viyatb-oai d124fe9de1 Add negotiated network policy metadata support for MCP calls (#56278) ...

## What changed

Add an optional `NetworkPolicyMetadataProvider` to the MCP runtime. Advertise `codex/network-policy-meta` only to trusted ChatGPT origins when a provider is available, and attach policy metadata only when the sending session also advertises support.

Strip caller-supplied policy metadata and derive restrictions from the call's captured permission profile and server environment. Resolve metadata against each session's capabilities, including after recovery, while retaining one policy snapshot per call. Fail the call before sending if policy resolution fails. Existing runtime callers leave the provider unset.

## Testing

Add tests for capability negotiation, trusted-origin restrictions, forged metadata removal, both tool dispatch paths, and policy snapshot reuse. Add HTTP session-recovery coverage for changing capabilities and policy-resolution failures while preserving caller metadata and read-only restrictions.

GitOrigin-RevId: 4b978f986abc0475fc67659be98fc01a2d6ce7cd

2026-10-22 22:33:07 +00:00

..

mcp_2026_discovery

Add negotiated network policy metadata support for MCP calls (#56278)

2026-10-22 22:33:07 +00:00

mcp_2026_mrtr

Add negotiated network policy metadata support for MCP calls (#56278)

2026-10-22 22:33:07 +00:00

streamable_http_recovery

Add attributed MCP OAuth credential storage telemetry (#49392)

2026-09-29 23:01:46 +00:00

foreign_stdio_cwd.rs

mcp: accept foreign absolute cwd for remote stdio (#29493)

2026-06-23 01:33:51 +00:00

mcp_2026_discovery.rs

Add negotiated network policy metadata support for MCP calls (#56278)

2026-10-22 22:33:07 +00:00

mcp_2026_message_limits.rs

Complete MCP 2026 client support (#35725)

2026-07-28 06:06:58 +00:00

mcp_2026_mrtr.rs

Add negotiated network policy metadata support for MCP calls (#56278)

2026-10-22 22:33:07 +00:00

mcp_2026_oauth_discovery.rs

Prefer resource-specific scopes during MCP OAuth discovery (#54653)

2026-10-16 16:23:55 +00:00

mcp_2026_sse_discovery.rs

Add MCP 2026-07-28 discovery support (#35724)

2026-07-28 05:52:12 +00:00

mcp_2026_stdio_discovery.rs

Add negotiated network policy metadata support for MCP calls (#56278)

2026-10-22 22:33:07 +00:00

mcp_2026_stdio.rs

Add negotiated network policy metadata support for MCP calls (#56278)

2026-10-22 22:33:07 +00:00

mcp_events.rs

Propagate authentication header failures before sending requests (#55607)

2026-10-20 15:43:19 +00:00

process_group_cleanup.rs

Add negotiated network policy metadata support for MCP calls (#56278)

2026-10-22 22:33:07 +00:00

resources.rs

Improve sandboxing, MCP errors, and cached approvals (#41196)

2026-08-27 20:05:08 +00:00

stdio_descriptor_boundary.rs

Add negotiated network policy metadata support for MCP calls (#56278)

2026-10-22 22:33:07 +00:00

stdio_message_limits.rs

Suppress console windows for local Windows MCP servers (#48238)

2026-09-25 22:56:00 +00:00

stdio_stderr_cleanup.rs

Close MCP stderr readers on client teardown (#43870)

2026-09-08 17:42:14 +00:00

streamable_http_oauth_startup.rs

Add negotiated network policy metadata support for MCP calls (#56278)

2026-10-22 22:33:07 +00:00

streamable_http_oauth_store_pinning.rs

Support client secrets for pre-registered MCP OAuth clients (#47891)

2026-09-24 17:26:18 +00:00

streamable_http_oauth_tool_call.rs

Add negotiated network policy metadata support for MCP calls (#56278)

2026-10-22 22:33:07 +00:00

streamable_http_recovery.rs

Add attributed MCP OAuth credential storage telemetry (#49392)

2026-09-29 23:01:46 +00:00

streamable_http_remote.rs

Cache executor metadata from initialization (#40343)

2026-08-24 06:43:07 +00:00

streamable_http_test_support.rs

Add negotiated network policy metadata support for MCP calls (#56278)

2026-10-22 22:33:07 +00:00

streamable_http_user_agent.rs

Set a default user agent for MCP HTTP requests (#34883)

2026-07-23 06:13:12 +00:00