Skip to content

Harden Spring AI raw provider diagnostics - #3

Closed
liuyun71378 wants to merge 1 commit into
sandking:mainfrom
liuyun71378:codex/harden-safe-registration-risk
Closed

Harden Spring AI raw provider diagnostics#3
liuyun71378 wants to merge 1 commit into
sandking:mainfrom
liuyun71378:codex/harden-safe-registration-risk

Conversation

@liuyun71378

Copy link
Copy Markdown
Contributor

No description provided.

@sandking

Copy link
Copy Markdown
Owner

Rejecting this PR as-is.

Reason:

  • It changes the default Spring AI external raw provider diagnostics from warn to fail.
  • That crosses the current library boundary. FastMCP Java should provide the safe provider path, hide managed raw providers it creates, and make external raw-provider risk visible through warning/audit/documentation. It should not fail application startup merely because the application context contains external ToolCallbackProvider beans.
  • If an application intentionally bypasses fastMcpSafeToolCallbackProvider and wires raw providers to the model, that is host-application wiring responsibility, not something this SDK should enforce by default.
  • fail is still useful as an explicit opt-in for applications that want fail-closed behavior, but the default should remain warn.

Acceptable direction: keep default warn, keep fail and off as explicit modes, and document fail as an opt-in production hardening choice.

@sandking sandking closed this Jun 30, 2026
@liuyun71378

Copy link
Copy Markdown
Contributor Author

Updated in 61210fc to match the requested direction: the default Spring AI external raw provider diagnostics mode remains warn, fail/off stay explicit modes, and docs now describe fail as an opt-in production hardening choice. Verified with mvn test and mvn -Pexamples test using JDK 21.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants