Addresses issue #4875 - MCP tool calling has no per-message authentication
or integrity verification.
Adds:
- MCPSecurityConfig: Pydantic model for security settings (agent identity,
key pairs, Trust Authority keys, signing/verification toggles)
- MCPSecurityManager: Stateful manager handling ECDSA P-256 key generation,
agent passport creation/signing, message signing/verification, tool
integrity checks, and nonce-based replay protection
- Integration into MCPClient, MCPToolResolver, and all config models
(MCPServerStdio, MCPServerHTTP, MCPServerSSE)
- 30 comprehensive tests covering all security features and graceful
degradation when mcp-secure is not installed
Uses the mcp-secure library (optional dependency) which implements the
IETF draft-sharif-mcps-secure-mcp specification.
Co-Authored-By: João <joao@crewai.com>
909ebd869b