Skip to content

fix: enforce toolset/promptset boundary on tools/call and prompts/get#3036

Merged
duwenxin99 merged 3 commits into
googleapis:mainfrom
sjhddh:fix/toolset-boundary-enforcement
May 8, 2026
Merged

fix: enforce toolset/promptset boundary on tools/call and prompts/get#3036
duwenxin99 merged 3 commits into
googleapis:mainfrom
sjhddh:fix/toolset-boundary-enforcement

Conversation

@sjhddh

@sjhddh sjhddh commented Apr 12, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Fix toolset boundary bypass (IDOR): tools/call previously resolved tools via resourceMgr.GetTool() without verifying the requested tool belongs to the current toolset, allowing clients to invoke any tool by name regardless of their toolset scope.
  • Fix promptset boundary bypass: Same issue existed for prompts/get with resourceMgr.GetPrompt().
  • Add ContainsTool() / ContainsPrompt() membership checks and enforce them in all four MCP protocol versions (v20241105, v20250326, v20250618, v20251125) before delegating to the global resource manager.

Fixes #2755

Test plan

  • Added unit tests for Toolset.ContainsTool() and Promptset.ContainsPrompt() (both positive and negative cases, including empty sets)
  • All existing tests pass (go test ./internal/tools/... ./internal/prompts/... ./internal/server/mcp/...)
  • Manual verification: configure two toolsets with different tools, connect to one, and confirm tools/call rejects tools from the other toolset

🤖 Generated with Claude Code

@sjhddh sjhddh requested a review from a team as a code owner April 12, 2026 17:13
@google-cla

google-cla Bot commented Apr 12, 2026

Copy link
Copy Markdown

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

gemini-code-assist[bot]
gemini-code-assist Bot reviewed Apr 12, 2026
View reviewed changes

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces ContainsPrompt and ContainsTool methods to the Promptset and Toolset structs, respectively, along with corresponding unit tests. These methods are used to verify that a requested prompt or tool belongs to the current set before global resolution in the MCP handlers. The review feedback points out that the current linear search implementation ($O(N)$) for these lookups could become a performance bottleneck as the number of items grows, suggesting a map-based approach for $O(1)$ efficiency.

Comment thread internal/prompts/promptsets.go
Comment thread internal/tools/toolsets.go
duwenxin99
duwenxin99 requested changes Apr 20, 2026
View reviewed changes

@duwenxin99 duwenxin99 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @sjhddh , the change LGTM overall except for the error messages. Please let me know once you fix them and I'll handle the merge process for you. Thank you for contributing!

Comment thread internal/server/mcp/v20241105/method.go
Comment thread internal/server/mcp/v20250326/method.go
Comment thread internal/server/mcp/v20241105/method.go
@duwenxin99

duwenxin99 commented Apr 20, 2026

Copy link
Copy Markdown
Contributor

You may want to squash the commits to get rid of the agent account that's missing CLA.

@sjhddh sjhddh force-pushed the fix/toolset-boundary-enforcement branch from 97edc7f to edb3e0c Compare April 21, 2026 06:10
@sjhddh

sjhddh commented Apr 21, 2026

Copy link
Copy Markdown
Contributor Author

@duwenxin99 Thanks! Fixed both:

  • Boundary violations on tools/call and prompts/get now return the same error message as genuinely missing tool/prompt (so clients can't distinguish the two cases) — applied across all four protocol versions.
  • Amended and force-pushed to drop the co-author trailer so the commit is signed by just my account for CLA.

Let me know if anything else needs polishing.

duwenxin99
duwenxin99 requested changes Apr 24, 2026
View reviewed changes
Comment thread internal/tools/toolsets.go
@sjhddh

sjhddh commented Apr 24, 2026

Copy link
Copy Markdown
Contributor Author

@duwenxin99 Thanks for the review! Pushed 1e5a7f2.

