feat: Enhanced Tool Annotations Intelligence (Spec 035)#342
Open
feat: Enhanced Tool Annotations Intelligence (Spec 035)#342
Conversation
Extend calculateToolApprovalHash to include serialized tool annotations in the SHA-256 hash. This detects "annotation rug-pulls" where a malicious server flips behavioral hints (e.g., destructiveHint from true to false) without changing the tool description or schema. Nil annotations contribute an empty string to maintain backward compatibility with tools approved before annotation tracking. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add annotation coverage reporting endpoint that shows how many upstream tools have MCP annotations (hint booleans) vs those that don't, broken down by server. A tool counts as annotated only if at least one of ReadOnlyHint, DestructiveHint, IdempotentHint, or OpenWorldHint is set (Title alone does not count). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…filtering to retrieve_tools (Spec 035 F2+F4) F2: Session risk analysis examines all connected servers' tool annotations to detect the "lethal trifecta" — open-world access + destructive capabilities + write access. Returns risk level (high/medium/low) in every retrieve_tools response as session_risk, with a warning when the trifecta is present. F4: Three new optional boolean parameters (read_only_only, exclude_destructive, exclude_open_world) allow agents to self-restrict tool discovery scope based on MCP annotation hints. Nil annotations are treated as most permissive per spec. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…35 F3) When a tool call is made via call_tool_read/write/destructive, code_execution, or direct routing mode, check if the called tool has openWorldHint=true (or nil, which defaults to true per MCP spec). Tag the activity record metadata with "content_trust": "untrusted" for open-world tools, or "trusted" for closed-world tools (openWorldHint=false). This enables downstream security review of tool outputs that may contain untrusted external data. Changes: - Add IsOpenWorldTool() and ContentTrustForTool() helpers in contracts/intent.go - Add content_trust field to EmitActivityToolCallCompleted event payload - Add content_trust extraction in handleToolCallCompleted and handleInternalToolCall activity service handlers - Add EmitActivityInternalToolCallWithContentTrust for code_execution path - Compute content trust in handleCallToolVariant, makeDirectModeHandler, and code_execution handler (any open-world tool call marks entire execution) - Add comprehensive tests: TestIsOpenWorldTool, TestContentTrustForTool, TestHandleToolCallCompleted_ContentTrust, TestHandleInternalToolCall_ContentTrust Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Deploying mcpproxy-docs with
|
| Latest commit: |
a6fd18b
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://7349c162.mcpproxy-docs.pages.dev |
| Branch Preview URL: | https://035-enhanced-annotations.mcpproxy-docs.pages.dev |
📦 Build ArtifactsWorkflow Run: View Run Available Artifacts
How to DownloadOption 1: GitHub Web UI (easiest)
Option 2: GitHub CLI gh run download 23042267110 --repo smart-mcp-proxy/mcpproxy-go
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements all 5 features from Spec 035 — leveraging MCP tool annotations for security-aware routing, quarantine protection, session-level risk analysis, and smarter tool discovery.
F1: Annotation Change Detection in Quarantine
destructiveHintfrom true→false)F2: Lethal Trifecta Session Risk Analysis
retrieve_toolsresponse includessession_riskfield analyzing all connected serversF3: openWorldHint Enhanced Scanning
openWorldHint=truetools tagged withcontent_trust: untrustedin activity metadatacode_executionsandboxF4: Annotation-Based Filtering in retrieve_tools
read_only_only,exclude_destructive,exclude_open_worldF5: Annotation Coverage Reporting
GET /api/v1/annotations/coverageTest plan
🤖 Generated with Claude Code