diff --git a/veilid-core/src/network_manager/mod.rs b/veilid-core/src/network_manager/mod.rs
index bc9277cb..b0c77c8d 100644
--- a/veilid-core/src/network_manager/mod.rs
+++ b/veilid-core/src/network_manager/mod.rs
@@ -528,6 +528,12 @@ impl NetworkManager {
         if will_validate_dial_info && !c.capabilities.disable.contains(&CAP_WILL_VALIDATE_DIAL_INFO) {
             capabilities.push(CAP_WILL_VALIDATE_DIAL_INFO);
         }
+        if !c.capabilities.disable.contains(&CAP_WILL_DHT) {
+            capabilities.push(CAP_WILL_DHT);
+        }
+        if !c.capabilities.disable.contains(&CAP_WILL_APPMESSAGE) {
+            capabilities.push(CAP_WILL_APPMESSAGE);
+        }
 
         PublicInternetNodeStatus {
             capabilities
@@ -556,6 +562,12 @@ impl NetworkManager {
         if will_validate_dial_info && !c.capabilities.disable.contains(&CAP_WILL_VALIDATE_DIAL_INFO)  {
             capabilities.push(CAP_WILL_VALIDATE_DIAL_INFO);
         }
+        if !c.capabilities.disable.contains(&CAP_WILL_DHT) {
+            capabilities.push(CAP_WILL_DHT);
+        }
+        if !c.capabilities.disable.contains(&CAP_WILL_APPMESSAGE) {
+            capabilities.push(CAP_WILL_APPMESSAGE);
+        }
         LocalNetworkNodeStatus {
             capabilities
         }
diff --git a/veilid-core/src/routing_table/types/node_status.rs b/veilid-core/src/routing_table/types/node_status.rs
index 2ab2b5b4..c8abe079 100644
--- a/veilid-core/src/routing_table/types/node_status.rs
+++ b/veilid-core/src/routing_table/types/node_status.rs
@@ -9,6 +9,8 @@ pub const CAP_WILL_TUNNEL: Capability = FourCC(*b"TUNL");
 pub const CAP_WILL_SIGNAL: Capability = FourCC(*b"SGNL");
 pub const CAP_WILL_RELAY: Capability = FourCC(*b"RLAY");
 pub const CAP_WILL_VALIDATE_DIAL_INFO: Capability = FourCC(*b"DIAL");
+pub const CAP_WILL_DHT: Capability = FourCC(*b"DHTV");
+pub const CAP_WILL_APPMESSAGE: Capability = FourCC(*b"APPM");
 pub const MAX_CAPABILITIES: usize = 64;
 
 /// PublicInternet RoutingDomain Status
diff --git a/veilid-core/src/rpc_processor/rpc_app_call.rs b/veilid-core/src/rpc_processor/rpc_app_call.rs
index cf0318de..00d1840e 100644
--- a/veilid-core/src/rpc_processor/rpc_app_call.rs
+++ b/veilid-core/src/rpc_processor/rpc_app_call.rs
@@ -53,6 +53,14 @@ impl RPCProcessor {
         &self,
         msg: RPCMessage,
     ) -> Result<NetworkResult<()>, RPCError> {
+        // Ignore if disabled
+        {
+            let c = self.config.get();
+            if c.capabilities.disable.contains(&CAP_WILL_APPMESSAGE) {
+                return Ok(NetworkResult::service_unavailable("appcall is disabled"));
+            }
+        }
+
         // Get the question
         let (op_id, _, _, kind) = msg.operation.clone().destructure();
         let app_call_q = match kind {
diff --git a/veilid-core/src/rpc_processor/rpc_app_message.rs b/veilid-core/src/rpc_processor/rpc_app_message.rs
index ba49c701..e7b4daaf 100644
--- a/veilid-core/src/rpc_processor/rpc_app_message.rs
+++ b/veilid-core/src/rpc_processor/rpc_app_message.rs
@@ -24,6 +24,14 @@ impl RPCProcessor {
         &self,
         msg: RPCMessage,
     ) -> Result<NetworkResult<()>, RPCError> {
+        // Ignore if disabled
+        {
+            let c = self.config.get();
+            if c.capabilities.disable.contains(&CAP_WILL_APPMESSAGE) {
+                return Ok(NetworkResult::service_unavailable("appmessage is disabled"));
+            }
+        }
+
