OptionalallowOptional allow-list of capability module/id path prefixes.
OptionalallowOptionalallowOptionalallowOptionalallowStatically pre-filters capabilities by McpCapabilityTrustTier at manifest-build time — see ToolRuntime.ts's assertTrustTierAllowed for the complementary per-request dynamic check.
OptionaldenyOptional deny-list of capability module/id path prefixes.
OptionaldenyOptionaldenyOptionaldenyOptionaldenyOptionalinclude
Policy model used to include or exclude capabilities before registration.