Every tool the server exposes and the scope each one needs.
Each tool calls one Store API endpoint with the same inputs, so the endpoint pages double as tool documentation. Tools whose scope the key lacks are not listed to the assistant at all.
A failed tool call returns a normal result with isError: true and text such as permission_denied: API key does not have products:write permission, so the assistant can explain the problem or try something else.