Switched ContainsTool / ContainsPrompt to O(1) map lookups, per the gemini-bot suggestion:

  • Added unexported toolNameSet / promptNameSet (map[string]struct{}) fields
  • Populated during Initialize alongside the existing slice/manifest builds
  • Kept a linear-scan fallback for when the struct is constructed directly (tests that bypass Initialize — zero-value contract preserved)
  • Updated the doc comments on both methods

Also updated three test files that diffed full Toolset/Promptset structs with cmp.Diff — switched to cmp.AllowUnexported / cmpopts.IgnoreUnexported so the new private cache doesn't break equality. go test ./internal/tools/... ./internal/prompts/... ./internal/server/... ./cmd/... is green.

sjhddh added 2 commits May 8, 2026 12:23
@sjhddh @duwenxin99
fix: enforce toolset/promptset boundary on tools/call and prompts/get
e1fca39 
tools/call and prompts/get resolved tools and prompts via the global
resourceMgr without verifying membership in the current toolset or
promptset. This allowed clients connected to a scoped toolset to invoke
any tool by name, bypassing toolset access boundaries (IDOR).

Add ContainsTool/ContainsPrompt membership checks and enforce them in
all four MCP protocol versions before delegating to resourceMgr. Return
the same "does not exist" error on boundary violation as on a truly
missing tool/prompt so clients cannot distinguish the two cases.

Fixes googleapis#2755
@sjhddh @duwenxin99
perf: use O(1) map lookups for ContainsTool/ContainsPrompt
eebbcec 
Addresses review feedback on the boundary-enforcement gate: previously
ContainsTool/ContainsPrompt performed a linear scan of ToolNames/PromptNames
on every tools/call and prompts/get. For large toolsets/promptsets this is
a measurable overhead on a hot path.

Introduce unexported toolNameSet/promptNameSet maps, populated during
Initialize, and use them for O(1) membership checks. Fall back to the
linear scan when the Toolset/Promptset was constructed directly (e.g., in
tests that bypass Initialize), preserving the zero-value contract.

Test comparisons that diff full Toolset/Promptset structs now use
cmp.AllowUnexported / cmpopts.IgnoreUnexported so the private cache
doesn't affect equality. All existing tests pass.
@duwenxin99 duwenxin99 force-pushed the fix/toolset-boundary-enforcement branch from 1e5a7f2 to eebbcec Compare May 8, 2026 17:47
@duwenxin99

duwenxin99 commented May 8, 2026

Copy link
Copy Markdown
Contributor

/gcbrun

@duwenxin99

duwenxin99 commented May 8, 2026

Copy link
Copy Markdown
Contributor

/gcbrun

@duwenxin99 duwenxin99 enabled auto-merge (squash) May 8, 2026 18:30
@duwenxin99 duwenxin99 merged commit c739b80 into googleapis:main May 8, 2026
14 checks passed
@release-please release-please Bot mentioned this pull request May 14, 2026
Merged
pavankrishna13 pushed a commit to pavankrishna13/genai-toolbox that referenced this pull request May 19, 2026
@sjhddh @duwenxin99 @pavankrishna13
fix: enforce toolset/promptset boundary on tools/call and prompts/get (…
9db2a5f 
…googleapis#3036)

## Summary
- **Fix toolset boundary bypass (IDOR)**: `tools/call` previously
resolved tools via `resourceMgr.GetTool()` without verifying the
requested tool belongs to the current toolset, allowing clients to
invoke any tool by name regardless of their toolset scope.
- **Fix promptset boundary bypass**: Same issue existed for
`prompts/get` with `resourceMgr.GetPrompt()`.
- Add `ContainsTool()` / `ContainsPrompt()` membership checks and
enforce them in all four MCP protocol versions (v20241105, v20250326,
v20250618, v20251125) before delegating to the global resource manager.

