Skip to content

Python: Clarify MCP annotation override scope #8399

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Eduard van Valkenburg (eavanvalkenburg) merged 1 commit into from
Sep 15, 2026
+17 −3
Merged

Python: Clarify MCP annotation override scope #8399

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 11 additions & 3 deletions python/packages/core/agent_framework/security.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4077,7 +4077,10 @@ async def apply_mcp_security_labels(
annotation_overrides: Optional per-tool-name overrides. Keys are
*remote* MCP tool names (as the server exposes them). Values are
``(IntegrityLabel, ConfidentialityLabel | None)`` tuples that
replace the annotation-derived labels entirely.
replace the annotation-derived labels entirely. Overrides apply
only to the supplied ``mcp_tool``; the mapping itself is not bound
to a server identity. Reuse it for another connection only after
independently authorizing that policy for the other server's tools.
mark_write_tools_as_sinks: When ``True`` (default), apply the
annotation-derived ``max_allowed_confidentiality=PUBLIC`` cap.
trust_server_ifc: Whether complete, valid server ``_meta.ifc`` labels
Expand Down Expand Up @@ -4348,7 +4351,9 @@ class SecureMCPToolProxy:
description: Tool description for the internal tool.
default_integrity: Default integrity for tools without annotations.
annotation_overrides: Per-tool-name label overrides (keyed by remote
MCP tool name).
MCP tool name), applied only to this proxy's MCP connection.
The mapping is not bound to a server identity; reuse it for another
connection only after independently authorizing that policy there.
mark_write_tools_as_sinks: Whether to apply the annotation-derived
PUBLIC confidentiality cap.
trust_server_ifc: Whether complete, valid server ``_meta.ifc`` labels
Expand Down Expand Up @@ -4387,7 +4392,10 @@ def __init__(
description: Tool description for the internal tool.
default_integrity: Default integrity for tools without annotations.
Defaults to ``IntegrityLabel.UNTRUSTED``.
annotation_overrides: Per-tool-name label overrides keyed by remote MCP tool name.
annotation_overrides: Per-tool-name label overrides keyed by remote MCP tool name,
applied only to this proxy's MCP connection. The mapping is not bound to a
server identity; reuse it for another connection only after independently
authorizing that policy there.
mark_write_tools_as_sinks: Whether to apply the annotation-derived
PUBLIC confidentiality cap. Defaults to ``True``.
trust_server_ifc: Whether complete, valid server ``_meta.ifc``
Expand Down
6 changes: 6 additions & 0 deletions python/samples/02-agents/security/FIDES_DEVELOPER_GUIDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -493,6 +493,12 @@ ToolAnnotations authoritative: `readOnlyHint` and `openWorldHint` remain restric
secure_mcp = SecureMCPToolProxy(url="https://trusted.example.com/mcp/", trust_server_ifc=True)
```

`annotation_overrides` supplies explicit local policy keyed by remote MCP tool name. It applies only to the
`MCPTool` passed to `apply_mcp_security_labels`, or the connection wrapped by `SecureMCPToolProxy`; the mapping
itself is not bound to a server identity. Reusing a mapping for another connection applies its overrides to
matching tool names on that connection. Independently authorize the policy for each server's tools before
reusing it; a shared tool name does not establish shared trust.

#### Operational checklist

1. Prefer `async with SecureMCPToolProxy(...)` so connection and label application happen together.
Expand Down
Loading