MCP tool name.
Authorized B2 capabilities, or null for full-surface mode.
true when the tool should be registered.
Secret-sink mode is enforced by createServer; this function only answers whether the B2 credential can use the operation. Unmapped tools otherwise register unconditionally (conservative: never hide a tool we did not explicitly classify). Mapped tools register when the key holds any of the required capabilities. A null capability set is the explicit full-surface mode.
Whether a tool should be registered for a key with the given capabilities.