Fixes googleapis#2755

## Test plan
- [x] Added unit tests for `Toolset.ContainsTool()` and
`Promptset.ContainsPrompt()` (both positive and negative cases,
including empty sets)
- [x] All existing tests pass (`go test ./internal/tools/...
./internal/prompts/... ./internal/server/mcp/...`)
- [ ] Manual verification: configure two toolsets with different tools,
connect to one, and confirm `tools/call` rejects tools from the other
toolset

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Wenxin Du <117315983+duwenxin99@users.noreply.github.com>
Yuan325 added a commit that referenced this pull request May 21, 2026
@release-please @Yuan325
chore(main): release 1.3.0 (#3228)
b001006 
🤖 I have created a release *beep* *boop*
---


##
[1.3.0](v1.2.0...v1.3.0)
(2026-05-21)


### Features

* **auth:** Implement MCP auth tool-level scopes validation
([#3049](#3049))
([c528985](c528985))
* **looker:** Propagate client IP from incoming MCP requests to
downstream SDK calls
([#3253](#3253))
([75da6c2](75da6c2))
* Setup SQLCommenter and allow client metadata
([#3064](#3064))
([9f1f9b3](9f1f9b3))
* **tool/cloudsqladmin:** Add `cloud-sql-admin-execute-sql-many` and
`cloud-sql-admin-sql-many`
([#3083](#3083))
([ef300a8](ef300a8))


### Bug Fixes

* **auth/generic:** Fix generic auth expiration field and integration
with `authRequired`
([#3251](#3251))
([f4d16c0](f4d16c0))
* Enforce toolset/promptset boundary on tools/call and prompts/get
([#3036](#3036))
([c739b80](c739b80))
* **tools/http:** Prevent path traversal and base path scope escape
([#3218](#3218))
([80a6602](80a6602))
* **tools/looker:** Return a 401 error to MCP client when Looker returns
a 401 ([#3233](#3233))
([4f409a3](4f409a3))
* **tools/looker:** Strip wrapping quotes from filter values for
unquoted parameters
([#3273](#3273))
([1e3de96](1e3de96))
* **tools:** Initialize query result slices to empty array
([#3250](#3250))
([60ddf48](60ddf48))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com>
github-actions Bot pushed a commit that referenced this pull request May 21, 2026
@Yuan325 @release-please
deploy: chore(main): release 1.3.0 (#3228)
1d64c0d 
🤖 I have created a release *beep* *boop*
---

##
[1.3.0](v1.2.0...v1.3.0)
(2026-05-21)

### Features

* **auth:** Implement MCP auth tool-level scopes validation
([#3049](#3049))
([c528985](c528985))
* **looker:** Propagate client IP from incoming MCP requests to
downstream SDK calls
([#3253](#3253))
([75da6c2](75da6c2))
* Setup SQLCommenter and allow client metadata
([#3064](#3064))
([9f1f9b3](9f1f9b3))
* **tool/cloudsqladmin:** Add `cloud-sql-admin-execute-sql-many` and
`cloud-sql-admin-sql-many`
([#3083](#3083))
([ef300a8](ef300a8))

### Bug Fixes

* **auth/generic:** Fix generic auth expiration field and integration
with `authRequired`
([#3251](#3251))
([f4d16c0](f4d16c0))
* Enforce toolset/promptset boundary on tools/call and prompts/get
([#3036](#3036))
([c739b80](c739b80))
* **tools/http:** Prevent path traversal and base path scope escape
([#3218](#3218))
([80a6602](80a6602))
* **tools/looker:** Return a 401 error to MCP client when Looker returns
a 401 ([#3233](#3233))
([4f409a3](4f409a3))
* **tools/looker:** Strip wrapping quotes from filter values for
unquoted parameters
([#3273](#3273))
([1e3de96](1e3de96))
* **tools:** Initialize query result slices to empty array
([#3250](#3250))
([60ddf48](60ddf48))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> b001006
github-actions Bot pushed a commit to renovate-bot/googleapis-_-genai-toolbox that referenced this pull request May 21, 2026
@renovate-bot @release-please
deploy: chore(main): release 1.3.0 (googleapis#3228)
2d4c637 
🤖 I have created a release *beep* *boop*
---

##
[1.3.0](googleapis/mcp-toolbox@v1.2.0...v1.3.0)
(2026-05-21)

### Features

* **auth:** Implement MCP auth tool-level scopes validation
([googleapis#3049](googleapis#3049))
([c528985](googleapis@c528985))
* **looker:** Propagate client IP from incoming MCP requests to
downstream SDK calls
([googleapis#3253](googleapis#3253))
([75da6c2](googleapis@75da6c2))
* Setup SQLCommenter and allow client metadata
([googleapis#3064](googleapis#3064))
([9f1f9b3](googleapis@9f1f9b3))
* **tool/cloudsqladmin:** Add `cloud-sql-admin-execute-sql-many` and
`cloud-sql-admin-sql-many`
([googleapis#3083](googleapis#3083))
([ef300a8](googleapis@ef300a8))