         // Get the statement
         let (_, _, _, kind) = msg.operation.destructure();
         let app_message = match kind {
diff --git a/veilid-core/src/rpc_processor/rpc_cancel_tunnel.rs b/veilid-core/src/rpc_processor/rpc_cancel_tunnel.rs
index 4698234a..0450ef38 100644
--- a/veilid-core/src/rpc_processor/rpc_cancel_tunnel.rs
+++ b/veilid-core/src/rpc_processor/rpc_cancel_tunnel.rs
@@ -6,6 +6,16 @@ impl RPCProcessor {
         &self,
         msg: RPCMessage,
     ) -> Result<NetworkResult<()>, RPCError> {
+        // Ignore if disabled
+        {
+            let c = self.config.get();
+            if c.capabilities.disable.contains(&CAP_WILL_TUNNEL) {
+                return Ok(NetworkResult::service_unavailable(
+                    "cancel tunnel is disabled",
+                ));
+            }
+        }
+
         Err(RPCError::unimplemented("process_cancel_tunnel_q"))
     }
 }
diff --git a/veilid-core/src/rpc_processor/rpc_complete_tunnel.rs b/veilid-core/src/rpc_processor/rpc_complete_tunnel.rs
index 307e659f..deb40a6d 100644
--- a/veilid-core/src/rpc_processor/rpc_complete_tunnel.rs
+++ b/veilid-core/src/rpc_processor/rpc_complete_tunnel.rs
@@ -6,6 +6,15 @@ impl RPCProcessor {
         &self,
         msg: RPCMessage,
     ) -> Result<NetworkResult<()>, RPCError> {
+        // Ignore if disabled
+        {
+            let c = self.config.get();
+            if c.capabilities.disable.contains(&CAP_WILL_TUNNEL) {
+                return Ok(NetworkResult::service_unavailable(
+                    "complete tunnel is disabled",
+                ));
+            }
+        }
         Err(RPCError::unimplemented("process_complete_tunnel_q"))
     }
 }
diff --git a/veilid-core/src/rpc_processor/rpc_find_block.rs b/veilid-core/src/rpc_processor/rpc_find_block.rs
index 3bfe81ea..6d92a6d8 100644
--- a/veilid-core/src/rpc_processor/rpc_find_block.rs
+++ b/veilid-core/src/rpc_processor/rpc_find_block.rs
@@ -6,6 +6,13 @@ impl RPCProcessor {
         &self,
         msg: RPCMessage,
     ) -> Result<NetworkResult<()>, RPCError> {
+        // Ignore if disabled
+        {
+            let c = self.config.get();
+            if c.capabilities.disable.contains(&CAP_WILL_BLOCKSTORE) {
+                return Ok(NetworkResult::service_unavailable("find block is disabled"));
+            }
+        }
         Err(RPCError::unimplemented("process_find_block_q"))
     }
 }
diff --git a/veilid-core/src/rpc_processor/rpc_get_value.rs b/veilid-core/src/rpc_processor/rpc_get_value.rs
index 8f419f80..de3f923f 100644
--- a/veilid-core/src/rpc_processor/rpc_get_value.rs
+++ b/veilid-core/src/rpc_processor/rpc_get_value.rs
@@ -163,6 +163,13 @@ impl RPCProcessor {
         &self,
         msg: RPCMessage,
     ) -> Result<NetworkResult<()>, RPCError> {
+        // Ignore if disabled
+        {
+            let c = self.config.get();
+            if c.capabilities.disable.contains(&CAP_WILL_DHT) {
+                return Ok(NetworkResult::service_unavailable("get value is disabled"));
+            }
+        }
         // Ensure this never came over a private route, safety route is okay though
         match &msg.header.detail {
             RPCMessageHeaderDetail::Direct(_) | RPCMessageHeaderDetail::SafetyRouted(_) => {}
diff --git a/veilid-core/src/rpc_processor/rpc_route.rs b/veilid-core/src/rpc_processor/rpc_route.rs
index 7e45bccd..0274e5aa 100644
--- a/veilid-core/src/rpc_processor/rpc_route.rs
