Bugbot - Team MCP shows Connected and Team Rules load, but MCP is never called

Support Bug Reports
, ,
1

Where does the bug appear (feature/product)?

Bugbot / Security Review Agent

Describe the Bug

Bugbot (Team plan).
Team MCP shows as Connected.
Required Team Rules that tell Bugbot to call that MCP are included in bugbot run verbose=true, but the review never uses the tools.
The same Team MCP works from Cloud Agents.
Our MCP server logs for this run show no tool calls.

Request ID: serverGenReqId_f05c3696-228d-4e0c-afe6-c76b65a5e3d4

Were MCP tools offered to Bugbot on this request?

Steps to Reproduce

Attach a Team MCP server to Bugbot; the dashboard shows Connected.
Add a Required Team Rule that tells Bugbot to call that MCP.
Run Bugbot with bugbot run verbose=true.
The rule shows as included; review does not call the MCP.

Expected Behavior

Bugbot calls the Connected Team MCP when a Required Team Rule tells it to.

Operating System

Other

Version Information

BugBot version

For AI issues: add Request ID with privacy disabled

serverGenReqId_f05c3696-228d-4e0c-afe6-c76b65a5e3d4

Does this stop you from using Cursor

No - Cursor works, but with this issue

12

Hey @CM_distilled!

Bugbot only uses MCP tools that your server marks as read-only. Each tool your server returns from tools/list needs annotations: { readOnlyHint: true }. Tools without that annotation (or marked as destructive) are skipped, even though the server shows as Connected.

None of your server’s tools appear to carry it, so Bugbot had nothing it was allowed to call.

The MCP Tools page in the Bugbot settings mentions this in its description (“Only read-only annotated tools are exposed”), but our docs don’t spell it out yet.

The change goes where each tool is registered on your server, for example:

server.registerTool("search_docs", {
  description: "...",
  inputSchema: { query: z.string() },
  annotations: { readOnlyHint: true },
}, handler);

Only mark tools that don’t change anything. After deploying, reconnect the server on the Bugbot settings page, comment bugbot run verbose=true on a PR, and reply here with the new request ID and whether your server logs show a tool call!