MCP Track A Phase 1: harden outbound token-based MCP actions

[Bionic711]

Summary

Implement Track A Phase 1 from #1013: baseline hardening for outbound MCP actions, with emphasis on Splunk/token-based streamable_http servers.

Scope

• Add a Splunk-friendly MCP preset/profile.
• Add safe custom_headers support in MCP additionalFields.
• Validate custom header names with a strict allowlist.
• Redact custom header values in logs, API responses, UI summaries, and test artifacts.
• Merge custom headers with auth headers in McpPluginFactory._build_headers, with auth headers winning by default.
• Improve endpoint and transport validation for streamable_http, sse, and websocket.
• Preserve the restriction that stdio is only available for admin-managed global actions.
• Add optional retry count/backoff settings for discovery and tool calls without changing existing defaults unexpectedly.
• Classify DNS/connect, TLS, authentication, MCP initialization, discovery, timeout, and tool execution failures.
• Extend schema/UI validation as needed.
• Add focused functional and UI tests.
• Bump application/single_app/config.py version when code changes are made.

Acceptance Criteria

• Existing MCP action manifests remain backward compatible.
• Splunk/token-based streamable_http MCP setup is easier and safer to configure.
• Custom headers are validated, merged, and redacted consistently.
• Endpoint/transport validation rejects unsupported or malformed values.
• Retry/timeout settings are bounded and preserve current default behavior.
• Discovery and tool-call failures return actionable, redacted error categories.
• Tests cover bearer header construction, custom header validation/redaction, discovery secret hydration, invalid/expired token error shapes, tool allowlist behavior, and manifest normalization.
• UI tests cover updated MCP modal behavior.
• Route policy tests are run if route files change.

Notes

Parent: #1013
Planning doc: docs/explanation/features/MCP_PLUGIN_ROBUSTNESS_PLAN.md
Priority: P1
Size: L

[Bionic711]

Update for v0.250.061:

Implemented a group action type scope fix that keeps group action creation independent from personal action governance.

What changed:

• Added /api/group/plugins/types for group-scoped action type discovery.
• Updated the shared action modal to select action type endpoints by scope:
  • personal: /api/user/plugins/types
  • group: /api/group/plugins/types
  • global/admin: /api/admin/plugins/types
• Ensured group action type discovery evaluates governance_group_actions instead of governance_user_actions.
• Added regression coverage in functional_tests/test_group_action_type_scope_routing.py.
• Updated release notes under v0.250.061.

Validation completed:

• python -m py_compile application\single_app\route_backend_plugins.py functional_tests\test_group_action_type_scope_routing.py
• node --check application\single_app\static\js\plugin_modal_stepper.js
• python -m pytest functional_tests\test_group_action_type_scope_routing.py -v
• python functional_tests\route_tests\test_route_blueprint_policy_inventory.py
• python functional_tests\route_tests\test_route_unauthenticated_policy_contract.py
• python functional_tests\route_tests\test_route_policy_test_coverage.py
• git -c core.whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol diff --check

[Bionic711]

Update for v0.250.062:

Implemented declarative MCP server presets so provider-specific MCP defaults are no longer hard-coded in the browser modal.

What changed:

• Added a server-side MCP preset catalog under application\single_app\mcp_presets.
• Added mcp_server_preset.schema.json for validating preset definitions.
• Added bundled generic.json and splunk.json definitions.
• Added functions_mcp_presets.py to load bundled presets and optional org-authored directories from SIMPLECHAT_MCP_PRESET_PATHS.
• Added authenticated route GET /api/plugins/mcp/presets so the modal receives transformed server-side definitions instead of reading files directly.
• Updated the MCP action modal to populate the preset dropdown from the API and apply preset defaults/constraints without hard-coded Splunk behavior.
• Updated mcp_plugin.additional_settings.schema.json so server_profile accepts validated preset ids instead of a fixed generic/splunk enum.
• Added authoring docs in docs\explanation\features\MCP_SERVER_PRESETS.md.
• Added regression coverage in functional_tests\test_mcp_server_presets.py and updated the MCP modal UI test mock.
• Added direct jsonschema==4.25.1 dependency because preset validation and existing plugin schema helpers rely on it.
• Updated release notes under v0.250.062.

Validation completed:

• python -m pip install jsonschema==4.25.1
• python -m py_compile application\single_app\functions_mcp_presets.py application\single_app\functions_mcp_operations.py application\single_app\route_backend_plugins.py functional_tests\test_mcp_server_presets.py ui_tests\test_workspace_mcp_action_modal.py
• node --check application\single_app\static\js\plugin_modal_stepper.js
• python -m pytest functional_tests\test_mcp_server_presets.py functional_tests\test_group_action_type_scope_routing.py -v
• python functional_tests\test_mcp_server_presets.py
• python functional_tests\route_tests\test_route_blueprint_policy_inventory.py
• python functional_tests\route_tests\test_route_unauthenticated_policy_contract.py
• python functional_tests\route_tests\test_route_policy_test_coverage.py
• git -c core.whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol diff --check

Validation notes:

• functional_tests\test_mcp_action_manifest_workflow.py could not run in the current global Python environment because semantic_kernel is not installed.
• ui_tests\test_workspace_mcp_action_modal.py could not run in the current global Python environment because playwright is not installed; the file was syntax-compiled successfully.

