activeadmin_mcp 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aac4aa9e2af5d377f711090b2e8adad79915844e26842733f5c8af6b02f37d7b
-  data.tar.gz: c418625d7b5bff3c9e555d0d248e098c08a8ac1a224644e900fa14fa3a95dfa7
+  metadata.gz: 3c5af58e285dcddc7105564342dc34b55531810db4ed351b10d45a1e018ab9f4
+  data.tar.gz: 5b03712e5ea784179d552b670875183324135a9835d4bceead9301433f82e8a5
 SHA512:
-  metadata.gz: aea999468c061e6d532b0edb1e3241393a78dc34c1f94c0b07c2108431ab4370b4c89d45940a6691dce0ce5bfbc6903f92bc087457fc4d557fd70a97dacc9278
-  data.tar.gz: 588af72e3801e3c2c728d0407e217c7ebf54277d07a8dbdbd518fdbfe7e9cb335601cc3afe90cbcbbe76af40ef55b6bddde982ce11632107aca957875e34e464
+  metadata.gz: cc3367de9915d2c12ac449a410328a553941341f76bfd2cf8b331c8f22a1cfb0a070f56a6990772ded10893ee1259af4d36f28defe6fc73cb52013a582f0c42e
+  data.tar.gz: 78b2f980db593f334e4349ede90bab1d264ab03796ebcbebc4673b79f30670eb9902e748c24b687f0d04250b64d36fbd2455644e7bce9dfddaaf33e9ad6d87b6

data/README.md

@@ -123,7 +123,10 @@ action, so a write from MCP is the same write the admin UI makes:
   so a `slug` sent to a `Post` permitting only `title` and `body` never
   reaches the record. A resource that declares no `permit_params` at all (like
   `Tag`) is refused outright, with a message saying so — ActiveAdmin cannot
-  write such a resource through its own forms either.
+  write such a resource through its own forms either. A block-form
+  `permit_params` is evaluated in controller context as the authenticated MCP
+  user, so a block varying the writable set by user gets the same answer it
+  would give that user in admin.
 - **Your callbacks run** — ActiveAdmin's `before_build`, `before_create`,
   `before_save`, `after_update` and friends all fire, because the controller
   action is what fires them. A `before_create` that fills in a `slug` the form
@@ -154,8 +157,14 @@ at render time, so there is nothing to read. The response's `source` says which
 of the two you are looking at.
 
 Either way every field is annotated from the model with the column type it is
-stored in and whether the model validates its presence. `has_many` blocks are
-reported under `nested` rather than flattened in with the record's own fields.
+stored in and whether the model validates its presence. An associated record's
+fields — declared with `has_many`, or with `inputs for: :author` — are reported
+under `nested` rather than flattened in with the record's own, because a write
+against the parent would drop them.
+
+A form block that declares no inputs of its own is described from
+`permit_params` too. A bare `f.inputs` is legal, and Formtastic only expands it
+against the model at render time, so there is nothing in the block to read.
 
 `action:` selects the gate, not the shape — ActiveAdmin uses one form block for
 both. `"new"` (the default) requires the resource to register `create` and pass
@@ -174,6 +183,13 @@ Two limits worth knowing:
 - A field a form block declares but `permit_params` omits is described and then
   silently dropped on write. This cannot arise on the `permit_params` fallback
   path.
+- On the `permit_params` fallback path, only fields backed by a database column
+  are reported. ActiveAdmin keeps no list of the params it permits — only a
+  method that filters against them — so the names are recovered by offering it
+  every column the model has and seeing which survive. Permitted params that
+  are not columns, such as `tag_ids` or a nested `*_attributes` key, are
+  therefore missing from the description even though `create` and `update`
+  will accept them.
 
 ### Running member, collection and batch actions
 
@@ -297,6 +313,83 @@ Redirect-style (submit-side) actions are the supported case; a `GET` action that
 renders a full admin view is best-effort and may fail for want of a view
 context.
 
