influxdata / influxdata/influxdb3_mcp_server

Resource token tools incorrectly support Core (Core has admin tokens only)

Open Beginner friendly
#54 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
38
Forks
14
Avg merge
5d 9h
Merged PRs (30d)
7

Description

## Summary

`create_resource_token` and `list_resource_tokens` are advertised and gated as supported on InfluxDB 3 **Core**, but Core does not have resource tokens. Core supports admin tokens only (operator `_admin` token plus named admin tokens). These tools misinform the LLM and fail when called against a Core instance.

Per the official Core docs, Core supports only admin tokens:
- https://docs.influxdata.com/influxdb3/core/admin/tokens/
- https://docs.influxdata.com/influxdb3/core/admin/tokens/admin/

> InfluxDB 3 Core supports two types of admin tokens: **Operator token** (`_admin`) and **Named admin token**.

There is no resource-token concept in Core. Resource tokens are an Enterprise feature.

## Where

`src/services/token-management.service.ts` gates both operations as supporting Core:

- `create_resource_token` — `validateOperationSupport("create_resource_token", [InfluxProductType.Core, InfluxProductType.Enterprise])` (~line 252)
- `list_resource_tokens` — `validateOperationSupport("list_resource_tokens", [InfluxProductType.Core, InfluxProductType.Enterprise])` (~line 157)

`src/tools/categories/token.tools.ts` describes both as "Core/Enterprise only":

- `create_resource_token`: "Create a new InfluxDB resource token with specific database permissions (Core/Enterprise only)."
- `list_resource_tokens`: "List all resource tokens ... (Core/Enterprise only)."

## Impact

Because `validateOperationSupport` includes `Core`, the call is **not** rejected for a Core deployment. It passes validation and reaches the InfluxDB API, where it has no valid resource-token endpoint to satisfy. An agent that reads the tool description will also believe Core supports resource tokens and attempt to create one, then fail. This is a tool-correctness problem: the description and gating both assert a capability Core does not have.

## Suggested fix

1. Remove `InfluxProductType.Core` from the supported-type lists for `create_resource_token` and `list_resource_tokens` in `token-management.service.ts`, leaving `Enterprise`.
2. Update the tool descriptions in `token.tools.ts` from "(Core/Enterprise only)" to "(Enterprise only)".
3. Confirm the related admin-token tools (`create_admin_token`, `list_admin_tokens`, `regenerate_operator_token`) stay scoped to Core/Enterprise, which is correct since Core does have admin tokens.
4. If protocol-compliance tests assert tool counts or per-product support, update expectations accordingly.

## Verification

- Start the server with `INFLUX_DB_PRODUCT_TYPE=core` and confirm `create_resource_token` / `list_resource_tokens` are no longer offered or are rejected with a clear "Enterprise only" message.
- Confirm Enterprise behavior is unchanged.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in src/services/token-management.service.ts and src/tools/categories/token.tools.ts, checking the two resource-token operations and the related admin-token entries. Review any protocol-compliance tests that assert tool counts or product support, then verify Core rejects or omits resource-token tools while Enterprise behavior remains unchanged.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
authentication, backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
84/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.