[Feature]: Add bounded safety controls for MCP federation

[xeonvs]

Parent: #188
Depends on: #189 and #190

Related enhancement: #203 — stage-aware publication DLP diagnostics and content-free forbidden-source attribution.

Purpose

Add the minimum enforceable safety boundary for an operator-configured MCP gateway. Do not build defenses for arbitrary web crawling: the toolkit contacts only configured MCP endpoints and never follows content links itself.

Required controls

Before an upstream call

• Validate and canonicalize model arguments against the admitted tool schema.
• Enforce per-call and aggregate limits for argument size, call count, concurrency, and deadline.
• Reuse the existing outbound context.dlp normalization, secret/PII checks, ForbiddenMatcher, and budgets instead of creating another DLP stack.
• For URL-shaped arguments, allow only the tool's configured resource origins. Unknown/disallowed links remain inert unless the model attempts a call with them; the toolkit never dereferences them directly.

Before returning content to OCR

• Enforce response byte/character/item limits and a run aggregate.
• Reuse the existing inbound context.dlp.check_text boundary and its normalization/forbidden matching patterns.
• Label returned material by server/tool as external evidence.
• Remove protocol control characters needed only for transport safety; do not attempt semantic Unicode/spoof detection.
• If a response is rejected, DLP-blocked, truncated, timed out, or incomplete, do not pass partial content to OCR. Record a closed failure/degradation outcome.

Authority boundary

Extend the toolkit's existing fixed guidance that review context is data, never instructions or authority, to external MCP descriptions and results. External material may inform findings but cannot add tools or servers, change project policy, act as reviewer commands, suppress findings, control publication, or grant approval. Enforce this through existing authority instructions and lifecycle code, not a new heuristic prompt-injection detector. Add one focused fixture with instruction-like external text to prove that lifecycle controls remain unchanged. A semantic detector remains future work only if real evidence shows the fixed boundary is insufficient.

Transport boundary

• Use only explicitly configured HTTPS MCP endpoints; reject credential-bearing URLs and unsafe schemes.
• Do not forward credentials to a different origin.
• Disable redirects unless the registry explicitly allows a fixed same-origin redirect requirement.
• For local stdio, use only explicit operator configuration and a bounded environment; own child-process cleanup.

Actual authorization inside an upstream service remains that service's responsibility. M7 does not implement DNS pinning/rebinding protection, private-address classification, arbitrary URL resolution, semantic spoof detection, cross-service graph analysis, or enforcement inside upstream servers.

Approval consequence

A link merely appearing in any text has no approval effect. A denied or incomplete attempted external call means potentially relevant context was unavailable and makes the run comment-only. Successful guarded review_read calls may remain eligible subject to every existing gate.

Acceptance criteria

• Every call crosses schema/size validation, existing outbound DLP, configured-origin checks when applicable, timeout/count limits, response bounds, and existing inbound DLP.
• The toolkit makes no network request except to configured MCP endpoints.
• Unknown links are non-fatal and do not independently block approval.
• Rejected or incomplete content never reaches OCR.
• External instruction-like text cannot change policy, lifecycle, publication, or approval behavior.
• Logs, receipts, and Technical details contain no arguments, URLs, IDs, content, credentials, private paths, or raw provider errors.
• Focused tests cover invalid arguments, disallowed URL origins, redirects, timeout, oversized response, DLP rejection, instruction-like content, and cleanup.

[github-actions]

Stable v0.11.0 delivery is verified by immutable release asset release-receipt.json in v0.11.0 (SHA-256 d8295d4e2a51f1d486229cf614fbb6afea92e80e331bafe8ebf356e469129c4a).