### Bug Fixes

* **auth/generic:** Fix generic auth expiration field and integration
with `authRequired`
([googleapis#3251](googleapis#3251))
([f4d16c0](googleapis@f4d16c0))
* Enforce toolset/promptset boundary on tools/call and prompts/get
([googleapis#3036](googleapis#3036))
([c739b80](googleapis@c739b80))
* **tools/http:** Prevent path traversal and base path scope escape
([googleapis#3218](googleapis#3218))
([80a6602](googleapis@80a6602))
* **tools/looker:** Return a 401 error to MCP client when Looker returns
a 401 ([googleapis#3233](googleapis#3233))
([4f409a3](googleapis@4f409a3))
* **tools/looker:** Strip wrapping quotes from filter values for
unquoted parameters
([googleapis#3273](googleapis#3273))
([1e3de96](googleapis@1e3de96))
* **tools:** Initialize query result slices to empty array
([googleapis#3250](googleapis#3250))
([60ddf48](googleapis@60ddf48))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> b001006
github-actions Bot pushed a commit to rodineyw/mcp-toolbox that referenced this pull request May 21, 2026
@pull @release-please
deploy: chore(main): release 1.3.0 (googleapis#3228)
37848f1 
🤖 I have created a release *beep* *boop*
---

##
[1.3.0](googleapis/mcp-toolbox@v1.2.0...v1.3.0)
(2026-05-21)

### Features

* **auth:** Implement MCP auth tool-level scopes validation
([googleapis#3049](googleapis#3049))
([c528985](googleapis@c528985))
* **looker:** Propagate client IP from incoming MCP requests to
downstream SDK calls
([googleapis#3253](googleapis#3253))
([75da6c2](googleapis@75da6c2))
* Setup SQLCommenter and allow client metadata
([googleapis#3064](googleapis#3064))
([9f1f9b3](googleapis@9f1f9b3))
* **tool/cloudsqladmin:** Add `cloud-sql-admin-execute-sql-many` and
`cloud-sql-admin-sql-many`
([googleapis#3083](googleapis#3083))
([ef300a8](googleapis@ef300a8))

### Bug Fixes

* **auth/generic:** Fix generic auth expiration field and integration
with `authRequired`
([googleapis#3251](googleapis#3251))
([f4d16c0](googleapis@f4d16c0))
* Enforce toolset/promptset boundary on tools/call and prompts/get
([googleapis#3036](googleapis#3036))
([c739b80](googleapis@c739b80))
* **tools/http:** Prevent path traversal and base path scope escape
([googleapis#3218](googleapis#3218))
([80a6602](googleapis@80a6602))
* **tools/looker:** Return a 401 error to MCP client when Looker returns
a 401 ([googleapis#3233](googleapis#3233))
([4f409a3](googleapis@4f409a3))
* **tools/looker:** Strip wrapping quotes from filter values for
unquoted parameters
([googleapis#3273](googleapis#3273))
([1e3de96](googleapis@1e3de96))
* **tools:** Initialize query result slices to empty array
([googleapis#3250](googleapis#3250))
([60ddf48](googleapis@60ddf48))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> b001006
github-actions Bot pushed a commit to Jaleel-zhu/genai-toolbox that referenced this pull request May 21, 2026
@pull @release-please
deploy: chore(main): release 1.3.0 (googleapis#3228)
6c4e70d 
🤖 I have created a release *beep* *boop*
---

