2. Hide an entire tool behind a permission

Only users who can manage_workflows should even see the advance_step tool. Everyone else gets a clean tool list with no hint it exists.

Problem. Only users who can manage_workflows should even see the advance_step tool. Everyone else gets a clean tool list with no hint it exists.

Solution. Add authorization to the tool wrapper. This is RBAC — it calls current_user.can?.

# app/mcp/workflows/advance_step_tool.rb
module Workflows
  class AdvanceStepTool < McpAuthorization::Tool
    tool_name "advance_step"
    authorization :manage_workflows   # hidden unless current_user.can?(:manage_workflows)
    dynamic_contract Workflows::AdvanceStep
  end
end

Result. A viewer's tools/list omits advance_step entirely. An operator's includes it. The check also runs at call time, so a viewer who hand-crafts a tools/call for it is rejected, not served.

Collected from COOKBOOK.md in the repository. Edit it there, not here.