Gate sheets tools behind ENABLE_SHEETS_TOOLS env flag

Sheets tools were always registered in HTTP mode and removed in stdio.
Now they're opt-in via `enable_sheets_tools` (default False), so HTTP
deployments without Google OAuth configured don't expose them either.
Also strips `output_spreadsheet_title` from the HTTP results schema
when sheets are disabled.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: RafaelPo

everyrow-mcp/src/everyrow_mcp/config.py

@@ -121,6 +121,10 @@ class Settings(BaseSettings):
         description="Upload rate limit sliding window in seconds (1 hour)",
     )
 
+    enable_sheets_tools: bool = Field(
+        default=False,
+        description="Enable Google Sheets tools (requires HTTP mode with Google OAuth)",
+    )
     everyrow_api_key: str | None = Field(default=None, repr=False)
     google_sheets_credentials_json: str | None = Field(
         default=None,

everyrow-mcp/src/everyrow_mcp/server.py

@@ -8,7 +8,6 @@
 
 from pydantic import BaseModel
 
-import everyrow_mcp.sheets_tools
 import everyrow_mcp.tools  # noqa: F401  — registers @mcp.tool() decorators
 from everyrow_mcp.app import get_instructions, mcp
 from everyrow_mcp.config import settings
@@ -21,6 +20,10 @@
 )
 from everyrow_mcp.uploads import register_upload_tool
 
+# Only register sheets tools when enabled (requires HTTP mode + Google OAuth)
+if settings.enable_sheets_tools:
+    import everyrow_mcp.sheets_tools  # noqa: F401
+
 
 class InputArgs(BaseModel):
     http: bool = False
@@ -93,6 +96,13 @@ def main():
             meta=_RESULTS_META,
         )(everyrow_results_http)
 
+        # Strip output_spreadsheet_title from results schema when sheets disabled
+        if not settings.enable_sheets_tools:
+            tool = mcp._tool_manager.get_tool("everyrow_results")
+            if tool:
+                http_def = tool.parameters.get("$defs", {}).get("HttpResultsInput", {})
+                http_def.get("properties", {}).pop("output_spreadsheet_title", None)
+
     if input_args.http:
         # ── HTTP mode logging ──────────────────────────────────────
         # INFO level so operational events show up in Cloud Logging.
@@ -136,17 +146,6 @@ def main():
             logging.error("Get an API key at https://everyrow.io/api-key")
             sys.exit(1)
 
-        # Sheets tools require HTTP mode (OAuth provides the Google token).
-        # Remove them from the tool manager so they don't appear in list_tools().
-        for name in (
-            "sheets_list",
-            "sheets_read",
-            "sheets_write",
-            "sheets_create",
-            "sheets_info",
-        ):
-            mcp._tool_manager.remove_tool(name)
-
     mcp.run(transport=transport.value)
 
 

everyrow-mcp/tests/test_mcp_e2e.py

@@ -70,7 +70,11 @@ def _http_state(fake_redis):
     )(everyrow_results_http)
 
     with (
-        override_settings(transport="streamable-http", upload_secret="test-secret"),
+        override_settings(
+            transport="streamable-http",
+            upload_secret="test-secret",
+            enable_sheets_tools=True,
+        ),
         patch.object(redis_store, "get_redis_client", return_value=fake_redis),
         patch("everyrow_mcp.tools.get_access_token", _fake_access_token),
         patch("everyrow_mcp.tool_helpers.get_access_token", _fake_access_token),