Repository navigation
[Feat]: Mark function output as untrusted in MCP results #24296
Description
Problem
Function output goes back to the client as plain text, with server guidance in separate content items but no marker on journal logs, process command lines or alert text, so hosts cannot tell that text apart from the server's own guidance.
Description
Add an untrusted-content marker to execute_function results (mcp-tools-execute-function.c#L2274).
Came up while reviewing this project for SafetyCard: https://safetycard.dev/github.com/netdata/netdata
Importance
nice to have
Value proposition
Hosts could tell function output (journal logs, process command lines, alert text) apart from the server's own guidance.
Proposed implementation
No response
Activity
[-][Feat]: Mark function output as untrusted in MCP results (SafetyCard review)[/-][+][Feat]: Mark function output as untrusted in MCP results[/+]Paraphern commentedon Oct 21, 2026
Publisher-side companion to this: alongside marking output untrusted in results, a publicly pinned tool contract gives consumers a verifiable anchor for "what this server serves". We run exactly that for a public corpus of MCP servers (per-version pins, repro commands), and the drift data argues for it: 25 of 28 watched npm-distributed servers changed at least one tool contract across version windows. If netdata wants a public pin set for its MCP surface, we would be glad to help set one up - the tooling is open source and the corpus format is ready (rugsnare, Apache-2.0).