+### Actions declared somewhere you can't add `mcp:`
+
+An action declared by a shared concern, or by another gem, has no declaration
+you can hang an `mcp:` key on — and if it did, every resource including it
+would get the same description, params and `permission:` proc. Annotate it by
+name from the registration instead, with `mcp_action`:
+
+```ruby
+module Flaggable
+  def self.included(dsl)
+    dsl.send(:member_action, :flag, method: [:post, :delete]) { ... }
+    dsl.send(:batch_action, :flag, form: proc { { reason: :text } }) { |ids, inputs| ... }
+  end
+end
+
+ActiveAdmin.register Volunteer do
+  include Flaggable
+
+  mcp_action :flag, kind: :batch, tool_name: "volunteer_bulk_flag",
+    description: "Flag the selected volunteers",
+    params: { reason: { type: :string, required: true } }
+
+  mcp_action :flag, kind: :member, tool_name: "volunteer_flag",
+    description: "Flag a volunteer",
+    params: { reason: { type: :string, required: true } }
+
+  mcp_action :flag, kind: :member, http_verb: :delete, tool_name: "volunteer_unflag",
+    description: "Remove a volunteer's flag"
+end
+```
+
+`mcp_action` takes everything `mcp:` takes, plus:
+
+| Option | Meaning |
+|--------|---------|
+| `kind:` | `:member`, `:collection` or `:batch`. Optional; needed only when one name belongs to more than one action, which is refused rather than guessed. |
+| `tool_name:` | The MCP tool name, in place of the derived `<resource>_<action>`. |
+| `http_verb:` | Which verb to dispatch, for an action declared with several (`method: [:post, :delete]`). A verb the action does not answer to is a declaration error. |
+
+It **annotates**; it never declares. Naming an action the resource does not
+have warns and skips. It is resolved when the tool list is built, not when it
+is called, so it may appear above or below the `include`.
+
+An annotation **replaces** an inline `mcp:` declaration rather than merging
+into it, so a shared generic declaration and a per-resource one cannot
+half-combine into something neither author wrote.
+
+An action may carry more than one annotation, each producing its own tool —
+which is how an action answering to two verbs, one undoing the other, becomes
+two tools.
+
+**Opting in is still per resource.** Two resources including the same concern
+share the actions, not the exposure: whichever does not annotate exposes
+nothing.
+
+**Names must not collide.** A tool name carries no kind, so a `member_action`
+and a `batch_action` of the same name derive the same one. Rather than let one
+silently shadow the other, both are hidden until a `tool_name:` tells them
+apart.
+
+**Batch actions declared with a String title** — the ones applications generate
+in loops from data — may be annotated by that title, rather than by the symbol
+ActiveAdmin derives from it by titleizing and underscoring, which can carry
+punctuation. The derived tool name has that punctuation squeezed out.
+
+**ActiveAdmin's `:if` proc is honoured.** A batch action the admin UI hides
+because its `:if` refuses is neither listed nor runnable over MCP. ActiveAdmin
+itself consults `:if` only when rendering, so this is stricter than ActiveAdmin
+is — deliberately: MCP should not be the way round a gate the admin enforces by
+not offering the button. A proc that raises, typically because it reads request
+state a tool listing cannot supply, hides the tool and says so in the log.
+
+**A proc `form:` is evaluated** in controller context, the way ActiveAdmin
+evaluates it, so a batch action whose form varies by resource still contributes
+its param types. Like `suggestions:`, this runs application code, and is never
+evaluated for a user the resource's authorization adapter refuses.
+
 ## Connecting a client
 
 `activeadmin_mcp` has been tested with **Claude Code** (Anthropic) over the

data/lib/activeadmin_mcp/action_catalog.rb

@@ -9,20 +9,47 @@ module ActiveadminMcp
     RESERVED = %w[list_resources query update create describe_form].freeze
 
     class << self
-      def all
-        ResourceRegistry.resources.flat_map { |entry| definitions_for(entry[:config]) }
+      # The authenticated user is carried through so a batch action's `form:`
+      # proc can be evaluated in controller context, the way ActiveAdmin
+      # evaluates it. Nothing here evaluates it — see ActionDefinition#params,
+      # which does, lazily, once the caller has authorized the action.
+      def all(current_user: nil)
+        without_colliding_names(
+          ResourceRegistry.resources.flat_map do |entry|
+            definitions_for(entry[:config], current_user)
+          end
+        )
       end
 
