Filtered tools cannot be used in vMCP composite tool steps

[danbarr]

Bug description

Tools that are filtered out of a backend MCP server using config.aggregation.tools cannot be used in composite tool steps.

My use case is, I want to hide the individual tools which are used by the composite tool to better control the workflow. In a lot of cases, the LLM is still trying to use the underlying tools unless I specifically guide it to the composite tool.

But if I apply filters such that the tools used by the composite are filtered out, I get a "failed to route tool ... tool not found" error. Removing the filtering config, the composite tool functions as expected.

Steps to reproduce

Given the following vMCP configuration using the arxiv server, which is the example from the docs, the research_topic tool cannot run and throws an error:

Workflow execution failed: level execution failed: failed to route tool arxiv_search_papers in step search: tool not found: arxiv_search_papers

apiVersion: toolhive.stacklok.dev/v1alpha1
kind: VirtualMCPServer
metadata:
  name: vmcp-research
  namespace: toolhive-system
spec:
  config:
    groupRef: research-tools
    aggregation:
      conflictResolution: prefix
      conflictResolutionConfig:
        prefixFormat: "{workload}_"
      tools:
        - workload: arxiv
          filter:
            # This tool isn't used by the composite tool, so let clients see it
            - "list_papers"
    compositeTools:
      - name: research_topic
        description: Search arXiv for papers and read the top result
        parameters:
          type: object
          properties:
            query:
              type: string
              description: Research topic to search for
          required:
            - query
        steps:
          # Step 1: Search arXiv for papers matching the query
          - id: search
            tool: arxiv_search_papers
            arguments:
              query: '{{.params.query}}'
              max_results: 1
          # Step 2: Download the paper (required before reading)
          # Note: fromJson is needed when the MCP server returns JSON as text
          # rather than structured content. This is common for servers that
          # don't fully support MCP's structuredContent field.
          - id: download
            tool: arxiv_download_paper
            arguments:
              paper_id:
                '{{(index (fromJson .steps.search.output.text).papers 0).id}}'
            dependsOn: [search]
          # Step 3: Read the downloaded paper content
          - id: read
            tool: arxiv_read_paper
            arguments:
              paper_id:
                '{{(index (fromJson .steps.search.output.text).papers 0).id}}'
            dependsOn: [download]
  incomingAuth:
    type: anonymous

Expected behavior

The composite tool should still be able to use the backend tools even though they're filtered out for downstream clients.

Actual behavior

The composite tool can't use the backend toos and produces the error above.

Environment (if relevant)

• Operator and CRDs version: 0.9.1

Additional context

The MCPGroup and MCPServer to go along with the example:

apiVersion: toolhive.stacklok.dev/v1alpha1
kind: MCPGroup
metadata:
  name: research-tools
  namespace: toolhive-system
spec:
  description: Group for vMCP research workflow tools
---
apiVersion: toolhive.stacklok.dev/v1alpha1
kind: MCPServer
metadata:
  name: arxiv
  namespace: toolhive-system
spec:
  image: ghcr.io/stacklok/dockyard/uvx/arxiv-mcp-server:0.3.2
  groupRef: research-tools
  transport: stdio
  proxyPort: 8080
  proxyMode: streamable-http
  env:
    - name: ARXIV_STORAGE_PATH
      value: /arxiv-papers
  podTemplateSpec:
    spec:
      volumes:
        - name: arxiv-papers
          emptyDir: {}
      containers:
        - name: mcp
          volumeMounts:
            - name: arxiv-papers
              mountPath: /arxiv-papers