---
summary: "Add `BRAPI_ENABLE_WRITES` env-var gate for the write surface — `brapi_submit_observations` is omitted from `tools/list` unless the operator opts in for the deployment. Mirrors obsidian-mcp-server's `OBSIDIAN_ENABLE_COMMANDS` pattern."
breaking: false
---

# 0.3.7 — 2026-04-29

A consent-layer release with no behavior change for opted-in deployments. The only mutation tool (`brapi_submit_observations`) is now gated behind an explicit deploy-time env flag, so a hosted instance never exposes writes unless the operator deliberately turns them on. The in-tool preview default, `ctx.elicit` confirmation, `force: true` bypass, and `brapi:write:observations` auth scope all continue to apply when the gate is open. Closes [#2](https://github.com/cyanheads/brapi-mcp-server/issues/2).

## Added

- **`BRAPI_ENABLE_WRITES` env var (default `false`)** — opt-in flag for the write surface. When unset or `false`, `brapi_submit_observations` is **not registered** on `createApp()` — it doesn't appear in `tools/list`, agents never see the description, the apply path is structurally unreachable. When `true`, it registers normally and existing in-tool gating layers stay in place. Surfaces as a configured env var on both `stdio` and `streamable-http` packages in `server.json` so the registry shows the flag to operators.
- **`src/mcp-server/tools/definitions/index.ts`** — new barrel exporting `readOnlyToolDefinitions` (18 tools) and `writeToolDefinitions` (`[brapiSubmitObservations]`). Pure exports — no eager `getServerConfig()` call, so reflective tooling (lint script, future tests) can import the arrays without env-parsing side effects.
- **`tests/registration-gate.test.ts`** — verifies `readOnlyToolDefinitions` excludes `brapi_submit_observations`, `writeToolDefinitions` contains exactly that tool, the env var parses to the right `enableWrites` value across stub variants, and the entry-point composition produces the expected tool list at both flag positions.

## Changed

- **`src/index.ts` registers tools via conditional spread** — `serverConfig.enableWrites ? [...readOnlyToolDefinitions, ...writeToolDefinitions] : readOnlyToolDefinitions`. All other call sites untouched. The 18 individual `import` lines for tools are gone — they live in the new barrel now.