+++ b/veilid-core/src/rpc_processor/rpc_route.rs
@@ -365,6 +365,19 @@ impl RPCProcessor {
         &self,
         msg: RPCMessage,
     ) -> Result<NetworkResult<()>, RPCError> {
+        // Ignore if disabled
+        {
+            let c = self.config.get();
+            if c.capabilities
+                .disable
+                .contains(&CAP_WILL_ROUTE)
+            {
+                return Ok(NetworkResult::service_unavailable(
+                    "route is disabled",
+                ));
+            }
+        }
+        
         // Get header detail, must be direct and not inside a route itself
         let detail = match msg.header.detail {
             RPCMessageHeaderDetail::Direct(detail) => detail,
diff --git a/veilid-core/src/rpc_processor/rpc_set_value.rs b/veilid-core/src/rpc_processor/rpc_set_value.rs
index 05bc3a23..43fd4a6b 100644
--- a/veilid-core/src/rpc_processor/rpc_set_value.rs
+++ b/veilid-core/src/rpc_processor/rpc_set_value.rs
@@ -175,6 +175,13 @@ impl RPCProcessor {
         &self,
         msg: RPCMessage,
     ) -> Result<NetworkResult<()>, RPCError> {
+        // Ignore if disabled
+        {
+            let c = self.config.get();
+            if c.capabilities.disable.contains(&CAP_WILL_DHT) {
+                return Ok(NetworkResult::service_unavailable("set value is disabled"));
+            }
+        }
         // Ensure this never came over a private route, safety route is okay though
         match &msg.header.detail {
             RPCMessageHeaderDetail::Direct(_) | RPCMessageHeaderDetail::SafetyRouted(_) => {}
diff --git a/veilid-core/src/rpc_processor/rpc_signal.rs b/veilid-core/src/rpc_processor/rpc_signal.rs
index 224a9bac..4d7d33f0 100644
--- a/veilid-core/src/rpc_processor/rpc_signal.rs
+++ b/veilid-core/src/rpc_processor/rpc_signal.rs
@@ -37,6 +37,14 @@ impl RPCProcessor {
         &self,
         msg: RPCMessage,
     ) -> Result<NetworkResult<()>, RPCError> {
+        // Ignore if disabled
+        {
+            let c = self.config.get();
+            if c.capabilities.disable.contains(&CAP_WILL_SIGNAL) {
+                return Ok(NetworkResult::service_unavailable("signal is disabled"));
+            }
+        }
+
         // Can't allow anything other than direct packets here, as handling reverse connections
         // or anything like via signals over private routes would deanonymize the route
         match &msg.header.detail {
diff --git a/veilid-core/src/rpc_processor/rpc_start_tunnel.rs b/veilid-core/src/rpc_processor/rpc_start_tunnel.rs
index ce9bce42..241e102c 100644
--- a/veilid-core/src/rpc_processor/rpc_start_tunnel.rs
+++ b/veilid-core/src/rpc_processor/rpc_start_tunnel.rs
@@ -6,6 +6,15 @@ impl RPCProcessor {
         &self,
         msg: RPCMessage,
     ) -> Result<NetworkResult<()>, RPCError> {
+        // Ignore if disabled
+        {
+            let c = self.config.get();
+            if c.capabilities.disable.contains(&CAP_WILL_TUNNEL) {
+                return Ok(NetworkResult::service_unavailable(
+                    "start tunnel is disabled",
+                ));
+            }
+        }
         Err(RPCError::unimplemented("process_start_tunnel_q"))
     }
 }
diff --git a/veilid-core/src/rpc_processor/rpc_supply_block.rs b/veilid-core/src/rpc_processor/rpc_supply_block.rs
index 5b27a512..a716b6b8 100644
--- a/veilid-core/src/rpc_processor/rpc_supply_block.rs
+++ b/veilid-core/src/rpc_processor/rpc_supply_block.rs
