feat: add create_data_element MCP tool

[connor-savage]

Summary

Add create_data_element MCP tool to Chip.

Generated by chip-factory pipeline.

[svc-snyk-github-jira]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[EricWarnerCollibra]

Review: create_data_element tool

Convention Compliance ✅

All conventions are met:

• Package name create_data_element matches directory name
• Exports exactly NewTool, Input, Output
• NewTool takes *http.Client, returns *chip.Tool[Input, Output]
• handler is unexported, returns chip.ToolHandlerFunc[Input, Output]
• Input/Output use json and jsonschema tags
• Optional fields use json:"field,omitempty" (display_name, status_id)
• Required fields (name, domain_id) do NOT use omitempty
• Tool name create_data_element is snake_case
• Errors returned as Output{}, err — no panics
• No direct mcp-go imports
• Client calls go through pkg/clients/create_data_element_client.go
• Permissions includes "dgc.ai-copilot"
• Registered in register.go

Build ✅

go build ./cmd/chip — passes

Unit Tests ✅

All 9 tests pass:

• Success, WithOptionalFields, MissingName, MissingDomainID, DuplicateNameConflict, Unauthorized, Forbidden, ServerError, SetsCorrectTypeID

Full Test Suite ✅

go test ./... — all packages pass

Lint ✅

golangci-lint run ./... — clean

MCP Validation ✅

• factory mcp-list — create_data_element is registered
• factory mcp-call happy path — successfully created asset, returned {"id": "...", "resource_type": "Asset"}

Adversarial Testing ✅ (8 edge cases tested)

Test	Result
Empty name ("")	✅ Tool returns "name is required"
Empty domain_id ("")	✅ Tool returns "domain_id is required"
Missing name field entirely	✅ MCP schema validation rejects with -32602
Malformed UUID ("not-a-uuid")	✅ API returns HTTP 400, tool surfaces it
Duplicate name	✅ API returns HTTP 400 "already exists", tool surfaces it
Invalid status_id (zeros UUID)	✅ API returns HTTP 404 "status not found", tool surfaces it
Unicode/emoji in name	✅ Creates successfully, no crash
Very long name (1000 chars)	✅ Creates successfully, no crash
HTML/XSS injection	✅ Creates successfully (API's responsibility to sanitize), no crash
Permission denied domain	✅ API returns HTTP 403, tool surfaces error clearly

Client Code Review

pkg/clients/create_data_element_client.go:

• Correctly POSTs to /rest/2.0/assets
• Sets Content-Type and Accept headers
• Properly handles non-2xx responses with status code and body
• Uses json.NewDecoder for response parsing
• Uses http.NewRequestWithContext for context propagation

Summary

Clean, well-structured implementation that follows all conventions. Comprehensive test coverage (9 unit tests covering happy path, validation, HTTP errors, and type ID verification). All adversarial inputs handled gracefully — validation errors are caught early, and API errors are surfaced clearly. No issues found.