DP-4 slice ⑤a (#671) added input guardrails over MCP — tool arguments run through the same guardrail chain as LLM input (check_input), blocking with a JSON-RPC error before the upstream is reached.
The output side (scanning the tool result with check_output — catching secrets/PII a tool returns) is not yet done. It needs the /mcp handler to buffer the gateway response body, extract the JSON-RPC result, synthesize a ChatResponse (ChatMessage::assistant(result_text)), run Guardrail::check_output(&chain, &resp), and on Block replace the result with a JSON-RPC error — mirroring the input path. Reuse the same env/key/team-scoped chain already resolved in the handler.
This completes guardrails-over-MCP (input + output), matching what LiteLLM does (input pre_mcp_call + output async_post_mcp_tool_call_hook) — but on the single DP pipeline. Refs AISIX-Cloud#894.
DP-4 slice ⑤a (#671) added input guardrails over MCP — tool arguments run through the same guardrail chain as LLM input (
check_input), blocking with a JSON-RPC error before the upstream is reached.The output side (scanning the tool result with
check_output— catching secrets/PII a tool returns) is not yet done. It needs the/mcphandler to buffer the gateway response body, extract the JSON-RPCresult, synthesize aChatResponse(ChatMessage::assistant(result_text)), runGuardrail::check_output(&chain, &resp), and on Block replace the result with a JSON-RPC error — mirroring the input path. Reuse the same env/key/team-scoped chain already resolved in the handler.This completes guardrails-over-MCP (input + output), matching what LiteLLM does (input
pre_mcp_call+ outputasync_post_mcp_tool_call_hook) — but on the single DP pipeline. Refs AISIX-Cloud#894.