MCP questions

[jacobreesmontgomery]

A couple of questions:

1. Why was the decision made to require users to pass every single allowable MCP tool for a Foundry agent, as opposed to by default allowing all tools from the provided MCP tool to be executable? I've noticed a lot of issues when you don't pass any tools, such as indefinite running of the agent that requires me to shut down the application and reboot it. Also, I would think there should be some preventative logic to check tools passed via allowed_tools to see if they're actually valid.
2. In the scenario of requiring an approval, where do I approve these requests from the Foundry agent? I am not seeing anything in the Foundry UI nor in the logs to be able to approve the next step, and the documentation itself is very unclear on this.

[jacobreesmontgomery]

Another thing: I think documentation surrounding server_url should be improved. I'm still unclear on what MCP servers are compatible with this. Should I be looking for "remote MCP servers" such as here? If so, are there caveats to this?

[jacobreesmontgomery]

@hfritz34

[hfritz34]

1. Security by design - Explicit allowed_tools follows security best practices since MCP servers are third-party services that could expose dangerous functions. It prevents accidental access to unintended tools and follows least privilege principles. The indefinite running issue you're experiencing is likely a bug in how the system handles missing or invalid tools, you should report this to Microsoft as there should definitely be validation logic to check if specified tools actually exist on the MCP server.

2. Programmatic approval only - The approval process isn't handled through the Foundry UI. When a run hits requires_action status, you need to poll the run via REST API/SDK, extract the call_id from the response, and submit approval programmatically with approve: true. Microsoft hasn't provided a UI component for this yet, which is why you can't find it in the interface. For now, either implement your own approval workflow via API or set require_approval: "never" for trusted tools.

[jacobreesmontgomery]

Are there instructions anywhere on how to approve a run programatically?

[roger-g-hatteland]

I'm looking for the same. It would be nice with some sample code if possible?

[jacobreesmontgomery]

@hfritz34 , could you please reply?

[mbaiza27]

Hi @jacobreesmontgomery and @roger-g-hatteland was able to track down some sample code here: https://learn.microsoft.com/en-us/azure/ai-foundry/agents/how-to/tools/model-context-protocol-samples?pivots=python

let me know if this helps!