Repository navigation
Python: [BREAKING] Harden MCP catalog discovery behavior - #10042
Conversation
…ty for retry logic
GitHub Actions
Inactive
GitHub Actions
Inactive
agent-framework-automation
Bot
added
documentation
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues are recorded for the MCP catalog discovery hardening.
No open issues 🎉
What changed in this PR
This PR hardens Python MCP catalog discovery with bounded requests and pagination while preserving complete catalog snapshots and caller-owned connection policy.
Changes:
- Adds configurable page and item limits, shared page-fetch recovery, and a 30-second default request timeout for framework-owned clients.
- Retains tool annotations with catalog snapshots so security labeling no longer lists tools independently.
- Adds tests and ownership guidance for discovery limits, recovery, and annotation refresh behavior.
| File | Description |
|---|---|
python/packages/core/tests/test_security.py |
Updates security tests to use retained annotation snapshots and explicit refreshes. |
python/packages/core/tests/core/test_mcp.py |
Tests limits, exact boundaries, opaque cursors, timeout defaults, and connection recovery. |
python/packages/core/AGENTS.md |
Documents request bounds, ownership policy, and atomic annotation refresh. |
python/packages/core/agent_framework/security.py |
Uses cached annotations and refreshes tools before reapplying proxy labels. |
python/packages/core/agent_framework/_mcp.py |
Implements bounded discovery, shared recovery, timeout defaults, and annotation retention. |
docs/decisions/0045-python-mcp-v2-client-lifecycle.md |
Clarifies timeout ownership, discovery bounds, and catalog publication responsibilities. |
Review effort: Balanced
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
GitHub Actions
Inactive
…gination_hardening # Conflicts: # python/packages/core/agent_framework/_mcp.py
GitHub Actions
Inactive
GitHub Actions
Inactive
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
MAF Automated Review — Iteration 1
Result: Findings reported
Scope: full PR (12 commit(s)): 5d32c1bd3d23, 37bd4437fd3e, 4b344e12a986, 9edeb705d1b2, 455f290dcd65, bd4e9f2ac202, 41eb445c870d, 4efc33245cb8, f358e659882a, 99ae067f1291, 863cb18fc4cd, 907d87eee6e3
Model: gpt-5.6-sol
Overview
The change adds per-fetch page and item limits, exact-boundary validation, atomic catalog publication, and retained annotation snapshots with conservative security-label defaults. The staged-state design and rollback tests provide strong protection against partial publication. Three compatibility gaps remain: the new timeout affects all MCP requests rather than discovery alone, label refresh can populate tools that were explicitly disabled, and wrapper entry points do not expose the new trusted-server opt-outs.
Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
3 verified findings remained after source verification (3 medium) across 2 files. Details are attached to the affected lines below.
Affected areas: python/packages/core/agent_framework/_mcp.py, python/packages/core/agent_framework/security.py
GitHub Actions
Inactive
GitHub Actions
Inactive
GitHub Actions
Inactive
GitHub Actions
Inactive
Jose Alvarez (jpalvarezl)
changed the title
GitHub Actions
Inactive
agent-framework-automation
Bot
added
the
breaking change
GitHub Actions
Inactive
Motivation & Context
MCP servers can expose paginated tool and prompt catalogs whose size and response time vary significantly. Catalog discovery should remain predictable, preserve the previous complete snapshot when refresh fails, and make framework-owned versus caller-owned request policy explicit.
Description & Review Guide
Noneto retain unlimited request timing. Caller-supplied clients retain their own transport and timeout policy. Catalog refresh continues to publish atomically, supports explicit trusted-server opt-outs, and reports which setting should be adjusted when a configured limit is reached.Related Issue
N/A - maintainer-directed behavior hardening with no public tracking issue.
AI Assistance
AI assistance details: Copilot assisted with design review, implementation guidance, tests, documentation, and this PR description.
Contribution Checklist
breaking changelabel (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.