##
[1.3.0](googleapis/mcp-toolbox@v1.2.0...v1.3.0)
(2026-05-21)

### Features

* **auth:** Implement MCP auth tool-level scopes validation
([googleapis#3049](googleapis#3049))
([c528985](googleapis@c528985))
* **looker:** Propagate client IP from incoming MCP requests to
downstream SDK calls
([googleapis#3253](googleapis#3253))
([75da6c2](googleapis@75da6c2))
* Setup SQLCommenter and allow client metadata
([googleapis#3064](googleapis#3064))
([9f1f9b3](googleapis@9f1f9b3))
* **tool/cloudsqladmin:** Add `cloud-sql-admin-execute-sql-many` and
`cloud-sql-admin-sql-many`
([googleapis#3083](googleapis#3083))
([ef300a8](googleapis@ef300a8))

### Bug Fixes

* **auth/generic:** Fix generic auth expiration field and integration
with `authRequired`
([googleapis#3251](googleapis#3251))
([f4d16c0](googleapis@f4d16c0))
* Enforce toolset/promptset boundary on tools/call and prompts/get
([googleapis#3036](googleapis#3036))
([c739b80](googleapis@c739b80))
* **tools/http:** Prevent path traversal and base path scope escape
([googleapis#3218](googleapis#3218))
([80a6602](googleapis@80a6602))
* **tools/looker:** Return a 401 error to MCP client when Looker returns
a 401 ([googleapis#3233](googleapis#3233))
([4f409a3](googleapis@4f409a3))
* **tools/looker:** Strip wrapping quotes from filter values for
unquoted parameters
([googleapis#3273](googleapis#3273))
([1e3de96](googleapis@1e3de96))
* **tools:** Initialize query result slices to empty array
([googleapis#3250](googleapis#3250))
([60ddf48](googleapis@60ddf48))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> b001006
@BrewTestBot BrewTestBot mentioned this pull request May 21, 2026
Merged
github-actions Bot pushed a commit to pepe57/genai-toolbox that referenced this pull request May 22, 2026
@pull @release-please
deploy: chore(main): release 1.3.0 (googleapis#3228)
402bf8c 
🤖 I have created a release *beep* *boop*
---

##
[1.3.0](googleapis/mcp-toolbox@v1.2.0...v1.3.0)
(2026-05-21)

### Features

* **auth:** Implement MCP auth tool-level scopes validation
([googleapis#3049](googleapis#3049))
([c528985](googleapis@c528985))
* **looker:** Propagate client IP from incoming MCP requests to
downstream SDK calls
([googleapis#3253](googleapis#3253))
([75da6c2](googleapis@75da6c2))
* Setup SQLCommenter and allow client metadata
([googleapis#3064](googleapis#3064))
([9f1f9b3](googleapis@9f1f9b3))
* **tool/cloudsqladmin:** Add `cloud-sql-admin-execute-sql-many` and
`cloud-sql-admin-sql-many`
([googleapis#3083](googleapis#3083))
([ef300a8](googleapis@ef300a8))

### Bug Fixes

* **auth/generic:** Fix generic auth expiration field and integration
with `authRequired`
([googleapis#3251](googleapis#3251))
([f4d16c0](googleapis@f4d16c0))
* Enforce toolset/promptset boundary on tools/call and prompts/get
([googleapis#3036](googleapis#3036))
([c739b80](googleapis@c739b80))
* **tools/http:** Prevent path traversal and base path scope escape
([googleapis#3218](googleapis#3218))
([80a6602](googleapis@80a6602))
* **tools/looker:** Return a 401 error to MCP client when Looker returns
a 401 ([googleapis#3233](googleapis#3233))
([4f409a3](googleapis@4f409a3))
* **tools/looker:** Strip wrapping quotes from filter values for
unquoted parameters
([googleapis#3273](googleapis#3273))
([1e3de96](googleapis@1e3de96))
* **tools:** Initialize query result slices to empty array
([googleapis#3250](googleapis#3250))
([60ddf48](googleapis@60ddf48))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> b001006
github-actions Bot pushed a commit to CrazyForks/genai-toolbox that referenced this pull request May 22, 2026
@pull @release-please
deploy: chore(main): release 1.3.0 (googleapis#3228)
ebc4be2 
🤖 I have created a release *beep* *boop*
---

