Function gateRegistration

mcp/src/server.ts:23–33

(server: McpServer, allowed: ReadonlySet<string>)

// surface/decision-space optimization; the backend still enforces scope, so a
// skipped tool is never the security boundary.
function gateRegistration(server: McpServer, allowed: ReadonlySet<string>): void {
  const original = server.registerTool.bind(server) as (...a: unknown[]) => unknown;
  server.registerTool = ((name: string, ...rest: unknown[]) => {
    if (!allowed.has(name)) {
      // Skip: not wired into the server's tool list. Returns undefined; the
      // register*Tools callers don't use the return value.
      return undefined as unknown as ReturnType<McpServer["registerTool"]>;
    }
    return original(name, ...rest) as ReturnType<McpServer["registerTool"]>;
  }) as McpServer["registerTool"];
}

export function buildServer({ client, version = "0.1.0" }: BuildServerOptions): McpServer {
  const server = new McpServer({