[BUG][PLUGINS]: tool_pre_invoke gets executed post MCP Tool Call

[gnthaker]

🐞 Bug Summary

Briefly describe the issue or unexpected behavior.
Intention was to invoke custom code for license check before actual MCP tool gets invoked. When we added tool_pre_invoke as plugin, tool calls are not getting blocked as it seems tool gets executed before plugin gets called.

---

🧩 Affected Component

Select the area of the project impacted:

• mcpgateway - API
• mcpgateway - UI (admin panel)
• mcpgateway.wrapper - stdio wrapper
• Federation or Transports
• CLI, Makefiles, or shell scripts
• Container setup (Docker/Podman/Compose)
• Other (explain below)
  Tool Call

---

🔁 Steps to Reproduce

1. created a plugin with config.yaml and py file for plugin
2. start gateway with plugin
3. observe tool call execution

---

🤔 Expected Behavior

What should have happened instead?

---

📓 Logs / Error Output

Paste any relevant stack traces or logs here.
⚠️ Do not paste secrets, credentials, or tokens.

---

🧠 Environment Info

You can retrieve most of this from the /version endpoint.

Key	Value
Version or commit	e.g. v0.9.0 or main@a1b2c3d
Runtime	e.g. Python 3.11, Gunicorn
Platform / OS	e.g. Ubuntu 22.04, macOS
Container	e.g. Docker, Podman, none

---

🧩 Additional Context (optional)

Add any configuration details, flags, or related issues.

[gnthaker]

config.yaml
license_check_plugin.py

[MohanLaksh]

Bug Validation: CONFIRMED ✅

Summary

The bug is confirmed. The tool_pre_invoke hooks are executing correctly, but the resolve endpoint's exception handling causes the tool to execute anyway via the Rust fallback path.

---

Bug Location

File: mcpgateway/main.py
Lines: 9321-9322

except (PluginError, PluginViolationError):                                                                                                                                                                     
    raise  # ❌ BUG: Should return JSON-RPC error, not re-raise                                                                                                                                                 

---

Root Cause

When a tool_pre_invoke plugin returns continue_processing=False with violations_as_exceptions=True:

1. Plugin executes correctly → prepare_rust_mcp_tool_execution() calls tool_pre_invoke hooks at tool_service.py:3252-3258
2. Plugin blocks as expected → Plugin manager raises PluginViolationError at manager.py:369-373
3. Resolve endpoint fails → Exception is re-raised instead of converted to JSON-RPC error at main.py:9321-9322
4. Rust sees HTTP error → Interprets as ResolveToolsCallError::Fallback at lib.rs:8164-8176
5. Tool executes anyway → Rust falls back to Python's handle_internal_mcp_tools_call, bypassing the plugin block

---

Evidence from Code Flow

Rust Runtime (tools_rust/mcp_runtime/src/lib.rs)

  // Line 8063: Rust calls resolve endpoint                 
  let plan = match resolve_tools_call(state, &incoming_headers, &request, body.clone()).await {                                                                                                                   
      Ok(plan) => plan,                                                                                                                                                                                           
      Err(ResolveToolsCallError::Fallback(err)) => {                                                                                                                                                              
          // Line 8084: On error, falls back to Python                                                                                                                                                            
          return forward_tools_call_to_backend(state, incoming_headers.clone(), body.clone()).await;                                                                                                              
      }                                                                                                                                                                                                           
  }                                                                                                                                                                                                               

Python Resolve Endpoint (mcpgateway/main.py)

  # Line 3248-3258: Hooks run with violations_as_exceptions=True                                                                                                                                                  
  pre_result, _ = await plugin_manager.invoke_hook(                                                                                                                                                               
      ToolHookType.TOOL_PRE_INVOKE,                                                                                                                                                                               
      payload=ToolPreInvokePayload(...),                                                                                                                                                                          
      violations_as_exceptions=True,  # ← Raises exception instead of returning error                                                                                                                             
  )                                                                                                                                                                                                               
                                                                                                                                                                                                                  
  # Line 9321-9322: Exception is re-raised (BUG)                                                                                                                                                                  
  except (PluginError, PluginViolationError):                                                                                                                                                                     
      raise  # ❌ Should convert to JSON-RPC error                                                                                                                                                                

---

Why Tool Still Executes

The resolve endpoint's re-raise causes:

• HTTP 500/502 error response (or exception propagation)
• Rust interprets this as a fallback condition
• Rust forwards request to handle_internal_mcp_tools_call (Python execution path)
• Tool executes despite plugin returning continue_processing=False

User observation matches this: Plugin logs show tool_pre_invoke executing and blocking (DEBUG logs visible), but tool still runs.

---

Fix Required

Replace the re-raise with proper JSON-RPC error conversion (consistent with handle_internal_mcp_tools_call at lines 9192-9193):

 except (PluginError, PluginViolationError) as exc:
     request_id = body.get("id") if isinstance(body, dict) else None                                                                                                                                             
     status_code = 403                                                                                                                                                                                           
     error_message = str(exc)
     error_code = -32000                                                                                                                                                                                         
                                                           
     if isinstance(exc, PluginViolationError) and exc.violation:                                                                                                                                                 
         error_message = f"{exc.violation.code} - {exc.violation.reason}: {exc.violation.description}"
         if exc.violation.http_status_code:                                                                                                                                                                      
             status_code = exc.violation.http_status_code                                                                                                                                                        
                                                                                                                                                                                                                 
     return ORJSONResponse(                                                                                                                                                                                      
         status_code=status_code,                                                                                                                                                                                
         content={                                                                                                                                                                                               
             "jsonrpc": "2.0",
             "error": {"code": error_code, "message": error_message},                                                                                                                                            
             "id": request_id,                                                                                                                                                                                   
         },
     )                                                                                                                                                                                                           

---

Impact

• Severity: High - Breaks plugin-based access control
• Affected Path: Rust MCP runtime direct execution path only (when MCP_RUST_MODE=edge or full)
• Scope: All tool_pre_invoke plugins that return continue_processing=False fail to block tool execution
• Workaround: Use Python-only MCP mode (MCP_RUST_MODE=shadow or unset)

---

Additional Notes

The resolve endpoint docstring incorrectly claims the re-raise is needed for "plugin middleware," but utility_router has no plugin middleware—this is an internal Rust↔Python interface that must return structured JSON-RPC errors for correct error handling.