[Eduard van Valkenburg (eavanvalkenburg)]

Motivation & Context

Fix MCP allowlist and approval name matching so each configured name identifies at most one raw remote tool. Preserve existing support for unambiguous prefixed names and keep discovery updates consistent across pagination and refresh.

Description & Review Guide

• What are the major changes? Add shared validation for configured allowlist and approval names. Stage tool and prompt discovery across all pages before publishing new functions. Revalidate configuration when exposing functions, including progressive discovery. Add regression coverage for ordering, pagination, refresh, approval modes, and compatibility.
• What is the impact of these changes? Configuration names that match multiple raw remote names now raise ToolExecutionException. Applications using those names must select an unambiguous name or a different tool_name_prefix. Raw names, unambiguous prefixed aliases, normalized-only approval nonmatching, and empty/unset allowlist behavior remain unchanged. Failed discovery refreshes retain the previous functions and metadata.
• What do you want reviewers to focus on? The compatibility boundary for configured names and the publication of discovery results only after validation.

Related Issue

N/A. No matching open issue or overlapping open PR was found.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible — MCP unit suites pass; the full repository suite has not been run.
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

🔵 Needs a closer look

The breaking configuration contract and discovery changes require final human review.

Pull request overview

This breaking Python change makes MCP allowlist and approval names unambiguous while improving discovery refresh safety.

Changes:

• Validates configured names across tools and prompts.
• Stages paginated discovery before publishing results.
• Adds regression tests and documents the updated contract.

File summaries

File	Summary
python/packages/core/tests/core/test_mcp.py	Adds coverage for ambiguity, pagination, refresh, and progressive discovery.
python/packages/core/AGENTS.md	Documents the updated MCP configuration behavior.
python/packages/core/agent_framework/_mcp.py	Implements validation and staged discovery publication.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0
• Review effort level: Lite (auto)

Note

Copilot is running an experiment and ran this review at Lite.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (1 commit(s)): 1cbfc5b2dadb
Model: gpt-5.6-sol-fast

Overview

The change centralizes MCP configuration-name validation and stages paginated discovery before publishing functions or metadata, with broad coverage for ambiguity, ordering, progressive disclosure, and failed reload preservation. Those guardrails correctly prevent partial publication, but validation currently combines a refreshed server snapshot with stale functions from the prior snapshot. As a result, a legitimate remote tool rename can make refresh fail and leave only an obsolete wrapper available.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
1 verified finding remained after source verification (1 medium) across 1 file. Details are attached to the affected lines below.

Affected areas: python/packages/core/agent_framework/_mcp.py