Per-Token Tool Filtering

By default, an MCP token sees every tool its permissions allow — that can be 90+ tools and a large tools/list payload. Tool filtering lets you restrict a token to a specific subset of tools.

How it works

1. Pass a toolFilters array at token creation.
2. Stored in the tool_filters JSONB column on mcp_tokens.
3. resolveMcpToken() loads the array per request.
4. buildMcpServer() overrides server.tool() so only allow-listed tools are registered — filtered-out tools do not appear in tools/list.

Example: single-purpose token

curl -X POST https://anymrkt.com/api/mcp/tokens \\
  -H "Authorization: Bearer PLACEHOLDER" \\
  -H "Content-Type: application/json" \\
  -d '{
    "brandIds": ["brand-uuid"],
    "label": "builder-only",
    "permissions": ["content"],
    "toolFilters": ["builder_patch_page", "builder_publish_page"]
  }'

Filtering vs. permissions

Tool filtering is an allow-list; permissions are a scope. A tool must pass both checks to be callable.