.NET: Add defense-in-depth for MCP cross origin request

[TaoChenOSU]

Motivation & Context

A customer reported an origin-pinning weakness reachable through the declarative-workflows MCP handler. DefaultMcpToolHandler created its transport with HttpTransportMode.AutoDetect and passed caller-supplied credentials (including an Authorization: Bearer token) via HttpClientTransportOptions.AdditionalHeaders. Under AutoDetect, the client can negotiate down to the legacy HTTP+SSE transport, which trusts a server-advertised message endpoint. A malicious or compromised MCP server could advertise a cross-origin endpoint (or issue a redirect) and capture the bearer token, since the SDK re-stamps AdditionalHeaders onto requests built from that unverified URL. The owned HttpClient also left auto-redirect enabled, a second cross-origin leakage path.

Description & Review Guide

• What are the major changes?
  • DefaultMcpToolHandler now forces HttpTransportMode.StreamableHttp instead of AutoDetect, removing the legacy-SSE server-advertised-endpoint vector.
  • The owned HttpClient handler now sets AllowAutoRedirect = false, blocking redirect-based credential leakage.
  • Added an OriginPinningHandler (DelegatingHandler) that strips credential headers (Authorization, Proxy-Authorization, Cookie) from any request whose origin differs from the configured server origin, leaving same-origin traffic untouched.
  • Documented the layered (defense-in-depth) design and a caveat for future maintainers: the handler strips credentials on all cross-origin requests, which would need auth-server origin allow-listing if SDK OAuth support is ever added here.
  • Added regression tests covering OriginPinningHandler behavior and StripCredentialHeadersOnCrossOrigin (same-origin pass-through, cross-origin scheme/host/port strip, case-insensitive origin match).
• What is the impact of these changes?
  • Credentials supplied to the handler are pinned to the configured server origin across three independent layers, so a compromised server, redirect, or future config regression cannot redirect them to another origin.
    Behavioral note: the transport no longer negotiates down to legacy SSE. Servers reachable only via the legacy /sse + /message flow will need the standard Streamable HTTP endpoint. This is consistent with the MCP SDK's own default of disabling legacy SSE.
  • The httpClientProvider path is unchanged; callers supplying their own HttpClient remain responsible for equivalent pinning, now called out in the XML docs.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[github-actions]

Automated Code Review

Reviewers: 1 | Confidence: 82% | Result: All clear

Reviewed: Design Approach

---

Automated review by TaoChenOSU's agents

[Copilot]

Pull request overview

This PR strengthens the .NET declarative-workflows MCP tool handler against credential leakage by pinning credential-bearing headers to the configured server origin and reducing transport/redirect-based cross-origin vectors.

Changes:

• Forces MCP transport to HttpTransportMode.StreamableHttp to avoid legacy HTTP+SSE server-advertised message endpoints.
• Disables HttpClientHandler auto-redirect and adds an OriginPinningHandler that strips credential headers on cross-origin requests.
• Adds unit tests validating the origin-pinning behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
dotnet/src/Microsoft.Agents.AI.Workflows.Declarative.Mcp/DefaultMcpToolHandler.cs	Adds defense-in-depth origin pinning and tightens transport/redirect behavior to prevent cross-origin credential leakage.
dotnet/tests/Microsoft.Agents.AI.Workflows.Declarative.Mcp.UnitTests/DefaultMcpToolHandlerTests.cs	Adds regression tests for credential header stripping and handler behavior across origins.

[github-actions]

Automated Code Review

Reviewers: 5 | Confidence: 86% | Result: All clear

Reviewed: Correctness, Security Reliability, Test Coverage, Failure Modes, Design Approach

---

Automated review by TaoChenOSU's agents