Role-based tool access guard for the MCP server pipeline.
Checks the active role’s tool policy before dispatching a tool call. Returns Some(CallToolResult) with a denial message if blocked, None if allowed.
Some(CallToolResult)
None