[Roger Barreto (rogerbarreto)]

Motivation & Context

Foundry Prompt Agent Toolboxes expose runtime-owned MCP execution to Responses callers as a completed mcp_call with inline output. .NET hosted agents previously exposed locally executed Toolbox and MCP tools as function-call components, while native MCP content from inference-hosted tools and custom agents was not consistently projected to the caller.

This change aligns those Hosting paths around MCP provenance. Toolbox tools, explicitly marked local MCP functions, and native MCP content now preserve one caller-facing MCP contract while retaining the private representation each agent needs for stored replay.

Description & Review Guide

• What are the major changes? Adds AsLocalMcpTool(...) as an explicit marker for locally executed MCP functions; generalizes Toolbox projection to that marker; serializes native MCP call, result, and approval content already emitted by inference providers or custom agents; restores local function-shaped and native MCP history through separate call-ID maps; adds isolated Toolbox and inference-hosted MCP integration scenarios; and fixes the Toolbox approval client so a native MCP decision also settles the framework's pending approval exactly once.
• What is the impact of these changes? Responses callers receive completed mcp_call items with inline output instead of function-call pairs for runtime-owned MCP execution. Existing local execution, middleware, approval surfaces, and private model history remain in place. Non-MCP functions keep their existing contract. Agent Skills built-ins such as load_skill continue to return function_call plus function_call_output after the native MCP approval exchange because the Toolbox MCP endpoint is their skill source, not the model-invoked tool.
• What do you want reviewers to focus on? Review the local/native history reconstruction split and the opt-in boundary for ordinary local MCP functions. Shared Declarative workflow MCP output remains unchanged because that event shape is consumed by multiple hosting adapters; any native Declarative MCP contract should be coordinated across those packages separately. This PR also intentionally excludes the broader approval persistence/CAS hardening, which is being developed as a separate follow-up change.

Related Issue

N/A - maintainer-directed change from a live Foundry contract investigation.

AI Assistance

• No material AI assistance was used.
• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details: Copilot assisted with implementation, tests, documentation, protocol investigation, and this PR description.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and the title prefix in sync automatically.

[Copilot]

🟡 Changes recommended

Unresolved MCP approval and replay defects can reject valid requests, silently drop tool output, lose typed content, and leave denied calls unsettled in conversation history.

6 open issues

• Match approval replay against the remote MCP tool name · New
• Restore typed native MCP contents from hosted history · New
• Retain call identity for auto-approved local MCP functions · New
• Preserve denied-call results in volatile approval history · New
• Preserve native MCP output in the Responses streaming adapter · New
• Remove the hard-coded GitHub login from the integration test · New

What changed in this PR

This PR aligns .NET Foundry hosting around a caller-facing MCP contract while preserving separate internal representations for local functions and native MCP tools.

Changes:

• Adds AsLocalMcpTool(...) and projects runtime-owned MCP executions as mcp_call items with inline output.
• Adds local/native history mappings, MCP approval conversion, and stable declarative call/result correlation.
• Expands unit and integration coverage and documents the Responses contract.

