[Eduard van Valkenburg (eavanvalkenburg)]

Motivation & Context

Make AgentMCPTool validate incoming arguments against the same JSON Schema it advertises through list_tools(). The adapter now enforces the configured parameter constraints before converting arguments, running the agent, or accessing the session store.

Description & Review Guide

• What are the major changes? Validate the complete generated schema with jsonschema, declare the direct dependency, and add regression coverage for direct calls and both native MCP protocol modes. Update the package documentation and consumer hosting guidance, including the native MCP callback example.
• What is the impact of these changes? Arguments that violate required fields, types, enum values, numeric bounds, constants, or additional-property constraints return INVALID_PARAMS before execution or session-store access. Valid configured chat options still override agent defaults. The generic conversion helpers, public API signatures, and application-owned authentication and session policies remain unchanged.
• What do you want reviewers to focus on? Full-schema behavior, including nested constraints, local references, composition, and whole-number floats; the distinction between invalid arguments and invalid host schemas; and the zero-execution/zero-store assertions for rejected calls with absent, fresh, and existing sessions.

Local checks on the updated base:

• uv run --directory python --package agent-framework-hosting-mcp --locked --group dev --no-sync pytest -p no:cacheprovider --import-mode=importlib packages/hosting-mcp/tests/hosting_mcp -m 'not integration' - passed: 329 tests, one integration test deselected, and the existing SessionStore experimental warning.
• uv build --project python/packages/hosting-mcp --no-sources --out-dir "$build_dir" - passed: source distribution and wheel built. build_dir was an output directory outside the checkout.

Related Issue

N/A

AI Assistance

• No material AI assistance was used.
• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details: GitHub Copilot assisted with the implementation, tests, documentation, and PR description.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

🟢 Approval recommended

No active review issues are reported for the changes enforcing JSON Schema validation before argument conversion and agent execution.

No open issues 🎉

What changed in this PR

This PR makes Python’s AgentMCPTool enforce its advertised JSON Schema before argument conversion, agent execution, or session-store access.

Changes:

• Add full-schema validation, returning INVALID_PARAMS for invalid arguments while allowing schema configuration errors to propagate.
• Add regression coverage for direct calls and both native MCP protocol modes, including rejected calls causing no execution or session-store access.
• Declare jsonschema as a direct dependency and update documentation and native MCP callback examples.

File	Description
skills/​agent-framework-builder-python/​references/​hosting-and-deployment.md	Clarifies adapter validation and direct-conversion responsibilities.
python/​uv.lock	Records the direct jsonschema dependency.
python/​packages/​hosting-mcp/​tests/​hosting_mcp/​test_agent_tool.py	Tests schema constraints, protocol modes, option overrides, and rejection side effects.
python/​packages/​hosting-mcp/​README.md	Documents validation behavior and updates native MCP examples.
python/​packages/​hosting-mcp/​pyproject.toml	Declares the supported jsonschema dependency range.
python/​packages/​hosting-mcp/​AGENTS.md	Updates guidance on the adapter’s validation responsibilities.
python/​packages/​hosting-mcp/​agent_framework_hosting_mcp/​_agent_tool.py	Validates arguments against the generated schema before conversion and execution.

_{Review effort: Balanced}

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (1 commit(s)): de5aa6320957
Model: gpt-5.6-sol

Overview

The PR validates AgentMCPTool arguments against its generated schema and has strong regression coverage across direct calls, both MCP protocol modes, nested constraints, and session-store isolation. Invalid ordinary inputs are rejected before conversion, agent execution, or session access. One residual risk remains: synchronous evaluation of a host-configured backtracking regex can let a small untrusted argument stall the shared event loop.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
1 verified finding remained after source verification (1 medium) across 1 file. Details are attached to the affected lines below.

Affected areas: python/packages/hosting-mcp/agent_framework_hosting_mcp/_agent_tool.py

[github-actions]

MAF Automated Review — Iteration 2

Result: No findings
Scope: 1 net-new commit(s): 0edaddf53a3a
Model: gpt-5.6-sol

Overview

This incremental commit documents the configured-schema trust boundary, synchronous event-loop validation, absence of an execution timeout, and the need for a terminable process boundary across the package and hosting guidance. The existing implementation centralizes advertised and enforced schema generation, and its regression matrix verifies rejection before conversion, agent execution, or session-store access across direct and native MCP paths. The documentation-only range introduces no publishable Critical, High, or Medium defect.

Reviewed the supplied incremental change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.