MCP: autocomplete ignores an explicit unknown role and returns another index #63

autocomplete_terms accepts an explicit nonexistent role and returns suggestions from the previously built index. The same released server correctly rejects that role for search, build_autocomplete_index and find_matches. A client therefore cannot trust a successful autocomplete result as proof that the requested role was applied.

Reproduced with the published terraphim_mcp_server-v1.21.18-rc.1, macOS arm64, official Python MCP SDK 1.30.0. Executable version is terraphim_mcp_server 1.21.18; SHA-256 9a86ddf05c0367a25578901e8d7b6aa5bc9bf6a85be737e1232ae62134c31098.

Reproduce

Configure a local kiloproject role with a Markdown KG containing:

# Risk
synonyms:: Concern

A possible event that could affect the project outcome.

Use kiloproject consistently in .terraphim/role-kiloproject.json, its name, selected/default role and tool calls. Keep concept notes separate from the corpus. Launch the released executable with --profile server --config-dir <project directory>. The retrieval issue #62 supplies the complete portable setup, including supported local profile overrides and isolated memory-backed test persistence.

After initialization, make these actual tools/call requests in the same session:

{"name":"build_autocomplete_index","arguments":{"role":"kiloproject"}}
{"name":"autocomplete_terms","arguments":{"query":"Con","role":"MissingKiloRole","limit":8}}
{"name":"search","arguments":{"query":"Concern","role":"MissingKiloRole","limit":3}}
{"name":"build_autocomplete_index","arguments":{"role":"MissingKiloRole"}}
{"name":"find_matches","arguments":{"text":"Concern","role":"MissingKiloRole"}}

Actual saved outputs

• The first index build succeeds with two terms for kiloproject.
• Autocomplete returns isError: false, Found 3 suggestions, then concern, concern, risk, even though MissingKiloRole does not exist.
• Search returns isError: true: Role MissingKiloRole not found in config.
• Index build and matches also return isError: true with role-not-found diagnostics.

The actual autocomplete schema describes role as the optional role name to use, and says omission uses the selected role. The implementation currently reuses the process's existing index without validating that requested role. The duplicate Concern suggestion is observed separately; uniqueness is not the acceptance criterion for this report.

Expected and regression acceptance

An explicit unknown role must return a clear error with no suggestions from another role. Add a real two-role test with disjoint vocabulary: build role A's index, request autocomplete for B, and verify either B's actual index or an explicit not-ready/error outcome, never A's terms. Repeat A→B→A and unknown-role cases against the actual released server. Omitted-role calls must remain bound to the selected role. Do not replace these checks with a mocked autocomplete result.

This finding prevents advertising per-call role isolation for autocomplete. No private source, credentials or local user paths are included here; it does not claim that unrelated exposed MCP tools have been qualified.