diff --git a/docs/server-configuration.md b/docs/server-configuration.md
index 87d48e01e..693c096a1 100644
--- a/docs/server-configuration.md
+++ b/docs/server-configuration.md
@@ -14,6 +14,7 @@ We currently support the following ways in which the GitHub MCP Server can be co
 | Dynamic Mode | Not available | `--dynamic-toolsets` flag or `GITHUB_DYNAMIC_TOOLSETS` env var |
 | Lockdown Mode | `X-MCP-Lockdown` header | `--lockdown-mode` flag or `GITHUB_LOCKDOWN_MODE` env var |
 | Insiders Mode | `X-MCP-Insiders` header or `/insiders` URL | `--insiders` flag or `GITHUB_INSIDERS` env var |
+| Feature Flags | `X-MCP-Features` header | `--features` flag |
 | Scope Filtering | Always enabled | Always enabled |
 | Server Name/Title | Not available | `GITHUB_MCP_SERVER_NAME` / `GITHUB_MCP_SERVER_TITLE` env vars or `github-mcp-server-config.json` |
 
@@ -390,7 +391,7 @@ Lockdown mode ensures the server only surfaces content in public repositories fr
 
 **Best for:** Users who want early access to experimental features and new tools before they reach general availability.
 
-Insiders Mode unlocks experimental features, such as [MCP Apps](./insiders-features.md#mcp-apps) support. We created this mode to have a way to roll out experimental features and collect feedback. So if you are using Insiders, please don't hesitate to share your feedback with us! Features in Insiders Mode may change, evolve, or be removed based on user feedback. 
+Insiders Mode unlocks experimental features, such as [MCP Apps](#mcp-apps) support. We created this mode to have a way to roll out experimental features and collect feedback. So if you are using Insiders, please don't hesitate to share your feedback with us! Features in Insiders Mode may change, evolve, or be removed based on user feedback.
 
 <table>
 <tr><th>Remote Server</th><th>Local Server</th></tr>
@@ -443,6 +444,62 @@ See [Insiders Features](./insiders-features.md) for a full list of what's availa
 
 ---
 
+### MCP Apps
+
+[MCP Apps](https://modelcontextprotocol.io/docs/extensions/apps) is an extension to the Model Context Protocol that enables servers to deliver interactive user interfaces to end users. Instead of returning plain text that the LLM must interpret and relay, tools can render forms, profiles, and dashboards right in the chat.
+
+MCP Apps is enabled by [Insiders Mode](#insiders-mode), or independently via the `remote_mcp_ui_apps` feature flag.
+
+**Supported tools:**
+
+| Tool | Description |
+|------|-------------|
+| `get_me` | Displays your GitHub user profile with avatar, bio, and stats in a rich card |
+| `issue_write` | Opens an interactive form to create or update issues |
+| `create_pull_request` | Provides a full PR creation form to create a pull request (or a draft pull request) |
+
+**Client requirements:** MCP Apps requires a host that supports the [MCP Apps extension](https://modelcontextprotocol.io/docs/extensions/apps). Currently tested with VS Code (`chat.mcp.apps.enabled` setting).
+
+<table>
+<tr><th>Remote Server</th><th>Local Server</th></tr>
+<tr valign="top">
+<td>
+
+```json
+{
+  "type": "http",
+  "url": "https://api.githubcopilot.com/mcp/",
+  "headers": {
+    "X-MCP-Features": "remote_mcp_ui_apps"
+  }
+}
+```
+
+</td>
+<td>
+
+```json
+{
+  "type": "stdio",
+  "command": "go",
+  "args": [
+    "run",
+    "./cmd/github-mcp-server",
+    "stdio",
+    "--features=remote_mcp_ui_apps"
+  ],
+  "env": {
+    "GITHUB_PERSONAL_ACCESS_TOKEN": "${input:github_token}"
+  }
+}
+```
+
+</td>
+</tr>
+</table>
+
+---
+
 ### Scope Filtering
 
 **Automatic feature:** The server handles OAuth scopes differently depending on authentication type:
diff --git a/internal/ghmcp/server.go b/internal/ghmcp/server.go
index 5dfaf596c..3f81ac3f7 100644
--- a/internal/ghmcp/server.go
+++ b/internal/ghmcp/server.go
@@ -114,8 +114,8 @@ func NewStdioMCPServer(ctx context.Context, cfg github.MCPServerConfig) (*mcp.Se
 		return nil, fmt.Errorf("failed to create GitHub clients: %w", err)
 	}
 
-	// Create feature checker
-	featureChecker := createFeatureChecker(cfg.EnabledFeatures)
+	// Create feature checker — resolves explicit features + insiders expansion
+	featureChecker := createFeatureChecker(cfg.EnabledFeatures, cfg.InsidersMode)
 
 	// Create dependencies for tool handlers
 	obs, err := observability.NewExporters(cfg.Logger, metrics.NewNoopMetrics())
@@ -144,8 +144,7 @@ func NewStdioMCPServer(ctx context.Context, cfg github.MCPServerConfig) (*mcp.Se
 		WithTools(github.CleanTools(cfg.EnabledTools)).
 		WithExcludeTools(cfg.ExcludeTools).
 		WithServerInstructions().
-		WithFeatureChecker(featureChecker).
-		WithInsidersMode(cfg.InsidersMode)
+		WithFeatureChecker(featureChecker)
 