-      def find(tool_name)
-        all.find { |definition| definition.tool_name == tool_name }
+      def find(tool_name, current_user: nil)
+        all(current_user: current_user).find { |definition| definition.tool_name == tool_name }
       end
 
       private
 
-      def definitions_for(config)
-        candidates(config).filter_map do |action, kind|
-          definition = ActionDefinition.build(config: config, action: action, kind: kind)
-          next unless definition
+      # A tool name carries no kind, so a member and a batch action of the same
+      # name derive the same one — which ActiveAdmin allows, and a shared
+      # concern declaring both is how it happens in practice. Advertising a
+      # duplicate would leave whichever the catalog found second permanently
+      # unreachable, since find returns the first match. Refuse both instead,
+      # and say which name, so the declaration can choose a tool_name.
+      def without_colliding_names(definitions)
+        definitions.group_by(&:tool_name).flat_map do |tool_name, sharing|
+          next sharing if sharing.one?
+
+          warn_and_skip("#{sharing.length} actions would both be called #{tool_name}; " \
+                        "give all but one an explicit tool_name:")
+          []
+        end
+      end
+
+      def definitions_for(config, current_user = nil)
+        annotated, inline = partition_declarations(config)
+
+        (annotated + inline).filter_map do |action, kind, options|
+          definition = ActionDefinition.new(
+            config: config, action: action, kind: kind, options: options, current_user: current_user
+          )
 
           next warn_and_skip(definition.errors.join("; ")) unless definition.valid?
           next warn_and_skip("#{definition.tool_name} collides with a built-in tool") if reserved?(definition)
@@ -31,6 +58,80 @@ module ActiveadminMcp
         end
       end
 
+      # Resolves each mcp_action annotation to the action it names, and leaves
+      # every unannotated action to its own inline mcp: declaration. An
+      # annotation replaces an inline declaration wholesale rather than merging
+      # into it: one declaration wins, and it is visible which.
+      def partition_declarations(config)
+        actions = candidates(config)
+        annotated = []
+        claimed = []
+
+        safe_annotations(config).each do |annotation|
+          matches = matching_actions(actions, annotation)
+
+          next warn_and_skip(annotation_missing(config, annotation)) if matches.empty?
+          next warn_and_skip(annotation_ambiguous(config, annotation)) unless matches.one?
+
+          action, kind = matches.first
+          claimed << action
+          annotated << [action, kind, annotation[:options]]
+        end
+
+        inline = actions.filter_map do |action, kind|
+          # By identity, not equality: ActiveAdmin::ControllerAction is
+          # Comparable through a `priority` its instances do not all have, so
+          # asking an Array whether it includes one can raise.
+          next if claimed.any? { |claimed_action| claimed_action.equal?(action) }
+
+          options = action.mcp_options
+          [action, kind, options] if options.is_a?(Hash)
+        end
+
+        [annotated, inline]
+      end
+
+      def matching_actions(actions, annotation)
+        wanted = annotation[:action_name].to_s
+
+        actions.select do |action, kind|
+          names_of(action, kind).include?(wanted) &&
+            (annotation[:kind].nil? || annotation[:kind] == kind)
+        end
+      end
+
+      # A batch action may be declared with a String title, from which
+      # ActiveAdmin derives the symbol by titleizing, stripping spaces and
+      # underscoring — which can leave punctuation in it. Applications generate
+      # those in loops from data, so an annotation may name either the title it
+      # wrote or the symbol ActiveAdmin made of it.
+      def names_of(action, kind)
+        names = [declared_name(action, kind).to_s]
+        names << action.title.to_s if kind == :batch && action.respond_to?(:title)
+        names
+      end
+
+      def declared_name(action, kind)
+        (kind == :batch ? action.sym : action.name).to_sym
+      end
+
+      def annotation_missing(config, annotation)
+        "#{resource_name(config)} annotates #{annotation[:action_name]}, which it does not declare"
+      end
+
+      def annotation_ambiguous(config, annotation)
+        "#{resource_name(config)} annotates #{annotation[:action_name]}, which names more than one " \
+          "action; say which with kind:"
+      end
+
+      def resource_name(config)
+        config.resource_class.name
+      end
+
+      def safe_annotations(config)
+        config.respond_to?(:mcp_annotations) ? Array(config.mcp_annotations) : []
+      end
+
       def candidates(config)
         pairs = []
         pairs.concat(safe_actions(config, :member_actions).map { |a| [a, :member] })

data/lib/activeadmin_mcp/action_definition.rb

@@ -9,6 +9,10 @@ module ActiveadminMcp
   class ActionDefinition
     KINDS = %i[member collection batch].freeze
 
+    # MCP tool names are referenced by clients as identifiers, so keep them to
+    # what every client can quote without escaping.
+    TOOL_NAME = /\A[a-z0-9][a-z0-9_-]*\z/
+
     # JSON Schema scalar types an application may declare.
     TYPES = %i[string integer number boolean array object].freeze
 
