McpToolExposureMode'direct'Which tools the MCP tools/list call returns. See McpToolExposureMode for the
available modes. In-process listing through McpToolExecutionService always lists
the real tools and ignores this.
'disabled' | 'authenticated' | 'anonymous''anonymous'Controls HTTP access to the /mcp/shop endpoint and the shop toolset.
'anonymous' (default): the endpoint accepts anonymous callers as well as
OAuth-authenticated customers.'authenticated': the endpoint requires an OAuth Bearer token. Token-less
requests receive a 401 with the standard auth challenge.'disabled': the endpoint responds 404 and customer OAuth authorization
requests are refused.In-process tool execution via McpToolExecutionService is not affected.
McpOauthOptionsLeave this out and the anonymous shop endpoint still works, but anything needing a token
fails with 400 MCP OAuth is not configured. That covers the admin endpoint, the
authenticated shop endpoint, and the OAuth endpoints themselves.
McpRateLimitOptionsMcpDnsRebindingOptionsMcpLoggingOptionsArchitecture reviews, custom plugin work, migrations, ongoing support. Get a hand from the team that builds Vendure.