An MCP tool was registered under the verbatim name the remote server
advertised, with no check against the names the framework itself puts on the
wire. A server that advertised `adk_request_credential`,
`adk_request_confirmation`, `adk_request_input` or `transfer_to_agent`
therefore had its own tool dispatched in place of the framework's.
`McpToolset.get_tools` now drops a tool carrying one of those four names and
logs a warning, and `McpTool.__init__` refuses the name outright. The listing
skips rather than raises so that one reserved name does not fail the whole
`list_tools` call and take the server's honest tools with it; the constructor
check is the backstop for anything that builds an `McpTool` directly.
Behaviour change: a server that legitimately serves a tool under one of those
four names loses that tool, with only a warning log as the signal. Only exact
matches are refused, so `transfer_to_agent_v2` still registers. Because
`tool_name_prefix` is applied after `get_tools` returns, a prefixed toolset
also drops such a tool even though the prefix would have made the final name
unique; this matches upstream.
Port of upstream 77d4647c, which is itself the reland of an earlier attempt.
Only the reland's net content is ported: the constructor's handling of a
`None` tool or session manager and the `mcp_session_manager` annotation are
left exactly as they were.
George Weale
71e21d4417