Python: Autolabelling MCP servers based on hints and Github MCP server ifc labels by shrutitople · Pull Request #6171 · microsoft/agent-framework

shrutitople · 2026-05-29T11:18:28Z

Motivation and Context

This PR adds end-to-end MCP security integration for FIDES by introducing automatic tool labeling from MCP annotations and per-result IFC label parsing from MCP metadata. It also adds a SecureMCPToolProxy convenience path for local MCP execution with policy enforcement, expands security test coverage for MCP labeling behavior, and updates docs and samples to reflect the new workflow.

Description

Core security pipeline updates for MCP annotation-to-label mapping and _meta.ifc result label handling.
MCP transport and framework export updates to support secure labeling flow.
New consolidated GitHub MCP sample with CLI/attack/devui flows and debug-gated security output.
Security documentation refresh (developer guide, implementation summary, ADR notes), including stale/duplicate cleanup.
Sample/document cleanup replacing older split MCP sample references with the consolidated example.

Impact:
Improves deterministic prompt-injection defense for MCP-connected agents by ensuring tool-level and result-level labels are consistently enforced locally before model-visible execution.

…ecurity, and change context label only using the labels of unhidden result from tools

…nto pr/fides-mcp-autolabel-clean

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR expands the FIDES security samples and core framework to support securely running remote MCP tools with local policy enforcement, including tool auto-labeling from MCP annotations, per-result IFC label parsing from MCP _meta, and improved variable-reference tool chaining.

Changes:

Add SecureMCPToolProxy, MCP tool auto-labeling (apply_mcp_security_labels), and _meta.ifc result label propagation into per-item security_label.
Add a new GitHub MCP sample demonstrating direct MCP URL connection with local FIDES enforcement (CLI + DevUI) and update docs accordingly.
Enhance variable-reference expansion in tool arguments and adjust label-taint behavior to account for hidden vs visible items; add tests for the new behavior.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
python/samples/02-agents/security/repo_confidentiality_example.py	Adds explicit DevUI auth token generation and passes it into `serve(...)`.
python/samples/02-agents/security/github_mcp_example.py	New sample for direct GitHub MCP URL + local FIDES enforcement with DevUI/CLI modes.
python/samples/02-agents/security/email_security_example.py	Adds debug logging flag, explicit DevUI token handling, and content-filter exception handling.
python/samples/02-agents/security/README.md	Documents the new GitHub MCP sample and DevUI bearer token behavior.
python/samples/02-agents/security/FIDES_DEVELOPER_GUIDE.md	Updates/extends developer guide with MCP integration guidance and refreshed sections.
python/packages/core/tests/test_security.py	Adds tests for variable reference expansion, auto-hide behavior, mixed-result tainting, and MCP `_meta.ifc` parsing/stamping.
python/packages/core/agent_framework/security.py	Implements variable reference expansion for tool args, refines context tainting rules, and adds MCP auto-labeling + `_meta.ifc` stamping + `SecureMCPToolProxy`.
python/packages/core/agent_framework/_mcp.py	Propagates MCP result `_meta` onto each produced `Content` via `__mcp_result_meta__`.
python/packages/core/agent_framework/init.py	Exposes `SecureMCPToolProxy` and `apply_mcp_security_labels` from the package.
docs/features/FIDES_IMPLEMENTATION_SUMMARY.md	Documents MCP hint labeling and `_meta.ifc` result label support.
docs/decisions/0024-prompt-injection-defense.md	Adds design notes for MCP hint-based tool labeling and `_meta.ifc` result label enforcement.

Comments suppressed due to low confidence (1)

python/packages/core/agent_framework/security.py:1

The docstring claims destructiveHint is used for label inference, but the implementation only reads readOnlyHint and openWorldHint. Either incorporate destructiveHint into _map_mcp_annotations_to_labels or remove it from the documentation to avoid misleading users.

