add app-level config for exposing callback docstrings in MCP tools

Author: KoolADE85

dash/_configs.py

@@ -34,6 +34,7 @@ def load_dash_env_vars():
                 "DASH_COMPRESS",
                 "DASH_MCP_ENABLED",
                 "DASH_MCP_PATH",
+                "DASH_MCP_EXPOSE_DOCSTRINGS",
                 "HOST",
                 "PORT",
             )

dash/dash.py

@@ -485,6 +485,7 @@ def __init__(  # pylint: disable=too-many-statements
         csrf_header_name: str = "X-CSRFToken",
         enable_mcp: Optional[bool] = None,
         mcp_path: Optional[str] = None,
+        mcp_expose_docstrings: Optional[bool] = None,
         **obsolete,
     ):
 
@@ -565,6 +566,9 @@ def __init__(  # pylint: disable=too-many-statements
             hide_all_callbacks=False,
             csrf_token_name=csrf_token_name,
             csrf_header_name=csrf_header_name,
+            mcp_expose_docstrings=get_combined_config(
+                "mcp_expose_docstrings", mcp_expose_docstrings, False
+            ),
         )
         self.config.set_read_only(
             [

tests/unit/mcp/tools/test_callback_adapter.py

@@ -244,6 +244,50 @@ def update(val):
             in tool.description
         )
 
+    def test_app_level_opt_in_exposes_docstrings(self):
+        """Dash(mcp_expose_docstrings=True) exposes docstrings for all callbacks."""
+        app = Dash(__name__, mcp_expose_docstrings=True)
+        app.layout = html.Div([dcc.Input(id="inp"), html.Div(id="out")])
+
+        @app.callback(Output("out", "children"), Input("inp", "value"))
+        def update(val):
+            """intentionally-exposed callback docstring text for the LLM"""
+            return val
+
+        app_context.set(app)
+        app.mcp_callback_map = CallbackAdapterCollection(app)
+
+        with app.server.test_request_context():
+            tool = app.mcp_callback_map[0].as_mcp_tool
+        assert (
+            "intentionally-exposed callback docstring text for the LLM"
+            in tool.description
+        )
+
+    def test_per_callback_false_overrides_app_level_opt_in(self):
+        """Per-callback mcp_expose_docstring=False wins over app-level opt-in."""
+        app = Dash(__name__, mcp_expose_docstrings=True)
+        app.layout = html.Div([dcc.Input(id="inp"), html.Div(id="out")])
+
+        @app.callback(
+            Output("out", "children"),
+            Input("inp", "value"),
+            mcp_expose_docstring=False,
+        )
+        def update(val):
+            """sensitive callback docstring text that must not leak to LLMs"""
+            return val
+
+        app_context.set(app)
+        app.mcp_callback_map = CallbackAdapterCollection(app)
+
+        with app.server.test_request_context():
+            tool = app.mcp_callback_map[0].as_mcp_tool
+        assert (
+            "sensitive callback docstring text that must not leak to LLMs"
+            not in tool.description
+        )
+
     def test_description_includes_output_target(self, simple_app):
         with simple_app.server.test_request_context():
             tool = app_context.get().mcp_callback_map[0].as_mcp_tool