Python: Enforce excluded_functions on MCP tool invocation path

[SergeyMenshykh]

Motivation and Context

The MCP server created by create_mcp_server_from_kernel (and the Kernel.as_mcp_server wrapper) accepts an excluded_functions argument to keep selected kernel functions off the server. Previously this list was applied only when building the tool set advertised by the list_tools handler; the call_tool handler did not consult it and forwarded the client-supplied name straight to the kernel. As a result the set of advertised tools and the set of callable tools could diverge.

Description

• Derive a single exposed_names set from functions_to_expose and check it in the call_tool handler, returning a METHOD_NOT_FOUND error for any name that is not exposed.
• Remove a leftover print debug statement in _call_kernel_function.
• Add a unit test covering the call_tool behavior for a non-exposed function.

Contribution Checklist

• The code builds clean without any errors or warnings
• The PR follows the SK Contribution Guidelines
• All unit tests pass, and I have added new tests where possible

[github-actions]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
connectors
mcp.py	464	205	55%	81, 86, 98, 108–117, 124–125, 128–129, 138–139, 146, 160–167, 175–179, 181–182, 184, 193, 296–302, 337–339, 344–346, 360–361, 364–365, 373–375, 407–408, 410, 412, 414–420, 424–426, 428–438, 442–443, 447–448, 452, 454, 458–459, 463, 471, 486, 501–509, 528–529, 544–545, 564–565, 568–569, 572–577, 581–582, 585–586, 589–595, 675, 677, 750, 752, 754, 756, 831, 833, 835, 837, 839, 903, 946–951, 953–956, 961, 1014, 1016, 1019, 1033, 1053–1055, 1070–1074, 1077–1080, 1083–1085, 1089–1093, 1096–1097, 1106–1107, 1109–1111, 1125–1126, 1128–1129, 1131–1133, 1136, 1143–1146, 1154, 1159–1164, 1169, 1171, 1174–1176
TOTAL	28901	5653	80%

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
4052	23 💤	0 ❌	0 🔥	1m 58s ⏱️

[Copilot]

Pull request overview

This PR fixes a security/consistency gap in the Python MCP server adapter by ensuring excluded_functions is enforced not only in tool listing (list_tools) but also at invocation time (call_tool), preventing hidden kernel functions from being callable via direct client requests.

Changes:

• Compute a single exposed_names set from the filtered function metadata and enforce it inside the MCP call_tool handler (returning METHOD_NOT_FOUND for non-exposed names).
• Remove a leftover debug print from _call_kernel_function.
• Add a unit test verifying that an excluded tool cannot be invoked and its side effects do not execute.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
python/semantic_kernel/connectors/mcp.py	Enforces excluded_functions during tool invocation and removes debug output.
python/tests/unit/connectors/mcp/test_mcp.py	Adds a unit test ensuring excluded tools are rejected at call time.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.