@@ -6,6 +6,15 @@ impl RPCProcessor {
         &self,
         msg: RPCMessage,
     ) -> Result<NetworkResult<()>, RPCError> {
+        // Ignore if disabled
+        {
+            let c = self.config.get();
+            if c.capabilities.disable.contains(&CAP_WILL_BLOCKSTORE) {
+                return Ok(NetworkResult::service_unavailable(
+                    "supply block is disabled",
+                ));
+            }
+        }
         Err(RPCError::unimplemented("process_supply_block_q"))
     }
 }
diff --git a/veilid-core/src/rpc_processor/rpc_validate_dial_info.rs b/veilid-core/src/rpc_processor/rpc_validate_dial_info.rs
index 06906639..991b2e2c 100644
--- a/veilid-core/src/rpc_processor/rpc_validate_dial_info.rs
+++ b/veilid-core/src/rpc_processor/rpc_validate_dial_info.rs
@@ -58,6 +58,19 @@ impl RPCProcessor {
         &self,
         msg: RPCMessage,
     ) -> Result<NetworkResult<()>, RPCError> {
+        // Ignore if disabled
+        {
+            let c = self.config.get();
+            if c.capabilities
+                .disable
+                .contains(&CAP_WILL_VALIDATE_DIAL_INFO)
+            {
+                return Ok(NetworkResult::service_unavailable(
+                    "validate dial info is disabled",
+                ));
+            }
+        }
+
         let detail = match msg.header.detail {
             RPCMessageHeaderDetail::Direct(detail) => detail,
             RPCMessageHeaderDetail::SafetyRouted(_) | RPCMessageHeaderDetail::PrivateRouted(_) => {
diff --git a/veilid-core/src/rpc_processor/rpc_value_changed.rs b/veilid-core/src/rpc_processor/rpc_value_changed.rs
index 621569e3..72f599e5 100644
--- a/veilid-core/src/rpc_processor/rpc_value_changed.rs
+++ b/veilid-core/src/rpc_processor/rpc_value_changed.rs
@@ -6,6 +6,15 @@ impl RPCProcessor {
         &self,
         msg: RPCMessage,
     ) -> Result<NetworkResult<()>, RPCError> {
+        // Ignore if disabled
+        {
+            let c = self.config.get();
+            if c.capabilities.disable.contains(&CAP_WILL_DHT) {
+                return Ok(NetworkResult::service_unavailable(
+                    "value changed is disabled",
+                ));
+            }
+        }
         Err(RPCError::unimplemented("process_value_changed"))
     }
 }
diff --git a/veilid-core/src/rpc_processor/rpc_watch_value.rs b/veilid-core/src/rpc_processor/rpc_watch_value.rs
index 0f4d24d1..5640bc3b 100644
--- a/veilid-core/src/rpc_processor/rpc_watch_value.rs
+++ b/veilid-core/src/rpc_processor/rpc_watch_value.rs
@@ -6,6 +6,16 @@ impl RPCProcessor {
         &self,
         msg: RPCMessage,
     ) -> Result<NetworkResult<()>, RPCError> {
+        // Ignore if disabled
+        {
+            let c = self.config.get();
+            if c.capabilities.disable.contains(&CAP_WILL_DHT) {
+                return Ok(NetworkResult::service_unavailable(
+                    "watch value is disabled",
+                ));
+            }
+        }
+
         Err(RPCError::unimplemented("process_watch_value_q"))
     }
 }
diff --git a/veilid-python/veilid/types.py b/veilid-python/veilid/types.py
index 40a739aa..7c5a8bb1 100644
--- a/veilid-python/veilid/types.py
+++ b/veilid-python/veilid/types.py
@@ -58,6 +58,8 @@ class Capability(StrEnum):
     CAP_WILL_SIGNAL = "SGNL"
     CAP_WILL_RELAY = "RLAY"
     CAP_WILL_VALIDATE_DIAL_INFO = "DIAL"
+    CAP_WILL_DHT = "DHTV"
+    CAP_WILL_APPMESSAGE = "APPM"
 
 
 class Stability(StrEnum):