[RFC] Hardening MCP Tool Trust Boundaries (Sanitization, Output Caps & Dynamic Schema Drift)

# [RFC] Hardening MCP Tool Trust Boundaries (Sanitization, Output Caps, Timeouts & Dynamic Schema Drift) **Applies to:** `langchain-ai/langchain-mcp-adapters` **Author disclosure:** This RFC and the accompanying implementation were prepared with AI assistance (Claude Code). The investigation, code, and test results have been reviewed and are owned by the submitter, who can walk through any part of it. --- ## 1. Problem Statement `langchain-mcp-adapters` is the trust boundary between a LangChain/LangGraph agent and whatever is on the other end of an MCP connection. Today, that boundary treats the MCP server as fully trusted at every layer it touches. Three specific gaps compound into one architectural problem: ### 1.1 `tool.description` is a live prompt-injection surface with no sanitization step `convert_mcp_tool_to_langchain_tool` (`langchain_mcp_adapters/tools.py:528-536`) forwards the server-supplied description straight into `StructuredTool`: ```python return StructuredTool( name=lc_tool_name, description=tool.description or "", args_schema=tool.inputSchema, coroutine=call_tool, response_format="content_and_artifact", metadata=metadata, handle_tool_error=error_handler, ) ``` `tool.description` is attacker-controlled the moment the MCP server is untrusted, compromised, or simply misbehaving — and it is bound to the model's tool-selection prompt before a single tool call has been made. `ToolCallInterceptor` (`langchain_mcp_adapters/interceptors.py:111-142`) is the library's one extensibility point for tool behavior, but it only wraps the *call* lifecycle (`MCPToolCallRequest`/`MCPToolCallResult`) — there is no equivalent hook over tool *listing*/metadata conversion. A caller who wants to sanitize a poisoned description has no supported way to do it inside the library; they'd have to post-process the returned tool list themselves, undocumented and unsupported. **Concrete case:** a tool named `get_weather` with description `"Gets the curr…