Python: Use the ai threat model for MCP handler input

Handler parameters are produced by a language model, so they are sources of the opt-in ai threat model added in github#22810. HTTP headers and bearer tokens come from the HTTP client and stay sources of the remote threat model.

Author: Alex-Hofer

python/ql/lib/change-notes/2026-09-30-mcp-models.md

@@ -1,4 +1,4 @@
 ---
 category: minorAnalysis
 ---
-* Added modeling of the `mcp` (the official Model Context Protocol SDK) and `fastmcp` PyPI packages. The parameters of MCP tool, resource and prompt handlers, the HTTP headers that `fastmcp` handlers read through `get_http_headers()` or `get_http_request()`, and the bearer token that token verifiers (`verify_token`) and `get_access_token()` receive, are now sources of the `remote` threat model.
+* Added modeling of the `mcp` (the official Model Context Protocol SDK) and `fastmcp` PyPI packages. The parameters of MCP tool, resource and prompt handlers are now sources of the opt-in `ai` threat model, as their values are produced by a language model. The HTTP headers that `fastmcp` handlers read through `get_http_headers()` or `get_http_request()`, and the bearer token that token verifiers (`verify_token`) and `get_access_token()` receive, are sources of the `remote` threat model.

python/ql/lib/semmle/python/frameworks/fastmcp.model.yml

@@ -5,13 +5,13 @@ extensions:
     data:
       # `fastmcp` (PyPI), a standalone MCP server framework. The parameters of tool, resource and
       # prompt handlers are chosen by the MCP client; `tool` and `prompt` also work without parentheses.
-      - ['fastmcp.FastMCP', 'Member[tool,prompt].Argument[0,name_or_fn:].Parameter[any]', 'remote']
-      - ['fastmcp.FastMCP', 'Member[tool,resource,prompt].ReturnValue.Argument[0].Parameter[any]', 'remote']
-      - ['fastmcp.FastMCP', 'Member[add_tool].Argument[0,tool:].Parameter[any]', 'remote']
-      - ['fastmcp.FastMCP', 'Member[add_prompt].Argument[0,prompt:].Parameter[any]', 'remote']
-      - ['fastmcp.tools.Tool!', 'Member[from_function].Argument[0,fn:].Parameter[any]', 'remote']
-      - ['fastmcp', 'Member[tools].Member[tool].Argument[0,name_or_fn:].Parameter[any]', 'remote']
-      - ['fastmcp', 'Member[tools].Member[tool].ReturnValue.Argument[0].Parameter[any]', 'remote']
+      - ['fastmcp.FastMCP', 'Member[tool,prompt].Argument[0,name_or_fn:].Parameter[any]', 'ai']
+      - ['fastmcp.FastMCP', 'Member[tool,resource,prompt].ReturnValue.Argument[0].Parameter[any]', 'ai']
+      - ['fastmcp.FastMCP', 'Member[add_tool].Argument[0,tool:].Parameter[any]', 'ai']
+      - ['fastmcp.FastMCP', 'Member[add_prompt].Argument[0,prompt:].Parameter[any]', 'ai']
+      - ['fastmcp.tools.Tool!', 'Member[from_function].Argument[0,fn:].Parameter[any]', 'ai']
+      - ['fastmcp', 'Member[tools].Member[tool].Argument[0,name_or_fn:].Parameter[any]', 'ai']
+      - ['fastmcp', 'Member[tools].Member[tool].ReturnValue.Argument[0].Parameter[any]', 'ai']
       # The HTTP headers of the transport.
       - ['fastmcp', 'Member[server].Member[dependencies].Member[get_http_headers].ReturnValue', 'remote']
       - ['fastmcp', 'Member[server].Member[dependencies].Member[get_http_request].ReturnValue.Member[headers]', 'remote']