 	// Apply token scope filtering if scopes are known (for PAT filtering)
 	if cfg.TokenScopes != nil {
@@ -162,10 +161,12 @@ func NewStdioMCPServer(ctx context.Context, cfg github.MCPServerConfig) (*mcp.Se
 		return nil, fmt.Errorf("failed to create GitHub MCP server: %w", err)
 	}
 
-	// Register MCP App UI resources if available (requires running script/build-ui).
-	// We check availability to allow Insiders mode to work for non-UI features
-	// even when UI assets haven't been built.
-	if cfg.InsidersMode && github.UIAssetsAvailable() {
+	// Register MCP App UI resources if the remote_mcp_ui_apps feature flag is enabled
+	// and UI assets are available (requires running script/build-ui).
+	// We check availability to allow the feature flag to be enabled without
+	// requiring a UI build (graceful degradation).
+	mcpAppsEnabled, _ := featureChecker(context.Background(), github.MCPAppsFeatureFlag)
+	if mcpAppsEnabled && github.UIAssetsAvailable() {
 		github.RegisterUIResources(ghServer)
 	}
 
@@ -334,15 +335,11 @@ func RunStdioServer(cfg StdioServerConfig) error {
 	return nil
 }
 
-// createFeatureChecker returns a FeatureFlagChecker that checks if a flag name
-// is present in the provided list of enabled features. For the local server,
-// this is populated from the --features CLI flag.
-func createFeatureChecker(enabledFeatures []string) inventory.FeatureFlagChecker {
-	// Build a set for O(1) lookup
-	featureSet := make(map[string]bool, len(enabledFeatures))
-	for _, f := range enabledFeatures {
-		featureSet[f] = true
-	}
+// createFeatureChecker returns a FeatureFlagChecker that resolves features
+// using the centralized ResolveFeatureFlags function. For the local server,
+// features are resolved once at startup from --features CLI flag + insiders mode.
+func createFeatureChecker(enabledFeatures []string, insidersMode bool) inventory.FeatureFlagChecker {
+	featureSet := github.ResolveFeatureFlags(enabledFeatures, insidersMode)
 	return func(_ context.Context, flagName string) (bool, error) {
 		return featureSet[flagName], nil
 	}
diff --git a/pkg/github/feature_flags.go b/pkg/github/feature_flags.go
index fd06a659b..cfb6c1e65 100644
--- a/pkg/github/feature_flags.go
+++ b/pkg/github/feature_flags.go
@@ -1,7 +1,54 @@
 package github
 
+// MCPAppsFeatureFlag is the feature flag name for MCP Apps (interactive UI forms).
+const MCPAppsFeatureFlag = "remote_mcp_ui_apps"
+
+// AllowedFeatureFlags is the allowlist of feature flags that can be enabled
+// by users via --features CLI flag or X-MCP-Features HTTP header.
+// Only flags in this list are accepted; unknown flags are silently ignored.
+// This is the single source of truth for which flags are user-controllable.
+var AllowedFeatureFlags = []string{
+	MCPAppsFeatureFlag,
+}
+
+// InsidersFeatureFlags is the list of feature flags that insiders mode enables.
+// When insiders mode is active, all flags in this list are treated as enabled.
+// This is the single source of truth for what "insiders" means in terms of
+// feature flag expansion.
+var InsidersFeatureFlags = []string{
+	MCPAppsFeatureFlag,
+}
+
 // FeatureFlags defines runtime feature toggles that adjust tool behavior.
 type FeatureFlags struct {
 	LockdownMode bool
 	InsidersMode bool
 }
+
+// ResolveFeatureFlags computes the effective set of enabled feature flags by:
+//  1. Taking explicitly enabled features (from CLI flags or HTTP headers)
+//  2. Adding insiders-expanded features when insiders mode is active
+//  3. Validating all features against the AllowedFeatureFlags allowlist
+//
+// Returns a set (map) for O(1) lookup by the feature checker.
+func ResolveFeatureFlags(enabledFeatures []string, insidersMode bool) map[string]bool {
+	allowed := make(map[string]bool, len(AllowedFeatureFlags))
+	for _, f := range AllowedFeatureFlags {
+		allowed[f] = true
+	}
+
+	effective := make(map[string]bool)
+	for _, f := range enabledFeatures {
+		if allowed[f] {
+			effective[f] = true
+		}
+	}
+	if insidersMode {
+		for _, f := range InsidersFeatureFlags {
+			if allowed[f] {
+				effective[f] = true
+			}
+		}
+	}
+	return effective
+}
diff --git a/pkg/github/feature_flags_test.go b/pkg/github/feature_flags_test.go
index 0f08c4f12..b0c1a4305 100644
--- a/pkg/github/feature_flags_test.go
+++ b/pkg/github/feature_flags_test.go
@@ -136,6 +136,70 @@ func TestHelloWorld_ConditionalBehavior_Featureflag(t *testing.T) {
 	}
 }
 
