[Improvement]: Only advertise authorized tools based on mcp_authz policy

[jhivandb]

Please select the area the issue is related to

Gateway

Please select the aspect the issue is related to

Aspect/AI (AI/LLM integration, MCP, AI readiness)

Suggested Improvement

When an mcp client does its tool discovery, based on the scopes in its access token only return the set of tools it has access to. Default for tools unmapped to a scope should be to return them.

  Request (JSON-RPC 2.0):
  {
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/list",
    "params": {
      "cursor": "optional-opaque-pagination-cursor"
    }
  }

Reasoning is an agent will always attempt a tool it sees returned until it fails which wastes tokens.

Related Issues

#2751