##
[1.3.0](googleapis/mcp-toolbox@v1.2.0...v1.3.0)
(2026-05-21)

### Features

* **auth:** Implement MCP auth tool-level scopes validation
([googleapis#3049](googleapis#3049))
([c528985](googleapis@c528985))
* **looker:** Propagate client IP from incoming MCP requests to
downstream SDK calls
([googleapis#3253](googleapis#3253))
([75da6c2](googleapis@75da6c2))
* Setup SQLCommenter and allow client metadata
([googleapis#3064](googleapis#3064))
([9f1f9b3](googleapis@9f1f9b3))
* **tool/cloudsqladmin:** Add `cloud-sql-admin-execute-sql-many` and
`cloud-sql-admin-sql-many`
([googleapis#3083](googleapis#3083))
([ef300a8](googleapis@ef300a8))

### Bug Fixes

* **auth/generic:** Fix generic auth expiration field and integration
with `authRequired`
([googleapis#3251](googleapis#3251))
([f4d16c0](googleapis@f4d16c0))
* Enforce toolset/promptset boundary on tools/call and prompts/get
([googleapis#3036](googleapis#3036))
([c739b80](googleapis@c739b80))
* **tools/http:** Prevent path traversal and base path scope escape
([googleapis#3218](googleapis#3218))
([80a6602](googleapis@80a6602))
* **tools/looker:** Return a 401 error to MCP client when Looker returns
a 401 ([googleapis#3233](googleapis#3233))
([4f409a3](googleapis@4f409a3))
* **tools/looker:** Strip wrapping quotes from filter values for
unquoted parameters
([googleapis#3273](googleapis#3273))
([1e3de96](googleapis@1e3de96))
* **tools:** Initialize query result slices to empty array
([googleapis#3250](googleapis#3250))
([60ddf48](googleapis@60ddf48))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> b001006
github-actions Bot pushed a commit to bhardwajRahul/genai-toolbox that referenced this pull request May 23, 2026
@pull @release-please
deploy: chore(main): release 1.3.0 (googleapis#3228)
e3bd116 
🤖 I have created a release *beep* *boop*
---

##
[1.3.0](googleapis/mcp-toolbox@v1.2.0...v1.3.0)
(2026-05-21)

### Features

* **auth:** Implement MCP auth tool-level scopes validation
([googleapis#3049](googleapis#3049))
([c528985](googleapis@c528985))
* **looker:** Propagate client IP from incoming MCP requests to
downstream SDK calls
([googleapis#3253](googleapis#3253))
([75da6c2](googleapis@75da6c2))
* Setup SQLCommenter and allow client metadata
([googleapis#3064](googleapis#3064))
([9f1f9b3](googleapis@9f1f9b3))
* **tool/cloudsqladmin:** Add `cloud-sql-admin-execute-sql-many` and
`cloud-sql-admin-sql-many`
([googleapis#3083](googleapis#3083))
([ef300a8](googleapis@ef300a8))

### Bug Fixes

* **auth/generic:** Fix generic auth expiration field and integration
with `authRequired`
([googleapis#3251](googleapis#3251))
([f4d16c0](googleapis@f4d16c0))
* Enforce toolset/promptset boundary on tools/call and prompts/get
([googleapis#3036](googleapis#3036))
([c739b80](googleapis@c739b80))
* **tools/http:** Prevent path traversal and base path scope escape
([googleapis#3218](googleapis#3218))
([80a6602](googleapis@80a6602))
* **tools/looker:** Return a 401 error to MCP client when Looker returns
a 401 ([googleapis#3233](googleapis#3233))
([4f409a3](googleapis@4f409a3))
* **tools/looker:** Strip wrapping quotes from filter values for
unquoted parameters
([googleapis#3273](googleapis#3273))
([1e3de96](googleapis@1e3de96))
* **tools:** Initialize query result slices to empty array
([googleapis#3250](googleapis#3250))
([60ddf48](googleapis@60ddf48))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> b001006
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@duwenxin99 duwenxin99 duwenxin99 approved these changes

+1 more reviewer

@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

@duwenxin99 duwenxin99

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

MCP toolset boundary bypass: tools/call can invoke tools outside toolset (IDOR)

2 participants

@sjhddh @duwenxin99