+func TestResolveFeatureFlags(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name            string
+		enabledFeatures []string
+		insidersMode    bool
+		expectedFlags   []string
+		unexpectedFlags []string
+	}{
+		{
+			name:            "no features, no insiders",
+			enabledFeatures: nil,
+			insidersMode:    false,
+			expectedFlags:   nil,
+			unexpectedFlags: []string{MCPAppsFeatureFlag},
+		},
+		{
+			name:            "explicit feature enabled",
+			enabledFeatures: []string{MCPAppsFeatureFlag},
+			insidersMode:    false,
+			expectedFlags:   []string{MCPAppsFeatureFlag},
+		},
+		{
+			name:            "insiders mode enables insiders flags",
+			enabledFeatures: nil,
+			insidersMode:    true,
+			expectedFlags:   InsidersFeatureFlags,
+		},
+		{
+			name:            "unknown flags are filtered out",
+			enabledFeatures: []string{"unknown_flag", "another_unknown"},
+			insidersMode:    false,
+			unexpectedFlags: []string{"unknown_flag", "another_unknown"},
+		},
+		{
+			name:            "mix of known and unknown flags",
+			enabledFeatures: []string{MCPAppsFeatureFlag, "unknown_flag"},
+			insidersMode:    false,
+			expectedFlags:   []string{MCPAppsFeatureFlag},
+			unexpectedFlags: []string{"unknown_flag"},
+		},
+		{
+			name:            "explicit plus insiders deduplicates",
+			enabledFeatures: []string{MCPAppsFeatureFlag},
+			insidersMode:    true,
+			expectedFlags:   []string{MCPAppsFeatureFlag},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			result := ResolveFeatureFlags(tt.enabledFeatures, tt.insidersMode)
+			for _, flag := range tt.expectedFlags {
+				assert.True(t, result[flag], "expected flag %q to be enabled", flag)
+			}
+			for _, flag := range tt.unexpectedFlags {
+				assert.False(t, result[flag], "expected flag %q to not be enabled", flag)
+			}
+		})
+	}
+}
+
 func TestHelloWorld_ConditionalBehavior_Config(t *testing.T) {
 	t.Parallel()
 
diff --git a/pkg/github/issues.go b/pkg/github/issues.go
index 05af64cab..0e20393f3 100644
--- a/pkg/github/issues.go
+++ b/pkg/github/issues.go
@@ -1073,12 +1073,12 @@ Options are:
 				return utils.NewToolResultError(err.Error()), nil, nil
 			}
 
-			// When insiders mode is enabled and the client supports MCP Apps UI,
+			// When the MCP Apps feature flag is enabled and the client supports MCP Apps UI,
 			// check if this is a UI form submission. The UI sends _ui_submitted=true
 			// to distinguish form submissions from LLM calls.
 			uiSubmitted, _ := OptionalParam[bool](args, "_ui_submitted")
 
-			if deps.GetFlags(ctx).InsidersMode && clientSupportsUI(ctx, req) && !uiSubmitted {
+			if deps.IsFeatureEnabled(ctx, MCPAppsFeatureFlag) && clientSupportsUI(ctx, req) && !uiSubmitted {
 				if method == "update" {
 					// Skip the UI form when a state change is requested because
 					// the form only handles title/body editing and would lose the
diff --git a/pkg/github/issues_test.go b/pkg/github/issues_test.go
index d06721be7..24d42f1cc 100644
--- a/pkg/github/issues_test.go
+++ b/pkg/github/issues_test.go
@@ -932,9 +932,9 @@ func Test_CreateIssue(t *testing.T) {
 	}
 }
 
-// Test_IssueWrite_InsidersMode_UIGate verifies the insiders mode UI gate
+// Test_IssueWrite_MCPApps_UIGate verifies the MCP Apps feature flag UI gate
 // behavior: UI clients get a form message, non-UI clients execute directly.
-func Test_IssueWrite_InsidersMode_UIGate(t *testing.T) {
+func Test_IssueWrite_MCPApps_UIGate(t *testing.T) {
 	t.Parallel()
 
 	mockIssue := &github.Issue{
@@ -949,11 +949,17 @@ func Test_IssueWrite_InsidersMode_UIGate(t *testing.T) {
 		PostReposIssuesByOwnerByRepo: mockResponse(t, http.StatusCreated, mockIssue),
 	}))
 
-	deps := BaseDeps{
-		Client:    client,
-		GQLClient: githubv4.NewClient(nil),
-		Flags:     FeatureFlags{InsidersMode: true},
+	mcpAppsChecker := func(_ context.Context, flag string) (bool, error) {
+		return flag == MCPAppsFeatureFlag, nil
 	}
+	deps := NewBaseDeps(
+		client, githubv4.NewClient(nil), nil, nil,
+		translations.NullTranslationHelper,
+		FeatureFlags{},
+		0,
+		mcpAppsChecker,
+		stubExporters(),
+	)
 	handler := serverTool.Handler(deps)
 
 	t.Run("UI client without _ui_submitted returns form message", func(t *testing.T) {
@@ -1066,11 +1072,14 @@ func Test_IssueWrite_InsidersMode_UIGate(t *testing.T) {
 			),
 		))
 
