Feature Flags

Feature flags control which system capabilities are available. All flags default to true. Setting a flag to false removes the capability entirely — the tool is not registered, not visible to the LLM, and returns 403 via the HTTP API or an error via MCP.

Configuration

Add a features object to your nimblebrain.json:

{
  "features": {
    "bundleManagement": true,
    "skillManagement": true,
    "delegation": true,
    "toolDiscovery": true,
    "bundleDiscovery": true,
    "mcpServer": true,
    "fileContext": true,
    "userManagement": true,
    "workspaceManagement": true
  }
}

Omitted flags default to true. You only need to include flags you want to disable.

Flag reference

Flag	Default	Controls	Tool(s) affected
`bundleManagement`	`true`	Install, uninstall, and configure bundles	`nb__manage_app`
`skillManagement`	`true`	Create, edit, and delete user skills	`nb__manage_skill`
`delegation`	`true`	Multi-agent sub-task delegation	`nb__delegate`
`toolDiscovery`	`true`	Search installed tools by keyword	`nb__search` (`scope: "tools"`)
`bundleDiscovery`	`true`	Search the mpak registry for bundles	`nb__search` (`scope: "registry"`)
`mcpServer`	`true`	Expose the platform as an MCP server	`/mcp` endpoint
`fileContext`	`true`	File upload and context extraction	File processing pipeline
`userManagement`	`true`	Create and delete users	`nb__manage_users`
`workspaceManagement`	`true`	CRUD workspaces and manage members	`nb__manage_workspaces`, `nb__manage_members`

Always-enabled tools

Read-only tools are never gated by feature flags:

nb__status — platform status; use scope: "bundles" for per-app health, scope: "skills" for loaded skills, scope: "config" for runtime configuration
nb__list_apps — list installed apps
nb__get_config — get runtime configuration

Enforcement

Feature flags are enforced at three layers:

Tool registry — disabled tools are excluded at startup and never visible to the LLM
HTTP API — POST /v1/tools/call returns 403 for disabled tools
MCP server — ListTools filters out disabled tools, CallTool rejects them