[Vincent Biret (baywet)]

Motivation & Context

An MCP tool's published metadata can change while an approval is pending. Revalidate that metadata before invoking the approved tool, and request a new approval when it has changed.

Description & Review Guide

• What are the major changes? Request consent before discovery, then request a separate tool approval bound to a canonical fingerprint of its published definition. Revalidate before invocation and reissue approval when the definition changes. Serialize the protocol tool metadata, including annotations and _meta.
• What is the impact of these changes? Approval-gated tool calls now require discovery consent followed by tool approval; tools/list itself needs only discovery consent. Configured headers are not sent before discovery consent. Handlers must return a structured tool list with complete SDK-supported definitions, or approval fails closed. Older checkpoints restart discovery approval. Refreshed requests do not embed the definition; comparison covers published metadata, not the server implementation's identity or changes between discovery and invocation.
• What do you want reviewers to focus on? The two-stage consent and restored-checkpoint behavior, handler compatibility, and metadata comparison.

Validation with the locally installed .NET SDK 10.0.403:

• dotnet test --project tests\Microsoft.Agents.AI.Workflows.Declarative.UnitTests -f net10.0 --no-restore: passed (1,388 tests).
• dotnet test --project tests\Microsoft.Agents.AI.Workflows.Declarative.Mcp.UnitTests -f net10.0 --no-restore: passed (58 tests).
• dotnet build src\Microsoft.Agents.AI.Workflows.Declarative.Mcp --no-restore --tl:off: passed for all targeted frameworks, including netstandard2.0 and net472 (zero warnings and errors).
• dotnet test --project tests\Microsoft.Agents.AI.Workflows.Declarative.UnitTests -f net472 --no-restore --filter-query "/*/Microsoft.Agents.AI.Workflows.Declarative.UnitTests.ObjectModel/InvokeMcpToolExecutorTest/*": passed (101 tests, on .NET Framework 4.8.1).
• dotnet test --project tests\Microsoft.Agents.AI.Workflows.Declarative.Mcp.UnitTests -f net472 --no-restore: passed (58 tests, on .NET Framework 4.8.1).
• dotnet format src\Microsoft.Agents.AI.Workflows.Declarative --no-restore --include src\Microsoft.Agents.AI.Workflows.Declarative\ObjectModel\InvokeMcpToolExecutor.cs src\Microsoft.Agents.AI.Workflows.Declarative\IMcpToolHandler.cs --verbosity minimal: passed.
• dotnet format src\Microsoft.Agents.AI.Workflows.Declarative.Mcp --no-restore --include src\Microsoft.Agents.AI.Workflows.Declarative.Mcp\DefaultMcpToolHandler.cs --verbosity minimal: passed.
• dotnet format tests\Microsoft.Agents.AI.Workflows.Declarative.UnitTests --no-restore --include tests\Microsoft.Agents.AI.Workflows.Declarative.UnitTests\ObjectModel\InvokeMcpToolExecutorTest.cs --verbosity minimal: passed.
• dotnet format tests\Microsoft.Agents.AI.Workflows.Declarative.Mcp.UnitTests --no-restore --include tests\Microsoft.Agents.AI.Workflows.Declarative.Mcp.UnitTests\DefaultMcpToolHandlerTests.cs --verbosity minimal: passed.

Full-solution tests were not run.

Related Issue

N/A - maintainer-directed change; no linked issue.

AI Assistance

• No material AI assistance was used.
• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details: implementation, tests, documentation, and PR description.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

🟡 Changes recommended

The default handler omits annotations from the metadata used for fingerprinting, allowing a tool to change from read-only to destructive without invalidating pending approval.

3 open issues

• Include annotations in the tool metadata fingerprint · New
• Handle approval separately for the reserved tools/list operation · New
• Canonicalize JSON before hashing tool metadata · New

What changed in this PR

This PR adds metadata revalidation to approval-gated MCP tool calls in .NET declarative workflows, preventing pending approvals from being reused when discovered tool definitions change.

Changes:

• Persist tool-definition fingerprints and compare them before approved invocation.
• Request fresh approval for changed metadata or legacy snapshots without fingerprints, and fail closed when discovery cannot verify the tool.
• Document the handler discovery requirement and expand approval and checkpoint tests.

