One MCP endpoint fronting four backends: two plain MCP servers and two deployed assistants. Exposure is pinned, so a curated set of tools sits inline while the full surface stays discoverable at call time.
Prefixing solves collisions. Both MCP servers ship a health and a ready tool. Merged into one list those names would fight. The namespace makes cafe_ready and roastery_ready distinct, addressable routes.
Pinning solves attention, not access. The four order lifecycle tools sit inline because they are the agent surface. The probes stay off the pinned list because they are operator surface, but they remain fully discoverable through search_tools and callable through invoke_tool.
If something must be unreachable, that belongs in a tool_allowlist on the backend attachment. The pinned list is a curation, not a security boundary.