@@ -24,18 +28,19 @@ module ActiveadminMcp
 
     attr_reader :config, :action, :kind, :errors
 
-    def self.build(config:, action:, kind:)
+    def self.build(config:, action:, kind:, current_user: nil)
       options = action.mcp_options
       return nil unless options.is_a?(Hash)
 
-      new(config: config, action: action, kind: kind, options: options)
+      new(config: config, action: action, kind: kind, options: options, current_user: current_user)
     end
 
-    def initialize(config:, action:, kind:, options:)
+    def initialize(config:, action:, kind:, options:, current_user: nil)
       @config = config
       @action = action
       @kind = kind
       @options = options
+      @current_user = current_user
       @errors = []
       validate!
     end
@@ -48,8 +53,28 @@ module ActiveadminMcp
       @config.resource_class.name
     end
 
+    # A declaration may choose its own name: an action shared by a concern can
+    # need a different one on each resource, and an action exposed once per
+    # verb needs a distinct name per tool.
     def tool_name
+      declared = @options[:tool_name]
+      return declared.to_s if declared
+
+      derived_tool_name
+    end
+
+    # Squeezed down to the characters a tool name may carry, because an action
+    # name is not always tame: ActiveAdmin derives a batch action's symbol from
+    # a String title and can leave punctuation in it. A resource may still
+    # choose its own name with tool_name:, which is validated rather than
+    # squeezed, since a name someone typed deliberately should not be silently
+    # rewritten.
+    def derived_tool_name
       "#{resource_name.underscore.tr('/', '_')}_#{action_name}"
+        .downcase
+        .gsub(/[^a-z0-9_-]+/, "_")
+        .squeeze("_")
+        .delete_suffix("_")
     end
 
     def description
@@ -60,10 +85,32 @@ module ActiveadminMcp
       @options[:permission]
     end
 
+    # ActiveAdmin's own `:if` proc on a batch action, which decides whether the
+    # admin UI offers it at all. Returned rather than evaluated: like a
+    # `permission:` proc it belongs in controller context, which only the
+    # caller can build.
+    def display_if
+      return nil unless @kind == :batch
+      return nil unless @action.respond_to?(:display_if_block)
+
+      @action.display_if_block
+    end
+
+    # ActiveAdmin always posts a batch action, whatever a declaration says.
+    # Otherwise a declaration may pick among the verbs the action answers to —
+    # `method: [:post, :delete]` is one action with two meanings, and without
+    # this only the first would ever be reachable.
     def http_verb
       return :post if @kind == :batch
 
-      Array(@action.http_verb).first&.to_sym || :get
+      declared = @options[:http_verb]&.to_sym
+      return declared if declared
+
+      action_verbs.first || :get
+    end
+
+    def action_verbs
+      Array(@action.http_verb).compact.map(&:to_sym)
     end
 
     # Declared params, with batch actions inheriting their types from the
@@ -89,14 +136,57 @@ module ActiveadminMcp
 
     def inherited_params
       return {} unless @kind == :batch
-      return {} unless @action.respond_to?(:inputs)
+
+      resolved_form.each_with_object({}) do |(name, widget), acc|
+        acc[name.to_sym] = { type: form_type(widget) }
+      end
+    end
+
+    # A form: entry is usually a widget name, but ActiveAdmin also accepts an
+    # array of options, which it renders as a select. There is no type to read
+    # off that, and its values are not treated as a binding enum: they were
+    # resolved once, at listing time, and a declaration wanting to offer them
+    # should say so with suggestions:, which is advisory by design.
+    def form_type(widget)
+      return :string unless widget.respond_to?(:to_sym)
+
+      FORM_TYPES.fetch(widget.to_sym, :string)
+    end
+
+    # ActiveAdmin lets `form:` be a proc and evaluates it in controller context
+    # at render time, which is the only way a concern shared across resources
+    # can vary its options. Evaluated here the same way, so a proc form still
+    # contributes its param types.
+    #
+    # Deliberately lazy: this runs application code, so it must not happen
+    # while the catalog is merely being built, before the caller has checked
+    # the user is authorized for the action at all. Same posture as
+    # `suggestions:`.
+    def resolved_form
+      return @resolved_form if defined?(@resolved_form)
+
+      @resolved_form = resolve_form || {}
+    end
+
+    def resolve_form
+      return nil unless @action.respond_to?(:inputs)
 
       form = @action.inputs
-      return {} unless form.is_a?(Hash)
+      return form if form.is_a?(Hash)
+      return nil unless form.is_a?(Proc)
 