-		closeDeps := BaseDeps{
-			Client:    closeClient,
-			GQLClient: closeGQLClient,
-			Flags:     FeatureFlags{InsidersMode: true},
-		}
+		closeDeps := NewBaseDeps(
+			closeClient, closeGQLClient, nil, nil,
+			translations.NullTranslationHelper,
+			FeatureFlags{},
+			0,
+			mcpAppsChecker,
+			stubExporters(),
+		)
 		closeHandler := serverTool.Handler(closeDeps)
 
 		request := createMCPRequestWithSession(t, ClientNameVSCodeInsiders, true, map[string]any{
diff --git a/pkg/github/pullrequests.go b/pkg/github/pullrequests.go
index 731db4931..69c02f159 100644
--- a/pkg/github/pullrequests.go
+++ b/pkg/github/pullrequests.go
@@ -601,12 +601,12 @@ func CreatePullRequest(t translations.TranslationHelperFunc) inventory.ServerToo
 				return utils.NewToolResultError(err.Error()), nil, nil
 			}
 
-			// When insiders mode is enabled and the client supports MCP Apps UI,
+			// When the MCP Apps feature flag is enabled and the client supports MCP Apps UI,
 			// check if this is a UI form submission. The UI sends _ui_submitted=true
 			// to distinguish form submissions from LLM calls.
 			uiSubmitted, _ := OptionalParam[bool](args, "_ui_submitted")
 
-			if deps.GetFlags(ctx).InsidersMode && clientSupportsUI(ctx, req) && !uiSubmitted {
+			if deps.IsFeatureEnabled(ctx, MCPAppsFeatureFlag) && clientSupportsUI(ctx, req) && !uiSubmitted {
 				return utils.NewToolResultText(fmt.Sprintf("Ready to create a pull request in %s/%s. IMPORTANT: The PR has NOT been created yet. Do NOT tell the user the PR was created. The user MUST click Submit in the form to create it.", owner, repo)), nil, nil
 			}
 
diff --git a/pkg/github/pullrequests_test.go b/pkg/github/pullrequests_test.go
index 801122dca..0febb2fc4 100644
--- a/pkg/github/pullrequests_test.go
+++ b/pkg/github/pullrequests_test.go
@@ -2312,9 +2312,9 @@ func Test_CreatePullRequest(t *testing.T) {
 	}
 }
 
-// Test_CreatePullRequest_InsidersMode_UIGate verifies the insiders mode UI gate
+// Test_CreatePullRequest_MCPApps_UIGate verifies the MCP Apps feature flag UI gate
 // behavior: UI clients get a form message, non-UI clients execute directly.
-func Test_CreatePullRequest_InsidersMode_UIGate(t *testing.T) {
+func Test_CreatePullRequest_MCPApps_UIGate(t *testing.T) {
 	t.Parallel()
 
 	mockPR := &github.PullRequest{
@@ -2332,11 +2332,17 @@ func Test_CreatePullRequest_InsidersMode_UIGate(t *testing.T) {
 		PostReposPullsByOwnerByRepo: mockResponse(t, http.StatusCreated, mockPR),
 	}))
 
-	deps := BaseDeps{
-		Client:    client,
-		GQLClient: githubv4.NewClient(nil),
-		Flags:     FeatureFlags{InsidersMode: true},
+	mcpAppsChecker := func(_ context.Context, flag string) (bool, error) {
+		return flag == MCPAppsFeatureFlag, nil
 	}
+	deps := NewBaseDeps(
+		client, githubv4.NewClient(nil), nil, nil,
+		translations.NullTranslationHelper,
+		FeatureFlags{},
+		0,
+		mcpAppsChecker,
+		stubExporters(),
+	)
 	handler := serverTool.Handler(deps)
 
 	t.Run("UI client without _ui_submitted returns form message", func(t *testing.T) {
diff --git a/pkg/http/handler.go b/pkg/http/handler.go
index 2e828211d..3d0fc4c68 100644
--- a/pkg/http/handler.go
+++ b/pkg/http/handler.go
@@ -253,7 +253,9 @@ func DefaultInventoryFactory(_ *ServerConfig, t translations.TranslationHelperFu
 }
 
 // InventoryFiltersForRequest applies filters to the inventory builder
-// based on the request context and headers
+// based on the request context and headers.
+// MCP Apps UI metadata is handled by the builder via the feature checker —
+// no need to check headers here.
 func InventoryFiltersForRequest(r *http.Request, builder *inventory.Builder) *inventory.Builder {
 	ctx := r.Context()
 
diff --git a/pkg/http/server.go b/pkg/http/server.go
index 55aed1c61..e373e7d8a 100644
--- a/pkg/http/server.go
+++ b/pkg/http/server.go
@@ -8,7 +8,6 @@ import (
 	"net/http"
 	"os"
 	"os/signal"
-	"slices"
 	"syscall"
 	"time"
 
@@ -25,10 +24,6 @@ import (
 	"github.com/go-chi/chi/v5"
 )
 
-// knownFeatureFlags are the feature flags that can be enabled via X-MCP-Features header.
-// Only these flags are accepted from headers.
-var knownFeatureFlags = []string{}
-
 type ServerConfig struct {
 	// Version of the server
 	Version string
@@ -211,19 +206,14 @@ func initGlobalToolScopeMap(t translations.TranslationHelperFunc) error {
 	return nil
 }
 
