Issue Station
Sign In
Tools hereToolbox

autogen - ✅(Solved) Fix Enforce fail-closed defaults for untrusted MCP server integrations [1 pull requests, 10 comments, 7 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
microsoft/autogen#7266•Fetched 2026-04-08 00:40:00
View on GitHub
Comments
10
Participants
7
Timeline
15
Reactions
0
Author
davidahmanndavidahmann
Participants
agent-morrowagent-morrowdavidahmanndavidahmannJairoohJairoohNeuZhouNeuZhoupiiiicopiiiicorazashariffrazashariffxXMrNidaXxxXMrNidaXx
Timeline (top)
commented ×10cross-referenced ×2mentioned ×1referenced ×1

Error Message

  • Error messaging clearly indicates required trust/policy configuration.

Fix Action

Fixed

PR fix notes

PR #7267: mcp: enforce strict-mode trust policy fail-closed defaults

Description (problem / solution / changelog)

Problem

MCP integrations can be configured without explicit trust boundaries, which allows permissive behavior in sensitive environments.

Why Now

AutoGen documentation already warns to use trusted MCP servers; strict runtime contracts should enforce that guidance.

What Changed

  • Added explicit trust metadata and strict validation path in MCP server params.
  • Added strict fail-closed policy enforcement helper (validate_mcp_trust_policy).
  • Wired strict policy through:
    • mcp_server_tools(..., strict_mode, allow_untrusted)
    • McpWorkbench(..., strict_mode, allow_untrusted) config/state serialization
    • McpSessionActor initialization/config serialization
  • Added focused tests for strict rejection and explicit opt-in allow paths.

Validation

  • uv run --extra mcp pytest tests/tools/test_mcp_workbench_warnings_and_errors.py tests/tools/test_mcp_tools.py -q ✅
  • uv run --extra mcp ruff check src/autogen_ext/tools/mcp/_config.py src/autogen_ext/tools/mcp/_factory.py src/autogen_ext/tools/mcp/_workbench.py src/autogen_ext/tools/mcp/_actor.py tests/tools/test_mcp_workbench_warnings_and_errors.py tests/tools/test_mcp_tools.py ✅

Refs #7266

Changed files

  • python/packages/autogen-ext/src/autogen_ext/tools/mcp/_actor.py (modified, +27/-4)
  • python/packages/autogen-ext/src/autogen_ext/tools/mcp/_config.py (modified, +20/-0)
  • python/packages/autogen-ext/src/autogen_ext/tools/mcp/_factory.py (modified, +15/-1)
  • python/packages/autogen-ext/src/autogen_ext/tools/mcp/_workbench.py (modified, +37/-4)
  • python/packages/autogen-ext/tests/tools/test_mcp_tools.py (modified, +30/-0)
  • python/packages/autogen-ext/tests/tools/test_mcp_workbench_warnings_and_errors.py (modified, +25/-0)
RAW_BUFFERClick to expand / collapse

Problem Example MCP integrations can be used in permissive ways without explicit trust boundaries, risking unsafe tool execution.

Why now README guidance already warns to only connect to trusted MCP servers; runtime contracts should enforce this by default.

Current behavior is insufficient Safety relies on user discipline/documentation rather than hard fail-closed defaults.

Expected behavior Default behavior should fail closed for untrusted MCP server integrations unless explicit opt-in trust/policy is configured.

Acceptance criteria

  • Untrusted MCP configurations are rejected by default.
  • Explicit opt-in path exists and is auditable.
  • Error messaging clearly indicates required trust/policy configuration.

Validation

  • Add tests proving untrusted configs fail and trusted opt-in configs pass.
  • Ensure behavior is deterministic across AgentChat and MCP tool integration surfaces.

Codepaths

  • python/packages/autogen-ext/src
  • python/packages/autogen-agentchat/src

extent analysis

Fix Plan

To address the issue, we will implement a default fail-closed behavior for untrusted MCP server integrations.

Steps to Fix

  • Introduce a new configuration option trusted_mcp_servers to store a list of trusted MCP servers.
  • Modify the MCP integration code to check if the server is in the trusted_mcp_servers list before connecting.
  • If the server is not trusted, raise an error with a clear message indicating the required trust/policy configuration.

Example Code

# python/packages/autogen-ext/src/mcp_integration.py
import os

def connect_to_mcp_server(mcp_server_url):
    trusted_mcp_servers = os.environ.get('TRUSTED_MCP_SERVERS', '').split(',')
    if mcp_server_url not in trusted_mcp_servers:
        raise ValueError(f"Untrusted MCP server: {mcp_server_url}. Please add it to the TRUSTED_MCP_SERVERS environment variable.")
    # Connect to the MCP server
    # ...

Verification

  • Add tests to prove that untrusted MCP configurations fail and trusted opt-in configurations pass.
  • Verify that the behavior is deterministic across AgentChat and MCP tool integration surfaces.

Extra Tips

  • Ensure that the TRUSTED_MCP_SERVERS environment variable is properly configured and auditable.
  • Consider implementing additional security measures, such as authentication and authorization, to further restrict access to trusted MCP servers.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#ssr#installation#tensor shape#prompt formatting#chain error#conversation history#tool integration#LLM response

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

autogen - ✅(Solved) Fix Enforce fail-closed defaults for untrusted MCP server integrations [1 pull requests, 10 comments, 7 participants]