# Copyright (c) Microsoft. All rights reserved.

moonbox3 · 2026-05-29T11:21:30Z

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
packages/core/agent_framework
_mcp.py	1211	93	92%	232, 238, 347, 366, 566, 645–646, 778, 819, 843, 856, 880–881, 900–903, 905–906, 910, 936, 970–972, 974, 1027–1029, 1088–1089, 1358, 1399–1400, 1413, 1416, 1425–1426, 1431–1432, 1438, 1492–1493, 1513–1514, 1523–1524, 1529–1530, 1536, 1629, 1632, 1659, 1682–1686, 1709–1711, 1716, 1720–1721, 1823, 1830, 1832, 1903, 1918–1919, 1926–1927, 1932–1933, 1938, 1942, 1957, 2019, 2202, 2204, 2226, 2228–2231, 2244–2245, 2289, 2351, 2750–2751, 2973–2974, 2992
security.py	932	209	77%	451–452, 470, 473–474, 552–553, 555, 603, 615, 631, 648, 825, 841–844, 902, 906, 909–911, 919–923, 928–931, 933, 948–952, 957–961, 965–968, 970, 982–983, 986–987, 1063, 1069–1070, 1075, 1077–1078, 1108–1109, 1137–1145, 1168–1171, 1281–1282, 1313–1314, 1333–1334, 1338–1339, 1380–1381, 1468–1469, 1698, 1702, 1706, 1809, 1814–1815, 1819, 1823–1825, 1874, 1886, 1888, 1905, 1926, 1937, 1963, 2004–2005, 2030, 2140, 2168–2170, 2205–2207, 2215, 2223, 2495–2496, 2498, 2500–2502, 2505, 2517, 2523–2524, 2526, 2557, 2561–2564, 2566, 2716–2717, 2730, 2753, 2820, 2830–2831, 2992–2993, 2997–2999, 3004, 3006–3014, 3019–3020, 3022–3026, 3028–3030, 3033–3035, 3037–3038, 3043, 3046–3047, 3051, 3053, 3122, 3150–3151, 3154–3155, 3262–3265, 3267–3268, 3270, 3272, 3278, 3283, 3292–3295, 3301–3303, 3307, 3313–3314, 3318, 3327–3329, 3336, 3341, 3346, 3351, 3356, 3361, 3373–3374
TOTAL	42793	5123	88%

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
8419	37 💤	0 ❌	0 🔥	2m 14s ⏱️

…nto pr/fides-mcp-autolabel-clean

…opogation

… instead of /insiders - Switch MCP_URL from /mcp/insiders to /mcp/ in github_mcp_example.py - Add MCP_HEADERS constant with X-MCP-Features: ifc_labels to opt-in to server-side IFC label emission in _meta payloads - Fix SecureMCPToolProxy to pass headers via httpx.AsyncClient so they are included on session.initialize(), not just on tool calls (was causing 401 to silently surface as anyio cancel-scope CancelledError) - Update README, FIDES_DEVELOPER_GUIDE, FIDES_IMPLEMENTATION_SUMMARY, and 0024-prompt-injection-defense.md to remove all /insiders references

…ntConfig quarantine client global behavior

eavanvalkenburg

couple of small comments, but nothing major

TaoChenOSU · 2026-06-23T20:55:16Z

Please resolve the comments that are addressed.

shrutitople · 2026-06-24T09:54:19Z

All the existing comments are addressed.

TaoChenOSU · 2026-06-24T17:43:35Z

Will approve once the pipelines pass

Implement the smallest real primitive that lets a genuine label-propagation check exist, scoped deliberately against Microsoft Agent Framework's FIDES (microsoft/agent-framework#6171, #6860, both shrutitople) rather than attempting a reimplementation of it. - ConfidentialityLabel: a fixed, closed, ordered type (public < internal < confidential < restricted) in types.ts/types.py. - IfcPolicy: a new optional ScopeDeclaration.ifc field -- a hand-declared source/sink labeling map the caller maintains. Not automatic inference: toolgovern has no way to know a resource is confidential or a destination is untrusted from a bare argument, so this only evaluates what is declared. - TG08-confidential-source-to-untrusted-sink: fires when a call's declared source argument names a resource labeled confidential-or-higher AND its declared sink argument names a destination whose trust tier is lower (deny) or was never declared at all (require-approval -- fails closed on ambiguity, never a silent allow). - Ported to Python (classifier/information_flow.py), same semantics, same matching style as isCredentialGranted (exact / trailing-segment / substring). - 12 new tests per language proving both sides: allow when sink trust covers the source label, deny when explicitly lower-trust, and require-approval when the sink is undeclared. Honest scope, documented in docs/security-model.md (finding #12) and SECURITY.md: no automatic label inference, no MCP gateway integration, no cross-call taint tracking, no reader-scoped lattice, no result-value inspection. Checked against the real upstream PRs this was scoped from -- #6171 (MCP-annotation autolabeling, _meta.ifc result-label parsing) and #6860 (gateway-delegated policy evaluation, a readers-lattice label type) are both real, larger engineering efforts than a classifier rule can close; this is the one primitive both presuppose, not a smaller version of either. Rule counts: TS classifier 34 -> 35 synchronous rules (36 total with the async-only TG03-dns-resolves-private); Python 35 -> 36 (folds the DNS check into one synchronous registry). README, docs/concepts.md, docs/policy-schema.md, python/README.md, benchmarks/README.md updated to match; the 2026-07-12 latency benchmark numbers are left as a dated historical measurement rather than fabricated as re-measured against the new count.

