ContextCurrent manage_istio_config tool is fully disabled in --read-only mode because it supports create/patch/delete. This blocks list/get operations too, which are needed in restricted environments.DecisionAs a short‑term workaround, split the tool into two so read-only operations remain available until granular permissions are supported.Scope

• Create a read-only tool that supports only list/get of Istio objects.

• Create a write tool that supports create/patch/delete operations.

• Ensure the read-only tool is available when --read-only is enabled.

Acceptance Criteria

• Read-only mode exposes only the read-only tool.

• Read-only tool successfully performs list/get operations.

• Write tool remains unchanged in write mode and handles create/patch/delete only.

Notes / References

• Discussion excerpt: “separate the tool in 2”

• Issue: https://github.com/containers/kubernetes-mcp-server/issues/568