[scottgrayson]

Why

CHECK needs training tools that only exist in CHECK, next to the LMS course tools. The package server has a fixed tool list, so a host app could not add tools to it. Now the package provides the tools, and a host app can serve them from its own MCP server.

What changed

• LmsServer::TOOLS lists every LMS tool. A host server spreads it into its own $tools.
• The new HasSanctumAbilities trait builds the Sanctum ability list for any server. LmsServer::sanctumAbilities() keeps its output.
• The package registers its stdio handle filament-lms and POST /mcp/lms after every provider boots. It skips each one when the host app already registered it, for example in routes/ai.php.

Scope

• Apps with no MCP setup get the same servers, tools, and abilities as before.
• The existing mcp.enabled and mcp.web flags still turn registration off.
• No new tools. No tag or release in this PR.

Tradeoffs

A config key that names the host server class was the other option. It still has the package own the route, so the host would not own its server. Detection needs no config, and the existing flags stay as the explicit switch.

Blast Radius

The package routes now register in a booted callback, not in boot. Code that looks up /mcp/lms from another provider's boot method would no longer find it. The package now defines the mcp rate limiter even with mcp.web off, unless the app defined it first.

Verification

• vendor/bin/pest: 310 tests, 305 pass, 5 skipped (the same 5 skip on 4.x). The new LmsMcpHostServerTest checks over HTTP that a host server on /mcp/lms serves its own tools. The test fails when the skip check is removed.
• vendor/bin/pint and composer analyse (PHPStan) pass.
• CHECK-LMS uses this branch for its own server, with end-to-end MCP calls (linked from the CHECK-LMS PR).

---

Note

Medium Risk
MCP routes and stdio registration now happen in a booted callback instead of during provider boot, and HTTP MCP remains behind Sanctum and LMS-admin middleware.

Overview
Host applications can now compose LMS MCP tools into their own MCP server instead of being limited to the package’s fixed LmsServer tool list.

LmsServer::TOOLS is a public constant listing every LMS tool class; host servers spread it into $tools and add app-specific tools. HasSanctumAbilities centralizes sanctumAbilities() so combined servers (and LmsServer) can expose Filament Sanctum checkbox labels for all registered tools.

MCP registration is deferred until after all providers boot (app->booted), so routes/ai.php can claim the filament-lms stdio handle or mcp/lms web path first; the package skips registering its own server when those slots are already taken. The mcp rate limiter is registered whenever the package boots MCP support (unless the app defined it first), including when mcp.web is false. README and config comments document the host-server pattern.

LmsMcpHostServerTest verifies default package registration, host override on the same handle/path (HTTP tools/list includes host + LMS tools), config opt-out, and HasSanctumAbilities on a host server.

^{Reviewed by Cursor Bugbot for commit 8c840e5. Bugbot is set up for automated code reviews on this repo. Configure here.}