[Bionic711]

MCP planning checkpoint update:

• The master plan now includes Track A Phase 1B for outbound MCP destination governance and preconfigured server catalog planning.
• Added fine-grained outbound destination allowlisting requirements across personal, group, and global/admin action scopes.
• Destination policy must be enforced server-side during:
  • action create/update,
  • MCP discovery/probe,
  • runtime tool invocation.
• Added endpoint-safety/SSRF guardrails for URL normalization, unsafe schemes, embedded credentials, redirects, loopback/private/link-local/metadata-service ranges, and DNS rebinding-style risks.
• Clarified distinction between:
  • presets: compatibility defaults, such as Generic or Splunk,
  • preconfigurations: concrete create-from-template MCP server definitions, such as Microsoft Learn, Azure documentation, GitHub documentation, and local dev MCP.
• Preconfigurations are planned as server-side validated/sanitized catalog definitions, not browser-static JSON and never containing secrets.

[Bionic711]

Track A Phase 1B update completed for outbound MCP destination governance and preconfigurations.

What changed:

• Added server-side MCP destination policy helpers with normalization, allowlist matching, optional unsafe literal-IP blocking, and policy decisions for personal/group/global scopes.
• Enforced destination policy during personal/group/global action save/update, MCP tool discovery, and runtime connector creation.
• Added validated server-side MCP server preconfiguration catalog support with bundled Microsoft Learn, Azure documentation, GitHub, and local development definitions.
• Added authenticated /api/plugins/mcp/preconfigurations catalog API and modal support for applying selected preconfigurations.
• Added preconfiguration_id storage in MCP action manifests.
• Added docs/explanation/features/MCP_SERVER_PRECONFIGURATIONS.md and updated the MCP robustness plan and release notes for v0.250.064.

Validation:

• python -m py_compile application\single_app\functions_mcp_destinations.py application\single_app\functions_mcp_preconfigurations.py application\single_app\functions_mcp_operations.py application\single_app\semantic_kernel_plugins\mcp_plugin_factory.py application\single_app\route_backend_plugins.py application\single_app\config.py functional_tests\test_mcp_destination_governance_and_preconfigurations.py ui_tests\test_workspace_mcp_action_modal.py
• node --check application\single_app\static\js\plugin_modal_stepper.js
• python -m pytest functional_tests\test_mcp_destination_governance_and_preconfigurations.py functional_tests\test_mcp_server_presets.py -v (5 passed)
• python functional_tests\route_tests\test_route_blueprint_policy_inventory.py (6/6 passed)
• python functional_tests\route_tests\test_route_unauthenticated_policy_contract.py (4/4 passed)
• python functional_tests\route_tests\test_route_policy_test_coverage.py (2/2 passed)
• python functional_tests\test_mcp_destination_governance_and_preconfigurations.py
• git -c core.whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol diff --check

Notes:

• Destination governance is compatibility-off by default via ENABLE_MCP_DESTINATION_GOVERNANCE=false.
• Unsafe literal-IP blocking can be enabled independently with MCP_BLOCK_UNSAFE_DESTINATIONS=true.
• This slice adds config/env-backed policy hooks and runtime enforcement; admin UI for managing allowlists and catalog enablement remains a follow-up.

[Bionic711]

Track A Phase 1C is implemented locally for outbound MCP destination governance UI and policy persistence.

Summary:

• Added delegated item policy entity types for personal, group, and global MCP destination rules.
• Added Admin Settings > Governance controls for enabling MCP destination allowlist enforcement, unsafe literal-IP blocking, and creating scoped destination policies.
• Wired persisted destination policies into MCP action save/update, discovery, preconfiguration catalog filtering, and runtime connector checks where request/stored identity is available.
• Added JSON-body governance item-policy save/delete routes so URL-like destination patterns can be stored safely.
• Updated docs and release notes for v0.250.065.

Validation:

• Python syntax compilation for changed backend/test files passed.
• node --check application\single_app\static\js\admin\admin_governance.js passed.
• python -m pytest functional_tests\test_mcp_destination_governance_and_preconfigurations.py functional_tests\test_mcp_server_presets.py -v passed: 7 passed.
• Route policy tests passed: 6/6, 4/4, and 2/2.
• Standalone MCP governance functional test exited successfully.
• UI tests for admin MCP governance and workspace MCP modal skip cleanly in this environment because Playwright is not installed.
• git diff --check passed.

Notes:

• Destination governance remains compatibility-off by default.
• Per-definition preconfiguration enable/disable controls remain a future catalog-administration refinement; admins can allow/block specific preconfigurations now with preconfiguration:<id> destination policies.