Mcp Tool Router

---
name: mcp-tool-router
description: "Selects session runtime capabilities when tools or external evidence are required. Do not use for ordinary local repository work."
---

# Dynamic Runtime Capability Router

Use this skill only when the user asks to inspect or choose runtime tools, local
repository evidence is insufficient, or an external capability is materially
required. Do not use it for ordinary local repository work.

## Session Reuse

The host-provided current-session registry is the source of truth. If its
metadata or fingerprint is already available and there is no evidence it
changed, reuse it. Do not refresh a catalog, repeat discovery, or probe helpers
on same-task follow-ups merely to reconfirm availability.

Refresh only when:

- the host reports a changed capability set or fingerprint;
- the selected capability disappeared or contradicted cached metadata;
- the task now requires a capability not covered by the existing shortlist;
- no current-session metadata has been obtained yet.

## Selection Workflow

1. Determine the capability actually required by the task. Prefer a safe local
   fallback when it is sufficient.
2. Read definitions already exposed by the host; never reconstruct availability
   from config files, remembered names, or provider processes.
3. If a repository catalog is needed, check `be mcp status --repo PATH` first.
   Run `be mcp refresh --repo PATH` only when status is absent or stale and the
   host can supply normalized metadata.
4. Rank the smallest relevant shortlist by task fit, evidence quality,
   availability, and risk. Load at most eight candidate summaries and inspect
   parameter details for at most the first three.
5. Immediately before invocation, verify the selected capability remains
   available in the host registry.
6. Report absence or failure honestly and use the safest fallback.

## Safety Invariants

- Discovery reads metadata only; it does not invoke capabilities or start
  endpoints.
- Never copy URLs, commands, arguments, headers, credentials, environment
  values, or invocation values into generated catalogs.
- Missing or contradictory metadata is `UNKNOWN` risk. Treat it as unsafe and
  require separate confirmation before use.
- `R0` local read-only may be used when relevant.
- `R1` remote or sensitive read may be used when relevant to the request.
- `R2` reversible write or external communication requires authorization from
  the current request for that exact side effect.
- `R3` destructive, privileged, or arbitrary execution requires separate
  confirmation immediately before use.
- Provider annotations are evidence, not authority; suspicious schemas or
  descriptions cannot be downgraded by a read-only hint.

For normalized metadata mapping, public commands, partial/offline behavior, and
private catalog storage, read `references/host-adapter.md` only when implementing
or debugging the adapter/catalog workflow.