v3.7.0

Foundry IQ can now use approved, preprovisioned generic MCP Server knowledge sources. This capability is Preview, is disabled by default, and leaves the existing Foundry IQ retrieval path unchanged until explicitly enabled.

This release implements Azure/GPT-RAG#567 through the orchestrator runtime PR #275. It requires the provisioning changes in Azure/GPT-RAG#568. Do not enable this Preview until a GPT-RAG release containing PR #568 is available and deployed.

Added

• Generic MCP sources, planning, and results. Foundry IQ can plan across one or more approved mcpServer knowledge sources alongside existing source kinds. Enabled retrieval sends one user messages entry, uses low or medium reasoning, requests extractiveData with activity details, handles required and optional source failures, and normalizes successful flat, text, and structured MCP results into the existing citation contract.
• Request-scoped MCP authentication. Query-time credentials are resolved independently for every request and forwarded through Azure AI Search's paired knowledge-source control headers. Supported modes are managedIdentity, obo, keyVaultSecret, and none; Search authorization, document-security authorization, and MCP credentials remain separate.

Changed

• MCP-aware retrieval. Enabled requests apply configured planning, runtime, document, per-source, and per-tool output bounds. HTTP 206 activity is inspected so required-source failures fail closed while an explicitly optional source can preserve successful references as a partial result.
• Compatibility and rollback. FOUNDRY_IQ_MCP_ENABLED=false is the default and preserves the existing minimal-reasoning intents request and headers without MCP reasoning, activity, runtime, or credential controls. Roll back by disabling the flag or by returning to the prior orchestrator release; existing non-MCP retrieval configuration does not need to change.

Fixed

• Canonical and safe MCP configuration. Runtime validation follows the Search 2026-05-01-preview contract, including serverURL, strict discriminated output parsing, splitParameters, and reranked/always inclusion modes. It rejects unsafe endpoints, query strings, literal secrets, invalid header names, unsupported controls, and incomplete auth metadata.
• Security validation and redaction. MCP endpoints require HTTPS and an exact trusted-host match; localhost, IP literals, userinfo, fragments, and reserved hosts are rejected. Normal telemetry excludes credentials, endpoints, query strings, raw results, and tool arguments. Optional debug argument logging remains default-off and is bounded and recursively redacted.
• Disabled-path compatibility. Search OBO failures retain legacy logging and fallback behavior when MCP is disabled. Enabled MCP source, credential, transport, and required-source failures continue to propagate instead of being silently skipped.

Configuration

Key	Default	Purpose
FOUNDRY_IQ_MCP_ENABLED	false	Enables generic MCP Server sources. Keep disabled until GPT-RAG provisioning PR #568 ships in a GPT-RAG release.
FOUNDRY_IQ_MCP_SOURCES_JSON	[]	Validated non-secret source metadata: registered name, trusted serverURL, tools, parsing, inclusion, output limits, failure policy, and query-header credential metadata.
FOUNDRY_IQ_MCP_REASONING_EFFORT	low	Planning effort for enabled MCP retrieval. Supported values are low and medium.
FOUNDRY_IQ_MCP_TRUSTED_HOSTS	Unset	Exact comma-separated MCP host allowlist. Required when MCP is enabled.
FOUNDRY_IQ_MCP_LOG_TOOL_ARGUMENTS	false	Enables bounded, recursively redacted debug argument logging. Keep disabled in production unless approved.
FOUNDRY_IQ_MAX_RUNTIME_SECONDS	120	Existing Foundry IQ runtime ceiling; enabled MCP validation requires a value from 30 to 600 seconds.
FOUNDRY_IQ_MAX_OUTPUT_DOCUMENTS	Existing configured default	Existing final grounding-document limit, applied in addition to per-source and per-tool limits.

Each source uses an explicit tool allowlist. managedIdentity and obo require a downstream scope, keyVaultSecret requires a Key Vault secret name, and none forwards no credential. Literal credential values are never accepted in configuration.

See the tagged Generic MCP Server knowledge sources (Preview) README for the complete schema, security requirements, rollout, and rollback guidance.

Validation

• Full test suite: 457 passed.
• Focused Foundry IQ/MCP tests: 65 passed.
• Ruff passed on the relevant source and test files.
• python -m compileall -q src tests passed.
• Clean dependency installation and pip check passed using the repository's requirements and test dependencies. The repository's existing editable-install package-discovery limitation remains unchanged.
• Linux AMD64 Docker build completed successfully from the release source.
• Release diff and UTF-8 release-note scans passed.
• No live Azure end-to-end MCP call was run because the required preprovisioned generic MCP knowledge source and GPT-RAG provisioning release were not available in this isolated validation. Runtime metadata, endpoint, tool allowlist, identity/RBAC, and the Azure Monitor scenario still require validation in the deployment environment.

This release does not publish a container image.