Session-Scoped Visibility
Tools appear after login, hide on logout. authorize() notifies the client automatically — no manual sendToolListChanged.
Session-aware MCP servers. Declare visibility rules as middleware.
server.tool("login", config, handler); // always visible
server.tool("weather", guard(), config, handler); // hidden until authorized
// Client gets notified automatically. No manual wiring.