Dynamic Tool discovery

[0xKoller]

Tools are no longer unconditionally registered, server operators and tool authors can now control which tools are visible based on authentication, scopes, dependencies, and configuration.

How it works

Three filtering layers, evaluated in order:

1. Build-time: tools.include / tools.exclude in xmcp.config.ts controls which tools get bundled. Excluded tools never load.
2. Runtime per-tool filters: New optional ToolMetadata fields:

• enabled: false: disabled by default (overridable by config include/enable)
• requiresAuth: true: hidden from unauthenticated clients
• requiredScopes: ['admin']: requires all listed OAuth scopes

3. Dependency resolution: dependsOn: ['other-tool'] makes a tool visible only when its dependencies pass their own filters. Resolved iteratively with circular dependency detection.

Hidden tools return "tool not found" if called directly. their existence is never revealed.

Config example

  // xmcp.config.ts
  export default {
    http: true,
    tools: {
      exclude: ['debug-tool'],        // never bundle this
      enable: ['experimental'],       // override enabled: false
    },
  }

Tool metadata example

  export const metadata: ToolMetadata = {
    name: 'advanced-analytics',
    description: 'Analytics dashboard',
    requiresAuth: true,
    requiredScopes: ['admin'],
    dependsOn: ['data-source'],      // only visible when data-source is registered
  }

Related Issues

Resolves XMCP-150

[linear]

XMCP-150 Dynamic Tool discovery

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
xmcp-website	Ready	Preview, Comment	Apr 16, 2026 8:39pm

[github-actions]

Rspack Bundle Analysis

Build	Assets	Total Size (MB)	Build Time
Main Compiler	4	5.29	5.43s
Runtime Compiler	6	4.34	5.81s

Main Compiler

Source: stats-main.json

Asset	Chunk	Size (KB)	Size (MB)
cli.js	cli	4948.56	4.83
index.js	index	369.14	0.36
cloudflare.js	cloudflare	81.70	0.08
detached-flush.js	detached-flush	15.18	0.01

Total emitted JS: 5.29 MB

Runtime Compiler

Source: stats-runtime.json

Asset	Chunk	Size (KB)	Size (MB)
http.js	http	1043.59	1.02
adapter-nestjs.js	adapter-nestjs	1019.81	1.00
adapter-nextjs.js	adapter-nextjs	1014.16	0.99
adapter-express.js	adapter-express	1012.12	0.99
stdio.js	stdio	354.38	0.35
headers.js	headers	1.73	0.00

Total emitted JS: 4.34 MB

Package Footprint (npm pack + npm install)

Item	Size (KB)	Size (MB)
Tarball (.tgz)	3394.07	3.31
dist/	9937.93	9.71
node_modules/	101316.79	98.94
dist + node_modules	111254.72	108.65

[0xKoller]

@greptileai re review