Resolved B2 credentials and runtime policy.
Optionalcapabilities: string[] | null
Capabilities returned by B2 authorize, null for the
full-surface operator override, or an empty array to fail closed.
Optional caller-scoped controls such as verified OAuth scopes.
The configured MCP server instance.
Build the MCP server and register the B2 tool surface.
Registration is capability-aware: when
capabilitiesis a non-null array, only tools the key can use are registered (per src/utils/tool-capabilities), and Partner tools register only with a distinct master key.null/undefinedregisters the full surface (operator override and legacy unit tests); an empty array is a fail-closed capability set, not "unknown".Credential model:
B2_APPLICATION_KEY_ID/B2_APPLICATION_KEYis the application key that drives the B2 native API, S3, and key management. Only the Partner API tools use a master key (B2_MASTER_KEY_ID/B2_MASTER_KEY, optional); a single non-master key covers everything else. B2's S3 endpoint rejects master keys, which is why the application key is the primary credential.