-      form.each_with_object({}) do |(name, widget), acc|
-        acc[name.to_sym] = { type: FORM_TYPES.fetch(widget.to_sym, :string) }
-      end
+      evaluate_form(form)
+    end
+
+    def evaluate_form(form)
+      controller = ControllerDispatcher.new(config: @config, current_user: @current_user)
+                                       .controller_with_mcp_user
+      evaluated = ::MethodOrProcHelper.render_in_context(controller, form)
+      evaluated.is_a?(Hash) ? evaluated : nil
+    rescue StandardError => e
+      # The tool keeps whatever the declaration said; it just inherits nothing.
+      warn("[activeadmin_mcp] evaluating the #{tool_name} form: proc raised #{e.class}: #{e.message}")
+      nil
     end
 
     def validate!
@@ -105,7 +195,10 @@ module ActiveadminMcp
 
       reserved = reserved_param_name
       form_keys = batch_form_keys
-      params.each do |name, spec|
+      # Declared params only. Inherited ones come from ActiveAdmin's own form:
+      # hash and are always well formed, and reading them would mean evaluating
+      # a proc form here — the one place it must not happen.
+      declared_params.each do |name, spec|
         unless spec.is_a?(Hash)
           @errors << "#{tool_name}: param #{name} must be a Hash"
           next
@@ -142,6 +235,27 @@ module ActiveadminMcp
       end
 
       @errors << "#{tool_name}: permission must be callable" if permission && !permission.respond_to?(:call)
+
+      validate_tool_name!
+      validate_http_verb!
+    end
+
+    def validate_tool_name!
+      return if tool_name.match?(TOOL_NAME)
+
+      @errors << "#{tool_name}: tool_name must match #{TOOL_NAME.source}"
+    end
+
+    # Dispatching a verb the action never declared would reach nothing, or
+    # worse, the wrong branch of the action's own body.
+    def validate_http_verb!
+      declared = @options[:http_verb]&.to_sym
+      return if declared.nil? || @kind == :batch
+
+      verbs = action_verbs
+      return if verbs.empty? || verbs.include?(declared)
+
+      @errors << "#{tool_name}: http_verb #{declared} is not one the action answers to (#{verbs.join(', ')})"
     end
 
     # The permitted param keys for a batch action's `inputs` (its `form:`

data/lib/activeadmin_mcp/action_runner.rb

@@ -32,6 +32,9 @@ module ActiveadminMcp
 
       dispatcher = ControllerDispatcher.new(config: @definition.config, current_user: @current_user)
 
+      unavailable = display_refusal(dispatcher)
+      return { error: unavailable } if unavailable
+
       refusal = permission_refusal(dispatcher, record, parsed)
       return { error: refusal } if refusal
 
@@ -64,6 +67,24 @@ module ActiveadminMcp
                    .authorized?(@definition.action_name, subject)
     end
 
+    # ActiveAdmin's `:if` proc decides whether the admin UI offers a batch
+    # action at all, but ActiveAdmin only consults it when rendering — a
+    # dispatched request reaches the action regardless. Consulting it here too
+    # keeps MCP from becoming the way round a gate the admin enforces by not
+    # offering the button.
+    def display_refusal(dispatcher)
+      block = @definition.display_if
+      return nil unless block
+
+      controller = dispatcher.controller_with_mcp_user
+      return nil if ::MethodOrProcHelper.render_in_context(controller, block)
+
+      "#{@definition.tool_name} is not available to you"
+    rescue StandardError => e
+      warn("[activeadmin_mcp] if: proc for #{@definition.tool_name} raised #{e.class}: #{e.message}")
+      "#{@definition.tool_name} is not available to you"
+    end
+
     # Evaluated the way ActiveAdmin evaluates batch action `:if` procs, so
     # current_admin_user, can? and the usual admin helpers are in scope.
     # Returns a refusal message, or nil when the proc allows the call.

