Agno patches an MCP flaw where a model could smuggle `tool_name` and execute any tool, bypassing every approval gate
Agno merged PR #9379 on 2026-08-06 fixing a security bug in which every MCP tool entrypoint was built as `functools.partial(call_tool, tool_name=tool.name)`. Because partial keyword defaults are overridden by call-time kwargs, a model passing `tool_name="delete_repo"` as an argument to any MCP tool made the server execute `delete_repo` while allow-lists, `requires_confirmation`, human-in-the-loop approval and logging all still resolved against the declared function name — meaning any HITL gate on an MCP toolkit could be bypassed by calling an ungated tool. The fix closes over `tool.name` and removes the parameter entirely. This is the confused-deputy pattern moving from protocol design into framework plumbing: the approval layer and the execution layer were reading two different names.
↳ Follow the thread