Enforce read-only and http mode in runtime (#2175)

[xiangyan99]

• Enforce read-only and http mode in runtime

• update

• updates

• updates

• address feedback

• fix tests

• update

What does this PR do?

[Provide a clear, concise description of the changes]

[Add additional context, screenshots, or information that helps reviewers]

GitHub issue number?

[Link to the GitHub issue this PR addresses]

Pre-merge Checklist

• Required for All PRs
  • Read contribution guidelines
  • PR title clearly describes the change
  • Commit history is clean with descriptive messages (cleanup guide)
  • Added comprehensive tests for new/modified functionality
  • Created a changelog entry if the change falls among the following: new feature, bug fix, UI/UX update, breaking change, or updated dependencies. Follow the changelog entry guide
• For MCP tool changes:
  • One tool per PR: This PR adds or modifies only one MCP tool for faster review cycles
  • Updated servers/Azure.Mcp.Server/README.md and/or servers/Fabric.Mcp.Server/README.md documentation
  • Validate README.md changes running the script ./eng/scripts/Process-PackageReadMe.ps1. See Package README
  • For new or modified tool descriptions, ran ToolDescriptionEvaluator and obtained a score of 0.4 or more and a top 3 ranking for all related test prompts
  • For tools with new names, including new tools or renamed tools, update consolidated-tools.json
  • For renamed tools, follow the Tool Rename Checklist and tag the PR with the breaking-change label
  • For new tools associated with Azure services or publicly available tools/APIs/products, add URL to documentation in the PR description
• Extra steps for Azure MCP Server tool changes:
  • Updated command list in servers/Azure.Mcp.Server/docs/azmcp-commands.md
  • Ran ./eng/scripts/Update-AzCommandsMetadata.ps1 to update tool metadata in azmcp-commands.md (required for CI)
  • Updated test prompts in servers/Azure.Mcp.Server/docs/e2eTestPrompts.md
  • 👉 For Community (non-Microsoft team member) PRs:
    • Security review: Reviewed code for security vulnerabilities, malicious code, or suspicious activities before running tests (crypto mining, spam, data exfiltration, etc.)
    • Manual tests run: added comment /azp run mcp - pullrequest - live to run Live Test Pipeline

[Copilot]

Pull request overview

This PR tightens enforcement of read-only and HTTP mode restrictions by validating tool eligibility at tool execution time (not only when listing tools), and adds unit tests to cover the new behavior.

Changes:

• Enforce read-only / HTTP mode restrictions during CallTool execution across multiple tool loader implementations.
• Adjust tool list caching to retain unfiltered tool metadata for execution-time validation while still returning filtered tool lists to callers.
• Add unit tests covering execution-time enforcement scenarios for each affected loader, plus a changelog entry.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
servers/Azure.Mcp.Server/changelog-entries/1774310978413.yaml	Adds changelog entry for the runtime enforcement behavior change.
core/Microsoft.Mcp.Core/src/Areas/Server/Commands/ToolLoading/SingleProxyToolLoader.cs	Caches unfiltered tool lists and enforces read-only/HTTP restrictions before proxy execution.
core/Microsoft.Mcp.Core/src/Areas/Server/Commands/ToolLoading/ServerToolLoader.cs	Caches unfiltered child tools and validates resolved commands (including after sampling) against mode restrictions at execution time.
core/Microsoft.Mcp.Core/src/Areas/Server/Commands/ToolLoading/RegistryToolLoader.cs	Stores tool metadata in the registry map and enforces read-only/HTTP restrictions at call time.
core/Microsoft.Mcp.Core/src/Areas/Server/Commands/ToolLoading/NamespaceToolLoader.cs	Blocks execution of non-read-only / local-required commands when running in read-only or HTTP mode.
core/Microsoft.Mcp.Core/src/Areas/Server/Commands/ToolLoading/CommandFactoryToolLoader.cs	Blocks execution of non-read-only / local-required commands when running in read-only or HTTP mode.
core/Azure.Mcp.Core/tests/Azure.Mcp.Core.UnitTests/Areas/Server/Commands/ToolLoading/SingleProxyToolLoaderTests.cs	Adds execution-time enforcement tests for read-only and HTTP mode.
core/Azure.Mcp.Core/tests/Azure.Mcp.Core.UnitTests/Areas/Server/Commands/ToolLoading/ServerToolLoaderTests.cs	Adds execution-time enforcement tests, including sampling-related scenarios.
core/Azure.Mcp.Core/tests/Azure.Mcp.Core.UnitTests/Areas/Server/Commands/ToolLoading/RegistryToolLoaderTests.cs	Adds execution-time enforcement tests for read-only and HTTP mode.
core/Azure.Mcp.Core/tests/Azure.Mcp.Core.UnitTests/Areas/Server/Commands/ToolLoading/NamespaceToolLoaderTests.cs	Adds execution-time enforcement tests for read-only and HTTP mode.
core/Azure.Mcp.Core/tests/Azure.Mcp.Core.UnitTests/Areas/Server/Commands/ToolLoading/CommandFactoryToolLoaderTests.cs	Adds execution-time enforcement tests for read-only and HTTP mode.

[vukelich]

LGTM. I'm assuming there are no differences with the previously reviewed and noted #2175. If there were any quirks for merging this to the release branch but not main, please let me know for me to give a closer look.