Bug: [tools].disabled in config.toml does not filter MCP tools from the request

Summary

Setting [tools].disabled in config.toml (e.g. disabled = ["mcp__higgsfield__*"]) has no effect on MCP tools: they are still sent on the wire with every request. Filtering appears to happen before provider conversion, but MCP tools are merged in after that point.

Discovered while investigating #2328 (Anthropic 400 on top-level oneOf/anyOf/allOf MCP schemas) — this makes the global tool switch useless as a workaround for a single non-conforming MCP tool, since the only effective lever is per-server disabledTools in mcp.json.

Steps to reproduce

1. Configure an MCP server in mcp.json (e.g. Higgsfield).
2. Add to config.toml:

   [tools]
   disabled = ["mcp__higgsfield__*"]
   

3. Start a session and inspect the outgoing request (wire log) → the MCP tools are still present in the tools array.

Expected

[tools].disabled patterns apply to MCP tools too, removing them from the request payload sent to the provider.

Environment

• kimi-code 0.29.2
• Linux (WSL2, Ubuntu 24.04)

Related: #2328

Start with the tool-filtering path described in the issue and trace where MCP tools are merged after provider conversion. Reproduce with config.toml's [tools].disabled pattern and an MCP server from mcp.json, then verify in the wire log that matching MCP tools are absent from the provider request.