influxdata / influxdata/influxdb3_mcp_server
Resource token tools incorrectly support Core (Core has admin tokens only)
- Dominant language
- TypeScript
- Stars
- 38
- Forks
- 14
- Avg merge
- 5d 9h
- Merged PRs (30d)
- 7
Description
## Summary
`create_resource_token` and `list_resource_tokens` are advertised and gated as supported on InfluxDB 3 **Core**, but Core does not have resource tokens. Core supports admin tokens only (operator `_admin` token plus named admin tokens). These tools misinform the LLM and fail when called against a Core instance.
Per the official Core docs, Core supports only admin tokens:
- https://docs.influxdata.com/influxdb3/core/admin/tokens/
- https://docs.influxdata.com/influxdb3/core/admin/tokens/admin/
> InfluxDB 3 Core supports two types of admin tokens: **Operator token** (`_admin`) and **Named admin token**.
There is no resource-token concept in Core. Resource tokens are an Enterprise feature.
## Where
`src/services/token-management.service.ts` gates both operations as supporting Core:
- `create_resource_token` — `validateOperationSupport("create_resource_token", [InfluxProductType.Core, InfluxProductType.Enterprise])` (~line 252)
- `list_resource_tokens` — `validateOperationSupport("list_resource_tokens", [InfluxProductType.Core, InfluxProductType.Enterprise])` (~line 157)
`src/tools/categories/token.tools.ts` describes both as "Core/Enterprise only":
- `create_resource_token`: "Create a new InfluxDB resource token with specific database permissions (Core/Enterprise only)."
- `list_resource_tokens`: "List all resource tokens ... (Core/Enterprise only)."
## Impact
Because `validateOperationSupport` includes `Core`, the call is **not** rejected for a Core deployment. It passes validation and reaches the InfluxDB API, where it has no valid resource-token endpoint to satisfy. An agent that reads the tool description will also believe Core supports resource tokens and attempt to create one, then fail. This is a tool-correctness problem: the description and gating both assert a capability Core does not have.
## Suggested fix
1. Remove `InfluxProductType.Core` from the supported-type lists for `create_resource_token` and `list_resource_tokens` in `token-management.service.ts`, leaving `Enterprise`.
2. Update the tool descriptions in `token.tools.ts` from "(Core/Enterprise only)" to "(Enterprise only)".
3. Confirm the related admin-token tools (`create_admin_token`, `list_admin_tokens`, `regenerate_operator_token`) stay scoped to Core/Enterprise, which is correct since Core does have admin tokens.
4. If protocol-compliance tests assert tool counts or per-product support, update expectations accordingly.
## Verification
- Start the server with `INFLUX_DB_PRODUCT_TYPE=core` and confirm `create_resource_token` / `list_resource_tokens` are no longer offered or are rejected with a clear "Enterprise only" message.
- Confirm Enterprise behavior is unchanged.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in src/services/token-management.service.ts and src/tools/categories/token.tools.ts, checking the two resource-token operations and the related admin-token entries. Review any protocol-compliance tests that assert tool counts or product support, then verify Core rejects or omits resource-token tools while Enterprise behavior remains unchanged.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 84/100