[Eduard van Valkenburg (eavanvalkenburg)]

Motivation & Context

Generated MCP results must retain server-provided _meta.ifc even when generic Host payload budgets are exhausted. The result path must also fail closed for invalid identity IFC and preserve restrictions across parsing, retries, session persistence, and hidden replay.

This is the fifth and final layer of the upstream replacement stack for #9652. It isolates MCP IFC enforcement from the lower service-history, replay-authority, and AG-UI provenance layers.

Description & Review Guide

• What are the major changes? Generated MCP calls retain _meta.ifc through an independently bounded private carrier. Successful results combine local policy with server IFC. Invalid, oversized, or unretainable IFC fails closed. Parser, retry, session, serialization, and hidden-replay paths preserve or safely remove private metadata as required.
• What is the impact of these changes? MCP success and detailed-error results keep conservative IFC restrictions across payload exhaustion and persistence. There are no public API or breaking changes.
• What do you want reviewers to focus on? Review the IFC retention boundary, identity-principal validation, parser and terminal-error finalization, and private metadata cleanup. The deferred change to automatically hide untrusted MCP detailed-error text remains out of scope.

Related Issue

Fixes #9652

#9652 is the original source draft. This PR is its MCP IFC enforcement replacement layer, stacked as #9875 -> #9876 -> #9877 -> #9878 -> this PR rather than a competing implementation.

AI Assistance

• No material AI assistance was used.
• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details: GitHub Copilot assisted with implementation, regression tests, validation, and this PR description.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[github-code-quality]

Code coverage overview

Languages: Python

Python / code-coverage/python

main 7a166e7	fides-mcp-ifc-enforc... 4b600f4	+/-
92%	92%	0%

View coverage of the 5 most impacted files.

File	main 7a166e7	fides-mcp-ifc-enforc... 4b600f4	+/-
packages/core/a...ork/security.py	91%	90%	-1%
packages/core/a...ework/_tools.py	96%	95%	-1%
packages/core/a...work/_skills.py	96%	96%	0%
packages/core/a...amework/_mcp.py	92%	92%	0%
packages/monty/...te_code_tool.py	98%	98%	0%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

---

_{Updated November 13, 2026 11:11 UTC}

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (1 commit(s)): 39ebe60bfd7a
Model: gpt-5.6-sol

Overview

This PR adds an independently bounded private carrier for MCP IFC metadata and defers detailed-error label commits until terminal result finalization, with strong regression coverage for payload exhaustion, retries, session scope, invalid identity labels, and hidden replay. The carrier is invocation-local and its private metadata is removed from normal finalized results. One Medium regression remains: malformed IFC on a successful result can leave a non-serializable private authority marker in public result properties when label-tracking middleware is absent.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
1 verified finding remained after source verification (1 medium) across 1 file. Details are attached to the affected lines below.

Affected areas: python/packages/core/agent_framework/security.py

[Copilot]

🟡 Changes recommended

Critical IFC enforcement gaps allow malformed identity labels and post-wrapper result parsing to bypass security restrictions, including exposing restricted error details.

3 open issues

• Function result parsing discards retained IFC restrictions · New
• Malformed identity principals bypass fail-closed routing · New
• Security marker breaks serialization without label tracking · New

What changed in this PR

This PR adds the final MCP enforcement layer of the FIDES hardening stack, preserving information-flow labels across payload limits, retries, and session persistence.

Changes:

• Retains server IFC metadata independently of generic Host payload budgets and fails closed on invalid or unretainable metadata.
• Labels terminal MCP errors in the captured session scope and prevents carrier metadata from returning to hidden placeholders.
• Adds regressions for budget exhaustion, identity restrictions, retries, serialization, and hidden-result replay.

File	Description
python/​packages/​core/​tests/​test_security.py	Tests fail-closed handling of invalid and unretained IFC.
python/​packages/​core/​tests/​core/​test_mcp.py	Adds MCP label enforcement, error, persistence, and replay regressions.
python/​packages/​core/​agent_framework/​security.py	Enforces retained IFC and captures terminal-error labels and scope.
python/​packages/​core/​agent_framework/​_tools.py	Adds private carrier state, error finalization, and hidden-placeholder metadata handling.
python/​packages/​core/​agent_framework/​_mcp.py	Introduces independently bounded IFC retention and propagation.

_{Review effort: Balanced}

[github-actions]

MAF Automated Review — Iteration 2

Result: Findings reported
Scope: full PR (3 commit(s)): 615b6f2ed023, aa7855ef3aaf, 2dea793f5d76
Model: gpt-5.6-sol

Overview

The change adds an independently bounded private carrier for MCP IFC, validates identity principals, delays error-label commits until terminal finalization, and includes strong regressions for budget exhaustion, parsing, retries, persistence, and hidden replay. However, the default restriction-only path loses validated remote identity principals at the tracking boundary, allowing a cross-identity policy bypass, and an ambient outer tracker can cause nested direct MCP invocations to expose a non-serializable private marker.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
2 verified findings remained after source verification (1 high, 1 medium) across 1 file. Details are attached to the affected lines below.

Affected areas: python/packages/core/agent_framework/security.py

[Eduard van Valkenburg (eavanvalkenburg)]

/review

[github-actions]

MAF Automated Review — Iteration 3

Result: Findings reported
Scope: 3 net-new commit(s): 063b39c3edd9, 2381db5d43b0, 1e53250252f1
Model: gpt-5.6-sol

Overview

The change adds an independently bounded IFC carrier, applies retained labels after generated MCP parsers, and covers normal, parser-error, persistence, and concurrency paths with focused tests. Owner matching and terminal marker cleanup prevent private authority objects from leaking into serialized results. Three residual lifecycle gaps remain: nested identity provenance is stripped, raw Skills invocations skip their operation-scoped adapter, and shallow copies retain a postprocessor bound to the original tool.

Reviewed the supplied incremental change set across correctness, security/reliability, architecture, and failure behavior.
3 verified findings remained after source verification (2 high, 1 medium) across 2 files. Details are attached to the affected lines below.

Affected areas: python/packages/core/agent_framework/_tools.py, python/packages/core/agent_framework/security.py