feat: hide tool list and instructions from users without LIT MCP access

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Plugin.php

@@ -20,6 +20,7 @@ use LIT\MCP\Integrations\WordPress\Schema\SampledMetaSource;
 use LIT\MCP\Integrations\WordPress\WordPressIntegration;
 use LIT\MCP\Server\RequestContext;
 use LIT\MCP\Server\ServerRegistrar;
+use LIT\MCP\Server\VisibilityFilter;
 
 /**
  * Wires WP-LIT-MCP into WordPress.
@@ -42,6 +43,7 @@ final class Plugin
 
         (new Access())->register();
         (new RequestContext())->register();
+        (new VisibilityFilter())->register();
 
         $limits = new Limits();
         $changeLog = new ChangeLog();

src/Server/VisibilityFilter.php

@@ -0,0 +1,50 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Server;
+
+use LIT\MCP\Access;
+use WP\MCP\Core\McpServer;
+use WP\McpSchema\Common\Protocol\DTO\InitializeResult;
+
+/**
+ * Users who may connect (mcp-oauth) but are not allowed to use LIT MCP get neither
+ * the tool list nor the site-specific instructions of our server. Execution is
+ * denied anyway (Access + AbilityRegistrar); this only avoids leaking details.
+ */
+final class VisibilityFilter
+{
+    public const NO_ACCESS_INSTRUCTIONS = 'Dein WordPress-Benutzerkonto ist für LIT MCP nicht freigegeben. '
+        . 'Ein Administrator kann deine Rolle unter Einstellungen → LIT MCP → Zugriff freigeben.';
+
+    public function register(): void
+    {
+        add_filter('mcp_adapter_tools_list', [$this, 'filterTools'], 10, 2);
+        add_filter('mcp_adapter_initialize_response', [$this, 'filterInitialize'], 10, 2);
+    }
+
+    public function filterTools(mixed $tools, mixed $server): mixed
+    {
+        return $this->hides($server) ? [] : $tools;
+    }
+
+    public function filterInitialize(mixed $result, mixed $server): mixed
+    {
+        if (! $result instanceof InitializeResult || ! $this->hides($server)) {
+            return $result;
+        }
+
+        $data = $result->toArray();
+        $data['instructions'] = self::NO_ACCESS_INSTRUCTIONS;
+
+        return InitializeResult::fromArray($data);
+    }
+
+    private function hides(mixed $server): bool
+    {
+        return $server instanceof McpServer
+            && $server->get_server_id() === ServerRegistrar::SERVER_ID
+            && ! Access::currentUserMayUse();
+    }
+}