.NET: [Feature Request] Function Invocation Middleware for Nested Tools (HITL Support)

[gtkpad]

Use Case

We need to intercept MCP tool invocations within nested agents (e.g., FinancialAgent called via handoff from TriageAgent) to implement Human-in-the-Loop (HITL) approval workflows.

Our application requires user confirmation before executing write operations (create transactions, update budgets, delete records). The workflow involves:

1. User sends message to TriageAgent
2. TriageAgent hands off to FinancialAgent (or other specialized agent)
3. FinancialAgent invokes MCP tools (e.g., register_expense)
4. Before tool execution, we need to suspend workflow and request user approval
5. Resume workflow after approval with same context

Current Limitation

• response.Messages only exposes top-level handoffs (e.g., handoff_to_1)
• MCP tool invocations within handoffed agents are hidden from the response
• No callback API available to intercept tool execution before it occurs
• Documentation references CallbackMiddleware<AgentFunctionInvocationCallbackContext> but classes don't exist in preview

Evidence from our investigation:

// What we receive in response.Messages:
FunctionCallContent { Name: "handoff_to_1" }  // ❌ Handoff, not tool name

// What we need to intercept:
FunctionCallContent { Name: "register_expense" }  // ✅ Actual MCP tool

Package version tested: Microsoft.Agents.AI 1.0.0-preview.260212.1

Requested API

1. Function Invocation Callback Middleware

public class AgentFunctionInvocationCallbackContext
{
    public AIFunction Function { get; set; }
    public AIFunctionArguments Arguments { get; set; }
    public bool Terminate { get; set; }  // Suspend workflow before execution
}

public abstract class CallbackMiddleware<TContext>
{
    public abstract Task OnProcessAsync(
        TContext context,
        Func<TContext, Task> next,
        CancellationToken cancellationToken);
}

2. Expose Nested Tool Calls in Response

Either:

• Option A: Include nested tool invocations in response.Messages (e.g., register_expense alongside handoff_to_1)
• Option B: Invoke callbacks BEFORE tool execution (even for nested tools within handoffs)

3. Checkpoint Resumption with Context

• Resume workflow from suspended state after approval
• Restore exact context at suspension point
• Execute approved tool with original arguments

Workaround Impact

Without this API:

• ❌ ALL write operations execute without user confirmation
• ❌ Violates GDPR/LGPD compliance (no explicit consent for data mutations)
• ❌ Cannot implement HITL workflows for 22 critical operations
• ❌ Users may create accidental transactions/deletions

Business Impact: Cannot deploy to production without HITL compliance.

Related Documentation

• ADR-0007 mentions callback patterns: https://github.com/microsoft/agent-framework/blob/main/docs/decisions/0007-agent-filtering-middleware.md
• .UseCallbacks() exists but requires CallbackMiddleware<T> (not available)

Proposed Timeline

This is a blocking issue for production deployment. We have prepared code for callback implementation and are ready to integrate as soon as the API is available.

Thank you for considering this feature request!