data/lib/activeadmin_mcp/active_admin_ext.rb

@@ -14,6 +14,50 @@ module ActiveadminMcp
       end
     end
 
+    # Records MCP annotations declared against a resource for actions it does
+    # not declare inline — typically because a shared concern declares them,
+    # and one description could not suit every resource that includes it.
+    #
+    # They live on the resource config rather than on the action, so a
+    # declaration may appear above or below the `include` that brings the
+    # action in, and so they are discarded with the config when ActiveAdmin
+    # reloads in development.
+    module ResourceAnnotations
+      def mcp_annotations
+        @mcp_annotations ||= []
+      end
+    end
+
+    module McpActionDsl
+      # Annotates an already-declared action so it is exposed as an MCP tool.
+      # Never declares the action itself: naming one that does not exist is
+      # reported when the catalog is built, not here, because the action may
+      # legitimately be declared after this call.
+      def mcp_action(name, kind: nil, **options)
+        config.mcp_annotations << {
+          action_name: name.to_sym,
+          kind: kind&.to_sym,
+          options: options,
+        }
+      end
+    end
+
+    # Installed separately from, and earlier than, apply!. A registration block
+    # calls mcp_action while ActiveAdmin loads its resources, which is before
+    # ActiveAdmin.after_load fires — so waiting for that hook would mean the
+    # method did not exist at the only moment anybody calls it.
+    #
+    # ActiveAdmin::Resource and ActiveAdmin::ResourceDSL both exist as soon as
+    # ActiveAdmin is required, so there is nothing to wait for. Idempotent:
+    # including a module twice is a no-op.
+    def self.apply_dsl!
+      return false unless defined?(::ActiveAdmin::Resource) && defined?(::ActiveAdmin::ResourceDSL)
+
+      ::ActiveAdmin::Resource.include(ResourceAnnotations)
+      ::ActiveAdmin::ResourceDSL.include(McpActionDsl)
+      true
+    end
+
     # ActiveAdmin::BatchAction only exists once ActiveAdmin's before_load hooks
     # have run, so this is called from ActiveAdmin.after_load rather than at
     # require time.

data/lib/activeadmin_mcp/engine.rb

@@ -17,7 +17,13 @@ module ActiveadminMcp
 
     initializer "activeadmin_mcp.active_admin_ext" do
       ActiveSupport.on_load(:after_initialize) do
-        ActiveAdmin.after_load { ActiveadminMcp::ActiveAdminExt.apply! } if defined?(::ActiveAdmin)
+        next unless defined?(::ActiveAdmin)
+
+        # The DSL has to exist before ActiveAdmin loads the registrations that
+        # call it; the option readers only have to exist before the catalog is
+        # read, and ActiveAdmin::BatchAction does not exist until load time.
+        ActiveadminMcp::ActiveAdminExt.apply_dsl!
+        ActiveAdmin.after_load { ActiveadminMcp::ActiveAdminExt.apply! }
       end
     end
   end

data/lib/activeadmin_mcp/form_description.rb

@@ -29,8 +29,12 @@ module ActiveadminMcp
       refusal = write_refusal(write_action)
       return refusal if refusal
 
+      # An empty result is not the same as no form block, but it means the same
+      # thing here: ActiveAdmin's own default form is a bare `f.inputs` that
+      # Formtastic expands only at render time, so a block written that way has
+      # nothing in it to read and the permitted params are all there is.
       declared = declared_inputs
-      return describe(action, "form", declared) if declared
+      return describe(action, "form", declared) if declared&.any?
 
       permitted = permitted_inputs
       return permit_params_refusal unless permitted
@@ -114,9 +118,13 @@ module ActiveadminMcp
       names.map { |name| { name: name } }
     end
 
+    # The controller carries the MCP user: ActiveAdmin instance_execs a
+    # block-form permit_params on it, so a block reading current_admin_user
+    # raises on a bare instance and the resource looks unwritable.
     def permitted_names
       param_key = @config.param_key.to_sym
-      controller = @config.controller.new
+      controller = ControllerDispatcher.new(config: @config, current_user: @current_user)
+                                       .controller_with_mcp_user
       controller.params = ActionController::Parameters.new(
         param_key => @resource[:model].column_names.index_with { nil }
       )