shrutitople added 7 commits May 22, 2026 13:48

Python: add GitHub MCP security label sample

660696e

modified samples to create devui auth token, support debugging with s…

a07e2c2

…ecurity, and change context label only using the labels of unhidden result from tools

FIDES: secure MCP labeling, _meta IFC parsing, and docs updates

1f5b6a5

FIDES: secure MCP labeling, _meta IFC parsing, and docs updates

097cc10

Merge branch 'main' of https://github.com/microsoft/agent-framework i…

74d703c

…nto pr/fides-mcp-autolabel-clean

Resolve merge conflict: keep local version with logging suppression fix

f43f358

modified docs

39b5d70

Copilot AI review requested due to automatic review settings May 29, 2026 11:18

moonbox3 added documentation Usage: [Issues, PRs], Target: documentation in the code base and learn docs python Usage: [Issues, PRs], Target: Python labels May 29, 2026

github-actions Bot changed the title ~~Autolabelling MCP servers based on hints and Github MCP server ifc labels~~ Python: Autolabelling MCP servers based on hints and Github MCP server ifc labels May 29, 2026

Copilot AI reviewed May 29, 2026

View reviewed changes

eavanvalkenburg reviewed May 29, 2026

View reviewed changes

Comment thread python/packages/core/agent_framework/_mcp.py Outdated

Comment thread python/packages/core/agent_framework/security.py

shrutitople added 4 commits May 29, 2026 14:30

Merge branch 'main' of https://github.com/microsoft/agent-framework i…

ee714f7

…nto pr/fides-mcp-autolabel-clean

fixed PR comments, simplified github_mcp example

eb8bc72

commented github_mcp example

9f82ee5

remove the parse_github_mcp_labels and fix the user_identity label pr…

74d634f

…opogation

eavanvalkenburg reviewed Jun 10, 2026

View reviewed changes

eavanvalkenburg reviewed Jun 17, 2026

View reviewed changes

shrutitople force-pushed the pr/fides-mcp-autolabel-clean branch from bc4264e to 3831fd0 Compare June 18, 2026 10:40

address PR comments

d2e4cc1

eavanvalkenburg reviewed Jun 22, 2026

View reviewed changes

Comment thread python/samples/02-agents/security/github_mcp_example.py

Simplify GitHub MCP security sample to DevUI-only; document SecureAge…

62134f4

…ntConfig quarantine client global behavior

eavanvalkenburg approved these changes Jun 23, 2026

View reviewed changes

Comment thread python/samples/02-agents/security/github_mcp_example.py Outdated

Comment thread python/samples/02-agents/security/github_mcp_example.py Outdated

shrutitople added 2 commits June 24, 2026 10:45

minor PR comments

ed3c28e

minor PR comments

0a0ad63

shrutitople added 2 commits June 25, 2026 11:30

fixing failed checks

5b81b17

fixing failed checks

4099c6e

TaoChenOSU approved these changes Jun 25, 2026

View reviewed changes

eavanvalkenburg added this pull request to the merge queue Jun 25, 2026

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Jun 25, 2026

eavanvalkenburg added this pull request to the merge queue Jun 26, 2026

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Jun 26, 2026

TaoChenOSU added this pull request to the merge queue Jun 27, 2026

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Jun 27, 2026

Merge branch 'main' into pr/fides-mcp-autolabel-clean

d1a7f82

eavanvalkenburg enabled auto-merge June 29, 2026 08:27

eavanvalkenburg added this pull request to the merge queue Jun 29, 2026

Merged via the queue into microsoft:main with commit 730bcee Jun 29, 2026
38 checks passed

This was referenced Jun 29, 2026

Python: selective version bump for 1.10.0 release (re-date to 260629) #6806

Closed

Python: selective version bump for 1.10.0 release #6840

Merged

Uh oh!

Conversation

shrutitople commented May 29, 2026

Motivation and Context

Description

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

moonbox3 commented May 29, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Python Unit Test Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

eavanvalkenburg left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

TaoChenOSU commented Jun 23, 2026

Uh oh!

shrutitople commented Jun 24, 2026

Uh oh!

TaoChenOSU commented Jun 24, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

moonbox3 commented May 29, 2026 •

edited by github-actions Bot

Loading