File	Description
dotnet/​tests/​Microsoft.Agents.AI.Workflows.Declarative.UnitTests/​ObjectModel/​InvokeMcpToolExecutorTest.cs	Adds metadata-change and unavailable-definition tests; updates mocks and legacy approval expectations.
dotnet/​src/​Microsoft.Agents.AI.Workflows.Declarative/​ObjectModel/​InvokeMcpToolExecutor.cs	Adds discovery, fingerprint persistence, revalidation, and reapproval notices.
dotnet/​src/​Microsoft.Agents.AI.Workflows.Declarative/​IMcpToolHandler.cs	Documents the tools/list requirement for approval-gated handlers.

_{Review effort: Balanced}

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (1 commit(s)): 927bbe96c1be
Model: gpt-5.6-sol

Overview

The change snapshots a tool-definition fingerprint and revalidates it before invoking an approved MCP tool, with strong fail-closed handling for missing, malformed, ambiguous, legacy, and changed definitions. Pending-response matching, replay prevention, header redaction, and restore-time reapproval provide useful guardrails. The implementation nevertheless breaks legacy target builds, sends configured credentials before approval, permits incomplete tool representations to bypass metadata-change detection, and compares JSON representation rather than semantic metadata.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
4 verified findings remained after source verification (3 high, 1 medium) across 2 files. Details are attached to the affected lines below.

Affected areas: dotnet/src/Microsoft.Agents.AI.Workflows.Declarative/IMcpToolHandler.cs, dotnet/src/Microsoft.Agents.AI.Workflows.Declarative/ObjectModel/InvokeMcpToolExecutor.cs

[Copilot]

🟡 Changes recommended

Name-only tool definitions can receive fingerprints and authorize invocation without an inputSchema, violating the required fail-closed validation contract.

1 open issue

• Reject tool definitions missing a valid input schema · New

3 resolved since last review

• Include annotations in the tool metadata fingerprint
• Canonicalize JSON before hashing tool metadata
• Handle approval separately for the reserved tools/list operation

_{Review effort: Balanced}

[github-code-quality]

Code coverage overview

Languages: C#

C# / code-coverage/dotnet

main beba921	fix/approval-binding f61a282	+/-
86%	86%	0%

View coverage of the 3 most impacted files.

File	main beba921	fix/approval-binding f61a282	+/-
/home/runner/wo...SessionStore.cs	100%	56%	-44%
/home/runner/wo...ToolExecutor.cs	97%	93%	-4%
/home/runner/wo...pToolHandler.cs	83%	82%	-1%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

---

_{Updated November 10, 2026 19:34 UTC}

[Copilot]

🔵 Needs a closer look

Restoring between approvals can indefinitely restart tool discovery when workflow headers are configured, and WorkflowSession omits the discovery explanation and changed-definition warning from delivered approval content.

No open issues 🎉

2 previously missed issues

In code that hasn't changed since last review

Restore workflow approval state across discovery consent and invocation

dotnet/​src/​Microsoft.Agents.AI.Workflows.Declarative/​ObjectModel/​InvokeMcpToolExecutor.cs:236

With workflow headers configured, restoring between discovery consent and the new invocation approval clears _approvalHeaderSnapshots, so approving the tool restarts discovery instead of invoking it. Hosts such as WorkflowSession that restore on every turn repeat this indefinitely. Make the two-stage flow resume safely without persisting credentials, and add a regression that restores before each approval response.

Include discovery notices in delivered approval content

dotnet/​src/​Microsoft.Agents.AI.Workflows.Declarative/​ObjectModel/​InvokeMcpToolExecutor.cs:389

When consumed through WorkflowSession, these sibling notices are omitted from the delivered approval content because ExternalInputRequest.GetInnerRequestContent() selects only ToolApprovalRequestContent. Approval consumers therefore lose the discovery explanation and changed-definition warning. Preserve the accompanying text through the approval delivery contract and add a regression at the WorkflowSession boundary.

1 resolved since last review

• Reject tool definitions missing a valid input schema

_{Review effort: Balanced}