Files
crewAI/lib
Iris Clawd edd79e50ef fix: ignore extra fields in dynamic tool schemas to prevent security_context validation errors
Changes the default Pydantic config in create_model_from_schema() from
extra='forbid' to extra='ignore'. This fixes OSS-9 where the framework
injects security_context metadata into tool call arguments, but MCP tools
and integration tools (created via create_model_from_schema) reject any
extra fields with Pydantic's extra_forbidden error.

Affected tools: all MCP tools (MCPServerAdapter, MCPToolResolver) and
all platform integration tools (CrewAIPlatformActionTool) — these all
use create_model_from_schema() without a custom __config__, so they
inherited the extra='forbid' default.

Regular user-defined tools (subclassing BaseModel) were not affected
because BaseModel defaults to extra='ignore'.

The fix is backward-compatible:
- Required fields are still enforced
- Type validation is still enforced
- Callers can still opt into extra='forbid' via __config__ parameter
- Tools that define security_context in their schema still receive it

Fixes: OSS-9
Related: #4796, #4841
2026-04-01 19:42:13 +00:00
..