Python: Add MCPStreamableHTTPTool security guidance for custom http client

[Tao Chen (TaoChenOSU)]

Motivation & Context

This pull request updates the documentation for the __init__ method in the python/packages/core/agent_framework/_mcp.py file to clarify security considerations when configuring custom HTTP clients and headers. The main focus is on preventing sensitive header leakage during cross-origin redirects.

Security and documentation improvements:

• Added explicit warnings to the docstring about the risks of leaking sensitive headers (like authentication tokens) when using a custom http_client, and clarified that the framework's built-in header_provider only attaches headers to requests matching the configured origin. Users must enforce this origin-scoped policy themselves if supplying headers via a custom client.
• Clarified that the header_provider hook attaches headers only to requests matching the configured origin, and reiterated the need for users to enforce this policy when using custom clients.

Description & Review Guide

• What are the major changes?
  • Security and documentation improvements
• What is the impact of these changes?
  • Public guidance for our customers
• What do you want reviewers to focus on?
  • The accuracy of the commens

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

Pull request overview

This PR clarifies security considerations in the MCPStreamableHTTPTool.__init__ docstring (in the Python core MCP integration), specifically around preventing sensitive header leakage when users configure custom httpx.AsyncClient instances and redirects are involved.

Changes:

• Adds explicit guidance warning that attaching sensitive headers directly on a custom http_client requires user-enforced origin scoping to avoid cross-origin redirect leakage.
• Clarifies that the built-in header_provider mechanism only injects headers when the request origin (scheme/host/port) matches the configured MCP server url.
• Reiterates the distinction between safely using header_provider for per-call headers vs. setting default client headers.

[github-actions]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
packages/core/agent_framework
_mcp.py	1380	114	91%	253, 259, 368, 387, 608, 687–688, 802, 827, 878, 993, 996, 1006, 1010, 1057–1058, 1063, 1070–1071, 1078, 1083–1084, 1091–1092, 1096, 1101–1102, 1111, 1118–1119, 1137, 1150, 1174–1175, 1194–1197, 1199–1200, 1204, 1230, 1264–1266, 1268, 1321–1323, 1382–1383, 1666, 1707–1708, 1721, 1724, 1733–1734, 1739–1740, 1746, 1800–1801, 1821–1822, 1831–1832, 1837–1838, 1844, 1937, 1940, 1967, 1990–1994, 2017–2019, 2024, 2028–2029, 2131, 2138, 2140, 2211, 2226–2227, 2234–2235, 2240–2241, 2246, 2250, 2265, 2327, 2510, 2512, 2534, 2536–2539, 2552–2553, 2597, 2659, 3098–3099, 3336–3337, 3355
TOTAL	45097	5092	88%

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
9208	33 💤	0 ❌	0 🔥	2m 4s ⏱️

[github-actions]

Automated Code Review

Reviewers: 5 | Confidence: 95% | Result: All clear

Reviewed: Correctness, Security Reliability, Test Coverage, Failure Modes, Design Approach

---

Automated review by TaoChenOSU's agents