fix(mcp): Port config stdio opt-in and reserved tool name checks to v1 - #6796
Merged
Conversation
…lt (v1) Loading an agent config that declared a stdio MCP server launched the config-supplied `command` as a local process, before the model was ever contacted. `McpToolset.from_config()` now rejects `stdio_server_params` and `stdio_connection_params` unless the operator opts in by setting `ADK_ALLOW_CONFIG_STDIO_MCP_SERVERS=1`. This is a behaviour change for existing 1.x users: an agent config that declares a stdio MCP server now raises `ValueError` at load time until the environment variable is set. Remote transports (`sse_connection_params`, `streamable_http_connection_params`) and toolsets constructed in Python code are unaffected. Port of upstream a61d8ec. Unlike the upstream version, this port does not add the in-process `_set_allow_config_stdio_servers()` override, so the environment variable is the only opt-in and no new module state lands on the maintenance branch.
An MCP tool was registered under the verbatim name the remote server advertised, with no check against the names the framework itself puts on the wire. A server that advertised `adk_request_credential`, `adk_request_confirmation`, `adk_request_input` or `transfer_to_agent` therefore had its own tool dispatched in place of the framework's. `McpToolset.get_tools` now drops a tool carrying one of those four names and logs a warning, and `McpTool.__init__` refuses the name outright. The listing skips rather than raises so that one reserved name does not fail the whole `list_tools` call and take the server's honest tools with it; the constructor check is the backstop for anything that builds an `McpTool` directly. Behaviour change: a server that legitimately serves a tool under one of those four names loses that tool, with only a warning log as the signal. Only exact matches are refused, so `transfer_to_agent_v2` still registers. Because `tool_name_prefix` is applied after `get_tools` returns, a prefixed toolset also drops such a tool even though the prefix would have made the final name unique; this matches upstream. Port of upstream 77d4647, which is itself the reland of an earlier attempt. Only the reland's net content is ported: the constructor's handling of a `None` tool or session manager and the `mcp_session_manager` annotation are left exactly as they were.
The header-check bot compares a pull request against `main`, and this sample directory exists only on `v1`, so both of its files read as newly added and the YAML was reported as missing a license header. Adds the standard header; no functional change.
GWeale
changed the title
wukath
approved these changes
Aug 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR ports two MCP changes from
mainto thev1branch:fix(mcp): reject stdio MCP servers declared in agent configs by default(upstreama61d8ecf)stdio_server_paramsorstdio_connection_paramsloads only whenADK_ALLOW_CONFIG_STDIO_MCP_SERVERSis1ortrue; otherwisefrom_config()raisesValueError. Remote transports and toolsets built in Python code are unaffected.tool_mcp_stdio_notion_configsample README documents the opt-in.main's in-process override setter.fix: refuse MCP tools that take a reserved ADK tool name(upstream77d4647c)McpToolset.get_toolsskips, with a warning log, a tool named exactlyadk_request_credential,adk_request_confirmation,adk_request_inputortransfer_to_agent; the server's other tools still register.McpTool.__init__raisesValueErroron the same four names.A third commit adds the Apache header to the sample's
root_agent.yaml.