docs(mcp): document tool guardrails for local MCP servers - #4648
docs(mcp): document tool guardrails for local MCP servers#4648UgaTheDev wants to merge 1 commit into
Conversation
openai#4632 added tool_input_guardrails / tool_output_guardrails to local MCP servers, but docs/guardrails.md still stated that tool guardrails apply only to function tools created with function_tool. Correct that scoping and add an MCP-side section covering the new server arguments, approval ordering, and the HostedMCPTool exclusion. Signed-off-by: Kush Zingade <kush.zingade@gmail.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8b1a84370a
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| from agents.tool_guardrails import ( | ||
| ToolGuardrailFunctionOutput, | ||
| ToolInputGuardrailData, | ||
| tool_input_guardrail, |
There was a problem hiding this comment.
This runnable snippet imports tool_input_guardrail from agents.tool_guardrails, teaching readers a noncanonical decorator import path. Import the decorator from agents.decorators while keeping ToolGuardrailFunctionOutput and ToolInputGuardrailData on their existing public path.
AGENTS.md reference: AGENTS.md:L126-L126
Useful? React with 👍 / 👎.
|
will be covered by #4577 |
2 participants
#4632 added
tool_input_guardrails/tool_output_guardrailsto local MCP servers, closing #4620. The docs were not updated in that PR, anddocs/guardrails.mdstill states the opposite of the new behavior:That sentence is now inaccurate for locally executed MCP tools, which the SDK converts into
FunctionTools and which carry the server's guardrails through that conversion (src/agents/mcp/util.py).This PR is documentation only — no source or test changes.
Changes
docs/guardrails.md— corrects the scoping bullet. The "only function tools" claim is now preceded by a bullet covering local MCP servers, and the section intro mentions that guardrails may be configured on the MCP server. Approval ordering, tripwire behavior, andtool_input_guardrail_results/tool_output_guardrail_resultsreporting are noted as identical to the function-tool path.HostedMCPToolis called out as not covered.docs/mcp.md— adds a "Tool guardrails for local MCP servers" section under the local-server configuration topics (aftertool_meta_resolver), with a runnable example and a note that these are client-side checks that complement rather than replace authorization in the MCP server.Verification
The example in
docs/mcp.mdwas executed verbatim against this branch: it imports, constructsMCPServerStreamableHttpwithtool_input_guardrails=[block_pii], and the guardrail is present on the constructed server.make build-docspasses, so the newmkdocstringscross-references (agents.mcp.server.MCPServerStdio,agents.mcp.server.MCPServerStreamableHttp,agents.tool_context.ToolContext) resolve.Translated pages under
docs/ja/etc. are generated bymake build-full-docsand are left for the usual translation pass.Notes for the maintainer
docs/mcp.mdsection shorter, thedocs/guardrails.mdcorrection is the part that matters — that file currently contradicts shipped behavior.