fix(mcp): reject config-supplied stdio MCP servers by default

[yusmer96-maker]

Link to Issue or Description of Change

2. Or, if no issue exists, describe the change:

Problem:

McpToolset.from_config() accepts stdio_server_params /
stdio_connection_params directly from an agent config. Those carry a command
and args that the MCP stdio transport launches as a local process, so loading
an agent config can start an arbitrary process on the first agent turn — before
the model is contacted.

Agent configs are not necessarily authored by the person running the agent: they
are shared as bundles, templates, samples and registry entries. That makes
config loading equivalent to code execution for anyone who runs an agent they
did not write.

ADK already treats this input as untrusted elsewhere: the args key is blocked
for Agent Builder uploads (fast_api.py) and for disk loads when the web UI is
enabled (config_agent_utils._set_enforce_yaml_key_denylist). It was simply not
enforced on the default adk run / adk api_server paths.

Solution:

from_config() now rejects stdio connection params unless the embedding
application explicitly opts in via _set_allow_config_stdio_servers(True).
Applications that legitimately launch local MCP servers from config keep working
by opting in; everything else fails closed.

Unaffected: remote transports (sse_connection_params,
streamable_http_connection_params), constructing McpToolset directly in
code, and applications that opt in.

Testing Plan

Unit Tests:

• I have added or updated unit tests for my change.
• All unit tests pass locally.

pytest tests/unittests/tools/mcp_tool/test_mcp_toolset.py -k from_config

• test_from_config_with_credential_key (updated to opt in)
• test_from_config_rejects_stdio_server_params
• test_from_config_rejects_stdio_connection_params
• test_from_config_allows_stdio_when_opted_in
• test_from_config_allows_remote_connection_params

Manual End-to-End (E2E) Tests:

Two agent bundles, each a single root_agent.yaml, run with adk run.

1 — stdio MCP server declared in an agent config (now rejected):

tools:
  - name: McpToolset
    args:
      stdio_server_params:
        command: npx
        args: ["-y", "@modelcontextprotocol/server-filesystem", "/tmp"]
      tool_filter: []

adk run now fails at config load with the new ValueError. Before this
change the same config launched the configured command on the first turn.

2 — remote MCP server in an agent config (unchanged):

tools:
  - name: McpToolset
    args:
      sse_connection_params:
        url: https://example.com/sse
      tool_filter: []

The toolset builds normally and the run proceeds to the model step, confirming
remote transports are not affected.

Additional context

Reported through the Google VRP (issue 541474207); this PR is the corresponding
fix. Related hardening on the same surface in the Go SDK: google/adk-go#923.

[yusmer96-maker]

any updates?

[yusmer96-maker]

??

[yusmer96-maker]

Hi @wukath,

The commit landed on Aug 10 (fix(mcp): reject stdio MCP servers declared in agent configs by default) implements what this PR proposed on Aug 1 — same opt-in function name _set_allow_config_stdio_servers, same rejection point in from_config(), same error message opening, and the same test names (test_from_config_rejects_stdio_server_params, test_from_config_allows_remote_connection_params). The env var and tri-state override are genuine improvements on what I wrote.

This repo normally preserves external contributors as co-authors through the export pipeline — the elicitation_callback, header-provider and sampling-callback commits on this same file all do it. Could a Co-authored-by trailer or a reference to #6547 be added here as well?

Happy to close this PR once that's recorded.