A central gate layer suppresses per-tool gate findings (ha-mcp maintainer reply)

RG-GATE-001 claims "this irreversible tool has no gate" -- a statement about the
WHOLE PROJECT -- but only ever inspected tool function bodies.

We filed an issue on homeassistant-ai/ha-mcp suggesting confirm parameters, a
read-only mode and approval policies. The maintainer replied that all of it
already exists. Verified against their source, and they are right:

  src/ha_mcp/read_only.py   ReadOnlyMiddleware blocks writes at call time;
                            ReadOnlyToolsTransform hides write tools from the
                            catalog; READ_ONLY_MODE env/addon/UI toggle
  src/ha_mcp/policy/        persisted tool-security policy (tool_policy.json),
                            enable_tool_security_policies flag
  tool annotations          MCP readOnlyHint / destructiveHint

None of that is visible from a function body, so the rule asserted a
project-level claim from function-local evidence and told a maintainer to build
what they had already built.

The scan now detects a central gate layer across the repo (an enforcement
construct, not a mere mention) and collapses the per-tool findings into a single
low/advisory note: "N irreversible tools found; project gates centrally --
cannot claim they are ungated." On ha-mcp that is 19 accusations to 1 note.

awslabs/mcp and google_workspace_mcp trip the same detection, so the queued AWS
issue would have been wrong the same way. It has been held.

Three tests: suppression fires on a real enforcement layer, still reports when
there is none, and a bare mention of "policy" in a docstring does not count.
86 cases, 100% precision, 100% recall; 705 tests pass.

Sixth false-positive class, and the only one caught by a maintainer rather than
by us. No labeled benchmark can encode "gated somewhere else in the repo".

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014Z2Zcqf7F1EawAx23FLwAp