea-agents@6.8.0`	2026-10-25T09:07:31Z
grep of the installed package	`REA_MCP_TOOL_FAMILIES` → 0 matches across 2,346 files
latest published version	6.8.0

The docs on main describe behaviour roughly 27 hours newer than the only published release.

Reproduction (no target analysis required)

# launch with the env var and count advertised tools
StdioServerParameters(command="npx", args=["-y", "rea-agents@6.8.0", "mcp"],
                      env={**os.environ, "REA_MCP_TOOL_FAMILIES": families})

no var (baseline)      tools=229
one valid family       tools=229     (session)
five valid families    tools=229     (javascript-runtime,electron,application,browser,session)
bogus family           tools=229     (not-a-real-family — expected startup failure)

And directly against the installed package:

$ pkg=~/.npm/_npx/da7caeae9db9c589/node_modules/rea-agents
$ grep -r REA_MCP_TOOL_FAMILIES "$pkg" | wc -l
0

Why I'm filing this

Not as a bug report — the implementation on main looks right, and #3246/#7228 explain the intent. The gap is that a reader on the released version can't tell the feature is unreleased: the paragraph reads as current behaviour, so the natural conclusion is "the control silently no-ops", which is the most expensive kind of wrong assumption for a security-relevant setting. I nearly filed that report, and the triage cost of that misdiagnosis lands on you.

Suggested fix (either is fine)

Add a version note where the setting is described (docs/mcp-contracts.md and the docs/installation.md mentions): "available in the release after 6.8.0". Cheapest, and it survives the next release.
If the docs are meant to track main, say so once on the docs landing page and in release notes.

Happy to send a PR for the wording if you prefer option 1.

Environment: Kali Linux, Node v22.23.1, npm/npx 10.9.8, Python mcp SDK 1.28.1 over stdio, REA 6.8.0 via npx -y, direct server launch (not rea setup).

Originally created by @Jstallings8686 on GitHub (Oct 31, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/8254 **What I ran into** Following [`docs/mcp-contracts.md` (lines 1519–1524)](https://github.com/morluto/rea/blob/d48e472fa6a664cacbb400560e673533005795ce/docs/mcp-contracts.md#L1519-L1524), I set `REA_MCP_TOOL_FAMILIES=session` on the MCP server and expected a scoped catalog. The server started normally and advertised all 229 tools. Repeating with five valid family ids and with a deliberately invalid id (`not-a-real-family`) also produced 229 tools — and the invalid-id case should have failed startup per that same paragraph — so my first read was "the control is broken". It isn't. The published artifact simply doesn't contain the feature yet: | Item | Value | | --- | --- | | docs claim on `main` | env var restricts advertised tools; invalid selection fails startup | | implementing PR | #7228, merged 2026-10-26T11:50:13Z | | release tag `rea-agents-6.8.0` | published 2026-10-25T08:36:02Z | | npm tarball `rea-agents@6.8.0` | 2026-10-25T09:07:31Z | | grep of the installed package | `REA_MCP_TOOL_FAMILIES` → 0 matches across 2,346 files | | latest published version | 6.8.0 | The docs on `main` describe behaviour roughly 27 hours newer than the only published release. **Reproduction** (no target analysis required) ```python # launch with the env var and count advertised tools StdioServerParameters(command="npx", args=["-y", "rea-agents@6.8.0", "mcp"], env={**os.environ, "REA_MCP_TOOL_FAMILIES": families}) ``` ``` no var (baseline) tools=229 one valid family tools=229 (session) five valid families tools=229 (javascript-runtime,electron,application,browser,session) bogus family tools=229 (not-a-real-family — expected startup failure) ``` And directly against the installed package: ``` $ pkg=~/.npm/_npx/da7caeae9db9c589/node_modules/rea-agents $ grep -r REA_MCP_TOOL_FAMILIES "$pkg" | wc -l 0 ``` **Why I'm filing this** Not as a bug report — the implementation on `main` looks right, and #3246/#7228 explain the intent. The gap is that a reader on the released version can't tell the feature is unreleased: the paragraph reads as current behaviour, so the natural conclusion is "the control silently no-ops", which is the most expensive kind of wrong assumption for a security-relevant setting. I nearly filed that report, and the triage cost of that misdiagnosis lands on you. **Suggested fix** (either is fine) 1. Add a version note where the setting is described (`docs/mcp-contracts.md` and the `docs/installation.md` mentions): "available in the release after 6.8.0". Cheapest, and it survives the next release. 2. If the docs are meant to track `main`, say so once on the docs landing page and in release notes. Happy to send a PR for the wording if you prefer option 1. **Environment:** Kali Linux, Node v22.23.1, npm/npx 10.9.8, Python `mcp` SDK 1.28.1 over stdio, REA `6.8.0` via `npx -y`, direct server launch (not `rea setup`).

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#6515

No description provided.

Rows
Columns