-// createHTTPFeatureChecker creates a feature checker that reads header features from context
-// and validates them against the knownFeatureFlags whitelist
+// createHTTPFeatureChecker creates a feature checker that resolves features
+// per-request by reading header features and insiders mode from context,
+// then validating against the centralized AllowedFeatureFlags allowlist.
 func createHTTPFeatureChecker() inventory.FeatureFlagChecker {
-	// Pre-compute whitelist as set for O(1) lookup
-	knownSet := make(map[string]bool, len(knownFeatureFlags))
-	for _, f := range knownFeatureFlags {
-		knownSet[f] = true
-	}
-
 	return func(ctx context.Context, flag string) (bool, error) {
-		if knownSet[flag] && slices.Contains(ghcontext.GetHeaderFeatures(ctx), flag) {
-			return true, nil
-		}
-		return false, nil
+		headerFeatures := ghcontext.GetHeaderFeatures(ctx)
+		insidersMode := ghcontext.IsInsidersMode(ctx)
+		effective := github.ResolveFeatureFlags(headerFeatures, insidersMode)
+		return effective[flag], nil
 	}
 }
diff --git a/pkg/inventory/builder.go b/pkg/inventory/builder.go
index d492e69b5..b9a0d8548 100644
--- a/pkg/inventory/builder.go
+++ b/pkg/inventory/builder.go
@@ -14,6 +14,11 @@ var (
 	ErrUnknownTools = errors.New("unknown tools specified in WithTools")
 )
 
+// mcpAppsFeatureFlag is the feature flag name that controls MCP Apps UI metadata.
+// This is defined here to avoid importing pkg/github (which imports pkg/inventory).
+// The value must match github.MCPAppsFeatureFlag.
+const mcpAppsFeatureFlag = "remote_mcp_ui_apps"
+
 // ToolFilter is a function that determines if a tool should be included.
 // Returns true if the tool should be included, false to exclude it.
 type ToolFilter func(ctx context.Context, tool *ServerTool) (bool, error)
@@ -48,7 +53,6 @@ type Builder struct {
 	featureChecker       FeatureFlagChecker
 	filters              []ToolFilter // filters to apply to all tools
 	generateInstructions bool
-	insidersMode         bool
 }
 
 // NewBuilder creates a new Builder.
@@ -154,15 +158,6 @@ func (b *Builder) WithExcludeTools(toolNames []string) *Builder {
 	return b
 }
 
-// WithInsidersMode enables or disables insiders mode features.
-// When insiders mode is disabled (default), UI metadata is removed from tools
-// so clients won't attempt to load UI resources.
-// Returns self for chaining.
-func (b *Builder) WithInsidersMode(enabled bool) *Builder {
-	b.insidersMode = enabled
-	return b
-}
-
 // CreateExcludeToolsFilter creates a ToolFilter that excludes tools by name.
 // Any tool whose name appears in the excluded list will be filtered out.
 // The input slice should already be cleaned (trimmed, deduplicated).
@@ -195,6 +190,19 @@ func cleanTools(tools []string) []string {
 	return cleaned
 }
 
+// checkFeatureFlag checks a feature flag at build time using the builder's feature checker.
+// Returns false if no checker is configured or the flag is not enabled.
+func (b *Builder) checkFeatureFlag(flag string) bool {
+	if b.featureChecker == nil {
+		return false
+	}
+	enabled, err := b.featureChecker(context.Background(), flag)
+	if err != nil {
+		return false
+	}
+	return enabled
+}
+
 // Build creates the final Inventory with all configuration applied.
 // This processes toolset filtering, tool name resolution, and sets up
 // the inventory for use. The returned Inventory is ready for use with
@@ -204,10 +212,13 @@ func cleanTools(tools []string) []string {
 // (i.e., they don't exist in the tool set and are not deprecated aliases).
 // This ensures invalid tool configurations fail fast at build time.
 func (b *Builder) Build() (*Inventory, error) {
-	// When insiders mode is disabled, strip insiders-only features from tools
 	tools := b.tools
-	if !b.insidersMode {
-		tools = stripInsidersFeatures(b.tools)
+
+	// When MCP Apps feature flag is not enabled, strip UI metadata from tools
+	// so clients won't attempt to load UI resources.
+	// The feature checker is the single source of truth for flag evaluation.
+	if !b.checkFeatureFlag(mcpAppsFeatureFlag) {
+		tools = stripMCPAppsMetadata(tools)
 	}
 
 	r := &Inventory{
@@ -375,24 +386,17 @@ func (b *Builder) processToolsets() (map[ToolsetID]bool, []string, []ToolsetID,
 	return enabledToolsets, unrecognized, allToolsetIDs, validIDs, defaultToolsetIDList, descriptions
 }
 
-// insidersOnlyMetaKeys lists the Meta keys that are only available in insiders mode.
-// Add new experimental feature keys here to have them automatically stripped
-// when insiders mode is disabled.
-var insidersOnlyMetaKeys = []string{
+// mcpAppsMetaKeys lists the Meta keys controlled by the remote_mcp_ui_apps feature flag.
+var mcpAppsMetaKeys = []string{
 	"ui", // MCP Apps UI metadata
 }
 