data/lib/activeadmin_mcp/form_field_collector.rb

@@ -32,7 +32,14 @@ module ActiveadminMcp
       self
     end
 
-    def inputs(*_args, **_opts, &block)
+    # `inputs for: :author` scopes its fields to an association, the same way
+    # has_many does; only an unscoped `inputs` groups fields of the record
+    # itself. Descending into a scoped one would advertise the associated
+    # record's fields as attributes of the record being written.
+    def inputs(*_args, **options, &block)
+      association = options[:for]
+      return nest(association, &block) if association
+
       instance_exec(self, &block) if block
       self
     end
@@ -41,11 +48,7 @@ module ActiveadminMcp
     # can tell an association's fields from the record's own. Flattening them
     # would advertise `body` as an attribute of the parent record.
     def has_many(name, *_args, **_opts, &block)
-      return self unless name.respond_to?(:to_sym)
-      return self if declared?(name.to_sym)
-
-      @inputs << { name: name.to_sym, nested: block ? self.class.new.collect(&block) : [] }
-      self
+      nest(name, &block)
     end
 
     def method_missing(_name, *_args, **_opts, &block)
@@ -59,6 +62,17 @@ module ActiveadminMcp
 
     private
 
+    # `for:` may name the association or give it as [name, object]; only the
+    # name says anything to a client.
+    def nest(association, &block)
+      name = association.is_a?(Array) ? association.first : association
+      return self unless name.respond_to?(:to_sym)
+      return self if declared?(name.to_sym)
+
+      @inputs << { name: name.to_sym, nested: block ? self.class.new.collect(&block) : [] }
+      self
+    end
+
     def declared?(name)
       @inputs.any? { |input| input[:name] == name }
     end

data/lib/activeadmin_mcp/record_writer.rb

@@ -133,9 +133,15 @@ module ActiveadminMcp
 
     # Asks the resource's own controller what it would permit, or nil when it
     # has nothing to say because permit_params was never declared.
+    #
+    # The controller carries the MCP user, because ActiveAdmin instance_execs a
+    # block-form permit_params on it: a block reading current_admin_user raises
+    # on a bare instance, and the rescue below would then report a resource
+    # that permits plenty as one that permits nothing.
     def resolve_permitted(attributes)
       param_key = @config.param_key.to_sym
-      controller = @config.controller.new
+      controller = ControllerDispatcher.new(config: @config, current_user: @current_user)
+                                       .controller_with_mcp_user
       controller.params = ActionController::Parameters.new(param_key => attributes)
       permitted = controller.send(:permitted_params)
       scoped = permitted && permitted[param_key]

data/lib/activeadmin_mcp/request_handler.rb

@@ -46,8 +46,9 @@ module ActiveadminMcp
     # an already-assembled list would mean those procs had already run — and
     # their values already been read — for a user authorized for none of it.
     def action_tools
-      ActionCatalog.all.filter_map do |definition|
+      ActionCatalog.all(current_user: @current_user).filter_map do |definition|
         next unless authorized_to_run?(definition)
+        next unless offered_by_active_admin?(definition)
         next unless authorized_to_list?(definition)
 
         {
@@ -69,6 +70,23 @@ module ActiveadminMcp
       false
     end
 
+    # ActiveAdmin's own `:if` proc on a batch action decides whether the admin
+    # UI offers it. Evaluated in controller context, as ActiveAdmin evaluates
+    # it, so `authorized?` and `current_admin_user` are in scope. A proc
+    # reaching for request state it cannot have here raises, and the tool is
+    # hidden rather than offered past a gate we could not read.
+    def offered_by_active_admin?(definition)
+      block = definition.display_if
+      return true unless block
+
+      controller = ControllerDispatcher.new(config: definition.config, current_user: @current_user)
+                                       .controller_with_mcp_user
+      !!::MethodOrProcHelper.render_in_context(controller, block)
+    rescue StandardError => e
+      warn("[activeadmin_mcp] hiding #{definition.tool_name}: if: proc raised #{e.class}: #{e.message}")
+      false
+    end
+
     # Collection and batch actions whose permission proc takes no record can be
     # resolved now, so the tool is simply hidden. A member action's proc needs a
     # record, so its tool stays listed and refusal happens at call time.
@@ -182,7 +200,7 @@ module ActiveadminMcp
     end
 
     def tool_action(name, args)
-      definition = ActionCatalog.find(name)
+      definition = ActionCatalog.find(name, current_user: @current_user)
       return { error: "Unknown tool: #{name}" } unless definition
 
       ActionRunner.new(definition: definition, current_user: @current_user).call(args)

data/lib/activeadmin_mcp/version.rb

@@ -1,3 +1,3 @@
 module ActiveadminMcp
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activeadmin_mcp
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - harunkumars