[Changyong Gong (chagong)]

Summary

Follow-up to #61. SDK 1.0.29 supplies MCP permission requests with an already-qualified tool name, for example server_name="github" and tool_name="github-get_repository". The host prefixed that name again and rejected the resulting github-github-get_repository identity, blocking legitimate reads and team-memory operations.

• Accept bare and SDK-qualified names only within the matching server's profile-specific allowlist, including the separate wiki-writer server.
• Continue denying unknown/cross-server tools, internal-analysis writes, execution permissions, and managed approvals. Explicitly deny managed-settings sessions rather than raising from the SDK approval helper.
• Add permission-shape and denial/log-safety regressions, distinguish static denial reasons, and document the matching contract. Public visibility enforcement is unchanged.

Validation

• Host integration suite: 71 tests passed with installed SDK 1.0.16 and with isolated SDK 1.0.29.
• Public-access suite: 14 tests passed.
• Real SDK 1.0.29 with local-only provider/MCP fixtures: the configured team-memory agent completed three qualified GitHub reads and a wiki-writer operation; internal analysis completed its reads without a writer attached. No live GitHub/Foundry requests or real wiki writes were performed by these fixtures.
• git diff --check passed.

Rollout

This PR changes repository code only. No Foundry deployment or production workflow rerun has been performed.

[Copilot]

🟢 Approval recommended

No active review issues are identified that would require changes before approval.

No open issues 🎉

What changed in this PR

This follow-up to #61 fixes host permission matching for SDK-qualified MCP tool names while preserving server-specific allowlists and confidentiality-profile restrictions.

Changes:

• Accept both bare and server-qualified tool names for the matching GitHub or wiki-writer server.
• Explicitly deny managed approvals and managed-settings sessions, with distinct static denial messages.
• Add permission-matching and log-safety regressions, and document the contract. Public visibility enforcement remains unchanged.

File	Description
tests/​test_host_telemetry.py	Adds coverage for accepted name formats, cross-server denials, managed approvals, and log safety.
main.py	Fixes server-bound permission matching and explicitly rejects managed approvals.
docs/​guide.md	Documents accepted tool-name formats and preserved permission restrictions.

_{Review effort: Balanced}