-// stripInsidersFeatures removes insiders-only features from tools.
-// This includes removing tools marked with InsidersOnly and stripping
-// Meta keys listed in insidersOnlyMetaKeys from remaining tools.
-func stripInsidersFeatures(tools []ServerTool) []ServerTool {
+// stripMCPAppsMetadata removes MCP Apps UI metadata from tools when the
+// remote_mcp_ui_apps feature flag is not enabled.
+func stripMCPAppsMetadata(tools []ServerTool) []ServerTool {
 	result := make([]ServerTool, 0, len(tools))
 	for _, tool := range tools {
-		// Skip tools marked as insiders-only
-		if tool.InsidersOnly {
-			continue
-		}
-		if stripped := stripInsidersMetaFromTool(tool); stripped != nil {
+		if stripped := stripMetaKeys(tool, mcpAppsMetaKeys); stripped != nil {
 			result = append(result, *stripped)
 		} else {
 			result = append(result, tool)
@@ -401,30 +405,30 @@ func stripInsidersFeatures(tools []ServerTool) []ServerTool {
 	return result
 }
 
-// stripInsidersMetaFromTool removes insiders-only Meta keys from a single tool.
+// stripMetaKeys removes the specified Meta keys from a single tool.
 // Returns a modified copy if changes were made, nil otherwise.
-func stripInsidersMetaFromTool(tool ServerTool) *ServerTool {
-	if tool.Tool.Meta == nil {
+func stripMetaKeys(tool ServerTool, keys []string) *ServerTool {
+	if tool.Tool.Meta == nil || len(keys) == 0 {
 		return nil
 	}
 
-	// Check if any insiders-only keys exist
-	hasInsidersKeys := false
-	for _, key := range insidersOnlyMetaKeys {
-		if tool.Tool.Meta[key] != nil {
-			hasInsidersKeys = true
+	// Check if any of the specified keys exist
+	hasKeys := false
+	for _, key := range keys {
+		if _, ok := tool.Tool.Meta[key]; ok {
+			hasKeys = true
 			break
 		}
 	}
-	if !hasInsidersKeys {
+	if !hasKeys {
 		return nil
 	}
 
-	// Make a shallow copy and remove insiders-only keys
+	// Make a shallow copy and remove specified keys
 	toolCopy := tool
 	newMeta := make(map[string]any, len(tool.Tool.Meta))
 	for k, v := range tool.Tool.Meta {
-		if !slices.Contains(insidersOnlyMetaKeys, k) {
+		if !slices.Contains(keys, k) {
 			newMeta[k] = v
 		}
 	}
diff --git a/pkg/inventory/registry_test.go b/pkg/inventory/registry_test.go
index 207e65dba..e6c9e450c 100644
--- a/pkg/inventory/registry_test.go
+++ b/pkg/inventory/registry_test.go
@@ -1723,6 +1723,10 @@ func TestFilteringOrder(t *testing.T) {
 		WithFeatureChecker(checker).
 		WithFilter(filter))
 
+	// Reset call order — Build() may call the checker for MCP Apps metadata.
+	// We're testing the AvailableTools filter order here.
+	callOrder = callOrder[:0]
+
 	_ = reg.AvailableTools(context.Background())
 
 	// Expected order: Enabled, FeatureFlag, ReadOnly (stops here because it's write tool)
@@ -1853,13 +1857,13 @@ func mockToolWithMeta(name string, toolsetID string, meta map[string]any) Server
 	)
 }
 
-func TestWithInsidersMode_DisabledStripsUIMetadata(t *testing.T) {
+func TestWithMCPApps_DisabledStripsUIMetadata(t *testing.T) {
 	toolWithUI := mockToolWithMeta("tool_with_ui", "toolset1", map[string]any{
 		"ui":          map[string]any{"html": "<div>hello</div>"},
 		"description": "kept",
 	})
 
-	// Default: insiders mode is disabled - UI meta should be stripped
+	// Default: MCP Apps is disabled - UI meta should be stripped
 	reg := mustBuild(t, NewBuilder().SetTools([]ServerTool{toolWithUI}).WithToolsets([]string{"all"}))
 	available := reg.AvailableTools(context.Background())
 
@@ -1874,24 +1878,27 @@ func TestWithInsidersMode_DisabledStripsUIMetadata(t *testing.T) {
 	}
 }
 
-func TestWithInsidersMode_EnabledPreservesUIMetadata(t *testing.T) {
+func TestWithMCPApps_EnabledPreservesUIMetadata(t *testing.T) {
 	uiData := map[string]any{"html": "<div>hello</div>"}
 	toolWithUI := mockToolWithMeta("tool_with_ui", "toolset1", map[string]any{
 		"ui":          uiData,
 		"description": "kept",
 	})
 
-	// Insiders mode enabled - UI meta should be preserved
+	// Feature checker enables MCP Apps - UI meta should be preserved
+	mcpAppsChecker := func(_ context.Context, flag string) (bool, error) {
+		return flag == mcpAppsFeatureFlag, nil
+	}
 	reg := mustBuild(t, NewBuilder().
 		SetTools([]ServerTool{toolWithUI}).
 		WithToolsets([]string{"all"}).
-		WithInsidersMode(true))
+		WithFeatureChecker(mcpAppsChecker))
 	available := reg.AvailableTools(context.Background())
 
 	require.Len(t, available, 1)
 	// UI metadata should be preserved
 	if available[0].Tool.Meta["ui"] == nil {
-		t.Errorf("Expected 'ui' meta to be preserved in insiders mode")
+		t.Errorf("Expected 'ui' meta to be preserved with MCP Apps enabled")
 	}
 	// Other metadata should also be preserved
 	if available[0].Tool.Meta["description"] != "kept" {
@@ -1899,48 +1906,14 @@ func TestWithInsidersMode_EnabledPreservesUIMetadata(t *testing.T) {
 	}
 }
 
