feat: [AG-116] MCP profiles

[ShawkyZ]

Description

Summary

• Adds MCP tool profiles feature allowing users to select which tools are registered based on their use case
• Profiles can be configured via CLI flag (--profile=<lite|full|experimental>) or environment variable (SNYK_MCP_PROFILE)
• Three profiles are available: lite (essential tools), full (default, all non-experimental), and experimental (all tools including experimental)

Motivation

Currently, all MCP tools are always registered when the server starts. This change allows users to:

• Reduce tool noise by using a minimal set of essential tools (lite profile)
• Access experimental features by opting into the experimental profile
• Have a sensible default that excludes unstable experimental tools (full profile)

Changes

New Files

• internal/mcp/profiles.go - Profile types, constants, parsing, and tool filtering logic
• internal/mcp/profiles_test.go - Comprehensive tests for profile functionality

Modified Files

• internal/mcp/tools.go - Added Profiles field to SnykMcpToolsDefinition struct; updated addSnykTools() to filter by profile
• internal/mcp/snyk_tools.json - Added profiles array to each tool definition
• internal/mcp/llm_binding.go - Get profile from configuration and pass to addSnykTools()
• internal/mcp/tools_test.go - Updated existing tests and added profile integration tests
• pkg/mcp/main.go - Added --profile CLI flag

Profile Assignments

Profile	Tools Included
lite	snyk_auth, snyk_sca_scan, snyk_code_scan, snyk_version, snyk_logout, snyk_trust, snyk_send_feedback
full (default)	All lite tools + snyk_container_scan, snyk_iac_scan, snyk_sbom_scan, snyk_aibom
experimental	All full tools + snyk_package_health

Usage

# Use lite profile via CLI flag and locally installed CLI
snyk mcp -t stdio --profile=lite

# Use lite profile via CLI flag and npx
npx -y snyk@latest mcp -t stdio --profile=lite


# Use experimental profile via environment variable
SNYK_MCP_PROFILE=experimental snyk mcp -t stdio

# Default is 'full' profile
snyk mcp -t stdio

Checklist

• Tests added and all succeed
• Regenerated mocks, etc. (make generate)
• Linted (make lint-fix)
• README.md updated, if user-facing
• License file updated, if new 3rd-party dependency is introduced

[dan-arpino]

Instead of tagging the tools, what if we had this as a profile level. Lite = Lite only. Full = Full + Lite. Experimental = Experimental + Full + Lite.

It could make this function clearer. It also makes it more consistent were each tool gets a profile level. Right now its a bit weird how "experimental" picks up the others, but "full" doesn't and has to be explicitly set.

[ShawkyZ]

I'm thinking of changing this to always explicitly set the profile where a tool should show up.

[ifeanyiecheruo]

Once small non-blocking comment to not hard-code the list of profiles in an error message