File	Description
dotnet/​tests/​Microsoft.Agents.AI.Workflows.Declarative.UnitTests/​ObjectModel/​InvokeMcpToolExecutorTest.cs	Tests matching MCP call/result IDs.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​OutputConverterTests.cs	Tests MCP projection, approvals, and parallel calls.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​InputConverterTests.cs	Tests transcript reconstruction and approval replay checks.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​FoundryToolboxApprovalTests.cs	Tests handler-level MCP contracts and name collisions.
dotnet/​tests/​Foundry.Hosting.IntegrationTests/​scripts/​it-bootstrap-agents.ps1	Registers the hosted MCP scenario.
dotnet/​tests/​Foundry.Hosting.IntegrationTests/​README.md	Documents prerequisites and separate MCP scenarios.
dotnet/​tests/​Foundry.Hosting.IntegrationTests/​McpToolboxHostedAgentTests.cs	Verifies the Toolbox Responses contract.
dotnet/​tests/​Foundry.Hosting.IntegrationTests/​HostedMcpHostedAgentTests.cs	Verifies inference-hosted MCP output.
dotnet/​tests/​Foundry.Hosting.IntegrationTests/​Fixtures/​McpToolboxHostedAgentFixture.cs	Configures the Toolbox test resource.
dotnet/​tests/​Foundry.Hosting.IntegrationTests/​Fixtures/​HostedMcpHostedAgentFixture.cs	Adds the inference-hosted MCP fixture.
dotnet/​tests/​Foundry.Hosting.IntegrationTests.TestContainer/​Program.cs	Configures isolated Toolbox and hosted MCP agents.
dotnet/​src/​Microsoft.Agents.AI.Workflows.Declarative/​ObjectModel/​InvokeMcpToolExecutor.cs	Emits native MCP content with stable correlation IDs.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​ToolApprovalIdMap.cs	Stores approval decisions and local/native call mappings.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​OutputConverter.cs	Projects MCP calls, results, approvals, and failures.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​InputConverter.cs	Reconstructs local-function and native MCP history.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​FoundryAIToolExtensions.cs	Adds the explicit local MCP marker API.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​ConsentAwareMcpClientAIFunction.cs	Exposes MCP execution metadata through tool wrappers.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​AgentFrameworkResponseHandler.cs	Collects MCP contracts and rejects ambiguous function names.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-Toolbox/​README.md	Documents Toolbox execution and approval items.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-Toolbox-AuthPaths/​README.md	Documents MCP output alongside approval and OAuth consent.

_{Review effort: Balanced}

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (1 commit(s)): 1b3af323553e
Model: gpt-5.6-sol

Overview

The PR consistently projects locally executed and native MCP operations into caller-facing MCP items while retaining private replay shapes, with strong identity checks, one-shot approval decisions, and broad unit/integration coverage. The remaining risks are a credential-bearing URL disclosure in declarative workflows, several replay/correlation edge cases, and unbounded persistent correlation state in long-lived sessions.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
5 verified findings remained after source verification (1 high, 4 medium) across 3 files. Details are attached to the affected lines below.

Affected areas: dotnet/src/Microsoft.Agents.AI.Foundry.Hosting/InputConverter.cs, dotnet/src/Microsoft.Agents.AI.Foundry.Hosting/ToolApprovalIdMap.cs, dotnet/src/Microsoft.Agents.AI.Workflows.Declarative/ObjectModel/InvokeMcpToolExecutor.cs

[github-actions]

MAF Automated Review — Iteration 2

Result: Findings reported
Scope: 4 net-new commit(s): 5a6fd0ae276b, 86a35ab2251d, 419b32e91e12, 9d865ae2997a
Model: gpt-5.6-sol

Overview

The update adds explicit local-MCP invocation tracking and strengthens approval replay with fail-closed identity checks, one-shot decisions, failure-state preservation, and focused round-trip tests. Those guards cover normal, rejected, and replayed executions well. Two lifecycle gaps remain: concurrent tool invocation can race while updating the new tracking map, and interrupted runs can persist unconsumed tracking entries.

Reviewed the supplied incremental change set across correctness, security/reliability, architecture, and failure behavior.
2 verified findings remained after source verification (2 medium) across 2 files. Details are attached to the affected lines below.

Affected areas: dotnet/src/Microsoft.Agents.AI.Foundry.Hosting/ConsentAwareMcpClientAIFunction.cs, dotnet/src/Microsoft.Agents.AI.Foundry.Hosting/ToolApprovalIdMap.cs

[github-code-quality]

Code coverage overview

Languages: C#

C# / code-coverage/dotnet

main dc6617a	prompt-agent-tool-yi... 03f08f3	+/-
86%	86%	0%

View coverage of the 7 most impacted files.

File	main dc6617a	prompt-agent-tool-yi... 03f08f3	+/-
/home/runner/wo...SessionStore.cs	100%	56%	-44%
/home/runner/wo...pprovalIdMap.cs	95%	93%	-2%
/home/runner/wo...olExtensions.cs	100%	100%	0%
/home/runner/wo...putConverter.cs	91%	92%	+1%
/home/runner/wo...ponseHandler.cs	89%	92%	+3%
/home/runner/wo...ntAIFunction.cs	93%	97%	+4%
/home/runner/wo...putConverter.cs	81%	86%	+5%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.