-func TestWithInsidersMode_EnabledPreservesInsidersOnlyTools(t *testing.T) {
-	normalTool := mockTool("normal", "toolset1", true)
-	insidersTool := mockTool("insiders_only", "toolset1", true)
-	insidersTool.InsidersOnly = true
-
-	// With insiders mode enabled, both tools should be available
-	reg := mustBuild(t, NewBuilder().
-		SetTools([]ServerTool{normalTool, insidersTool}).
-		WithToolsets([]string{"all"}).
-		WithInsidersMode(true))
-	available := reg.AvailableTools(context.Background())
-
-	require.Len(t, available, 2)
-	names := []string{available[0].Tool.Name, available[1].Tool.Name}
-	require.Contains(t, names, "normal")
-	require.Contains(t, names, "insiders_only")
-}
-
-func TestWithInsidersMode_DisabledRemovesInsidersOnlyTools(t *testing.T) {
-	normalTool := mockTool("normal", "toolset1", true)
-	insidersTool := mockTool("insiders_only", "toolset1", true)
-	insidersTool.InsidersOnly = true
-
-	// With insiders mode disabled, insiders-only tool should be removed
-	reg := mustBuild(t, NewBuilder().
-		SetTools([]ServerTool{normalTool, insidersTool}).
-		WithToolsets([]string{"all"}).
-		WithInsidersMode(false))
-	available := reg.AvailableTools(context.Background())
-
-	require.Len(t, available, 1)
-	require.Equal(t, "normal", available[0].Tool.Name)
-}
-
-func TestWithInsidersMode_ToolsWithoutUIMetaUnaffected(t *testing.T) {
+func TestWithMCPApps_ToolsWithoutUIMetaUnaffected(t *testing.T) {
 	toolNoUI := mockToolWithMeta("tool_no_ui", "toolset1", map[string]any{
 		"description": "kept",
 		"version":     "1.0",
 	})
 	toolNilMeta := mockTool("tool_nil_meta", "toolset1", true)
 
-	// Test with insiders disabled
+	// Test with MCP Apps disabled (default) - non-UI meta should be unaffected
 	reg := mustBuild(t, NewBuilder().
 		SetTools([]ServerTool{toolNoUI, toolNilMeta}).
 		WithToolsets([]string{"all"}))
@@ -1973,8 +1946,8 @@ func TestWithInsidersMode_ToolsWithoutUIMetaUnaffected(t *testing.T) {
 	}
 }
 
-func TestWithInsidersMode_UIOnlyMetaBecomesNil(t *testing.T) {
-	// Tool with ONLY ui metadata - should become nil after stripping
+func TestWithMCPApps_UIOnlyMetaBecomesNil(t *testing.T) {
+	// Tool with ONLY ui metadata - should become nil after stripping when MCP Apps is disabled
 	toolUIOnly := mockToolWithMeta("tool_ui_only", "toolset1", map[string]any{
 		"ui": map[string]any{"html": "<div>hello</div>"},
 	})
@@ -1985,44 +1958,57 @@ func TestWithInsidersMode_UIOnlyMetaBecomesNil(t *testing.T) {
 	available := reg.AvailableTools(context.Background())
 
 	require.Len(t, available, 1)
-	// Meta should be nil since ui was the only key
+	// Meta should be nil since ui was the only key and MCP Apps is off by default
 	if available[0].Tool.Meta != nil {
 		t.Errorf("Expected Meta to be nil after stripping only key, got %v", available[0].Tool.Meta)
 	}
 }
 
-func TestStripInsidersMetaFromTool(t *testing.T) {
+func TestStripMetaKeys(t *testing.T) {
 	tests := []struct {
 		name         string
 		meta         map[string]any
+		keys         []string
 		expectChange bool
 		expectedMeta map[string]any // nil means Meta should be nil
 	}{
 		{
 			name:         "nil meta - no change",
 			meta:         nil,
+			keys:         mcpAppsMetaKeys,
 			expectChange: false,
 		},
 		{
-			name:         "no insiders keys - no change",
+			name:         "no matching keys - no change",
 			meta:         map[string]any{"description": "test", "version": "1.0"},
+			keys:         mcpAppsMetaKeys,
 			expectChange: false,
 		},
 		{
 			name:         "ui key only - becomes nil",
 			meta:         map[string]any{"ui": "data"},
+			keys:         mcpAppsMetaKeys,
 			expectChange: true,
 			expectedMeta: nil,
 		},
 		{
 			name:         "ui key with other keys - ui stripped",
 			meta:         map[string]any{"ui": "data", "description": "kept"},
+			keys:         mcpAppsMetaKeys,
 			expectChange: true,
 			expectedMeta: map[string]any{"description": "kept"},
 		},
 		{
-			name:         "ui is nil value - no change (nil value means key not present)",
+			name:         "ui is nil value - ui stripped",
 			meta:         map[string]any{"ui": nil, "description": "kept"},
+			keys:         mcpAppsMetaKeys,
+			expectChange: true,
+			expectedMeta: map[string]any{"description": "kept"},
+		},
+		{
+			name:         "empty keys list - no change",
+			meta:         map[string]any{"ui": "data"},
+			keys:         []string{},
 			expectChange: false,
 		},
 	}
@@ -2030,7 +2016,7 @@ func TestStripInsidersMetaFromTool(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			tool := mockToolWithMeta("test", "toolset1", tt.meta)
-			result := stripInsidersMetaFromTool(tool)
+			result := stripMetaKeys(tool, tt.keys)
 
 			if tt.expectChange {
 				require.NotNil(t, result, "expected change but got nil")
@@ -2050,14 +2036,14 @@ func TestStripInsidersMetaFromTool(t *testing.T) {
 	}
 }
 
-func TestStripInsidersFeatures(t *testing.T) {
+func TestStripMCPAppsMetadata(t *testing.T) {
 	tools := []ServerTool{
 		mockToolWithMeta("tool1", "toolset1", map[string]any{"ui": "data"}),
 		mockToolWithMeta("tool2", "toolset1", map[string]any{"description": "kept"}),
 		mockTool("tool3", "toolset1", true), // nil meta
 	}
 
-	result := stripInsidersFeatures(tools)
+	result := stripMCPAppsMetadata(tools)
 
 	require.Len(t, result, 3)
 
@@ -2072,33 +2058,9 @@ func TestStripInsidersFeatures(t *testing.T) {
 	require.Nil(t, result[2].Tool.Meta)
 }
 
-func TestStripInsidersFeatures_RemovesInsidersOnlyTools(t *testing.T) {
-	// Create tools: one normal, one insiders-only, one normal
-	normalTool1 := mockTool("normal1", "toolset1", true)
-	insidersTool := mockTool("insiders_only", "toolset1", true)
-	insidersTool.InsidersOnly = true
-	normalTool2 := mockTool("normal2", "toolset1", true)
-
-	tools := []ServerTool{normalTool1, insidersTool, normalTool2}
-
-	result := stripInsidersFeatures(tools)
-
-	// Should only have 2 tools (insiders-only tool filtered out)
-	require.Len(t, result, 2)
-	require.Equal(t, "normal1", result[0].Tool.Name)
-	require.Equal(t, "normal2", result[1].Tool.Name)
-}
-
-func TestInsidersOnlyMetaKeys_FutureAdditions(t *testing.T) {
+func TestStripMetaKeys_MultipleKeys(t *testing.T) {
 	// This test verifies the mechanism works for multiple keys
-	// If we add new experimental keys to insidersOnlyMetaKeys, they should be stripped
-
-	// Save original and restore after test
-	originalKeys := insidersOnlyMetaKeys
-	defer func() { insidersOnlyMetaKeys = originalKeys }()
-
-	// Add a hypothetical future experimental key
-	insidersOnlyMetaKeys = []string{"ui", "experimental_feature", "beta"}
+	keys := []string{"ui", "experimental_feature", "beta"}
 
 	tool := mockToolWithMeta("test", "toolset1", map[string]any{
 		"ui":                   "ui data",
@@ -2107,7 +2069,7 @@ func TestInsidersOnlyMetaKeys_FutureAdditions(t *testing.T) {
 		"description":          "kept",
 	})
 
-	result := stripInsidersMetaFromTool(tool)
+	result := stripMetaKeys(tool, keys)
 
 	require.NotNil(t, result)
 	require.NotNil(t, result.Tool.Meta)
@@ -2117,12 +2079,12 @@ func TestInsidersOnlyMetaKeys_FutureAdditions(t *testing.T) {
 	require.Equal(t, "kept", result.Tool.Meta["description"], "description should be preserved")
 }
 
-func TestWithInsidersMode_DoesNotMutateOriginalTools(t *testing.T) {
+func TestWithMCPApps_DoesNotMutateOriginalTools(t *testing.T) {
 	originalMeta := map[string]any{"ui": "data", "description": "kept"}
 	tool := mockToolWithMeta("test", "toolset1", originalMeta)
 	tools := []ServerTool{tool}
 
-	// Build with insiders disabled - should strip ui
+	// Build with MCP Apps disabled (default) - should strip ui
 	_ = mustBuild(t, NewBuilder().SetTools(tools).WithToolsets([]string{"all"}))
 
 	// Original tool should be unchanged
diff --git a/pkg/inventory/server_tool.go b/pkg/inventory/server_tool.go
index b08ae1f01..752a4c2bd 100644
--- a/pkg/inventory/server_tool.go
+++ b/pkg/inventory/server_tool.go
@@ -82,10 +82,6 @@ type ServerTool struct {
 	// This includes the required scopes plus any higher-level scopes that provide
 	// the necessary permissions due to scope hierarchy.
 	AcceptedScopes []string
-
-	// InsidersOnly marks this tool as only available when insiders mode is enabled.
-	// When insiders mode is disabled, tools with this flag set are completely omitted.
-	InsidersOnly bool
 }
 
 // IsReadOnly returns true if this tool is marked as read-only via annotations.