python/ql/lib/semmle/python/frameworks/mcp.model.yml

@@ -6,14 +6,14 @@ extensions:
       # `mcp`, the official Model Context Protocol SDK. The parameters of tool, resource and prompt
       # handlers are chosen by the MCP client, that is by an LLM or by anyone who can reach the server.
       # `FastMCP` (1.x) was renamed to `MCPServer` (2.x).
-      - ['mcp.server.fastmcp.FastMCP', 'Member[tool,resource,prompt].ReturnValue.Argument[0].Parameter[any]', 'remote']
-      - ['mcp.server.fastmcp.FastMCP', 'Member[add_tool].Argument[0,fn:].Parameter[any]', 'remote']
-      - ['mcp.server.mcpserver.MCPServer', 'Member[tool,resource,prompt].ReturnValue.Argument[0].Parameter[any]', 'remote']
-      - ['mcp.server.mcpserver.MCPServer', 'Member[add_tool].Argument[0,fn:].Parameter[any]', 'remote']
+      - ['mcp.server.fastmcp.FastMCP', 'Member[tool,resource,prompt].ReturnValue.Argument[0].Parameter[any]', 'ai']
+      - ['mcp.server.fastmcp.FastMCP', 'Member[add_tool].Argument[0,fn:].Parameter[any]', 'ai']
+      - ['mcp.server.mcpserver.MCPServer', 'Member[tool,resource,prompt].ReturnValue.Argument[0].Parameter[any]', 'ai']
+      - ['mcp.server.mcpserver.MCPServer', 'Member[add_tool].Argument[0,fn:].Parameter[any]', 'ai']
       # The low-level server: decorators in 1.x, constructor handlers taking `(ctx, params)` in 2.x.
-      - ['mcp.server.lowlevel.Server', 'Member[call_tool,read_resource,get_prompt].ReturnValue.Argument[0].Parameter[any]', 'remote']
-      - ['mcp.server.lowlevel.Server!', 'Argument[on_call_tool:,on_get_prompt:].Parameter[1].Member[arguments]', 'remote']
-      - ['mcp.server.lowlevel.Server!', 'Argument[on_read_resource:].Parameter[1].Member[uri]', 'remote']
+      - ['mcp.server.lowlevel.Server', 'Member[call_tool,read_resource,get_prompt].ReturnValue.Argument[0].Parameter[any]', 'ai']
+      - ['mcp.server.lowlevel.Server!', 'Argument[on_call_tool:,on_get_prompt:].Parameter[1].Member[arguments]', 'ai']
+      - ['mcp.server.lowlevel.Server!', 'Argument[on_read_resource:].Parameter[1].Member[uri]', 'ai']
       # The bearer token of the Authorization header reaches token verifiers and the access-token helper.
       - ['mcp.server.auth.provider.TokenVerifier!', 'Subclass.Member[verify_token].Parameter[0,token:]', 'remote']
       - ['mcp', 'Member[server].Member[auth].Member[middleware].Member[auth_context].Member[get_access_token].ReturnValue.Member[token]', 'remote']

python/ql/test/library-tests/frameworks/fastmcp/test.py

@@ -14,57 +14,57 @@
 
 
 @app.tool
-def bare(command): # $ mad-source__remote=command
+def bare(command): # $ mad-source__ai=command
     return command
 
 
 @server_app.tool(name="exec")
-def called(command): # $ mad-source__remote=command
+def called(command): # $ mad-source__ai=command
     return command
 
 
 @module_app.resource("files://{path}")
-def resource(path): # $ mad-source__remote=path
+def resource(path): # $ mad-source__ai=path
     return path
 
 
 @app.prompt
-def bare_prompt(topic): # $ mad-source__remote=topic
+def bare_prompt(topic): # $ mad-source__ai=topic
     return topic
 
 
 @app.prompt()
-def called_prompt(topic, style="short"): # $ mad-source__remote=topic mad-source__remote=style
+def called_prompt(topic, style="short"): # $ mad-source__ai=topic mad-source__ai=style
     return topic + style
 
 
-def added(command): # $ mad-source__remote=command
+def added(command): # $ mad-source__ai=command
     return command
 
 
 app.add_tool(added)
 
 
-def added_prompt(topic): # $ mad-source__remote=topic
+def added_prompt(topic): # $ mad-source__ai=topic
     return topic
 
 
 app.add_prompt(prompt=added_prompt)
 
 
-def via_tool(url): # $ mad-source__remote=url
+def via_tool(url): # $ mad-source__ai=url
     return url
 
 
-def via_function_tool(url): # $ mad-source__remote=url
+def via_function_tool(url): # $ mad-source__ai=url
     return url
 
 
-def via_base_tool(url): # $ mad-source__remote=url
+def via_base_tool(url): # $ mad-source__ai=url
     return url
 
 
-def via_module_function_tool(url): # $ mad-source__remote=url
+def via_module_function_tool(url): # $ mad-source__ai=url
     return url
 
 
@@ -75,12 +75,12 @@ def via_module_function_tool(url): # $ mad-source__remote=url
 
 
 @tool
-def standalone(command): # $ mad-source__remote=command
+def standalone(command): # $ mad-source__ai=command
     return command
 
 
 @tool()
-def standalone_called(command): # $ mad-source__remote=command
+def standalone_called(command): # $ mad-source__ai=command
     return command
 
 

python/ql/test/library-tests/frameworks/mcp/fastmcp_v1.py

@@ -6,21 +6,21 @@
 
 
 @server.tool()
-def run(command): # $ mad-source__remote=command
+def run(command): # $ mad-source__ai=command
     return command
 
 
 @other.resource("notes://{name}")
-def note(name): # $ mad-source__remote=name
+def note(name): # $ mad-source__ai=name
     return name
 
 
 @server.prompt()
-def summarize(topic, style="short"): # $ mad-source__remote=topic mad-source__remote=style
+def summarize(topic, style="short"): # $ mad-source__ai=topic mad-source__ai=style
     return topic + style
 
 
-def fetch(url): # $ mad-source__remote=url
+def fetch(url): # $ mad-source__ai=url
     return url
 
 
@@ -29,7 +29,7 @@ def fetch(url): # $ mad-source__remote=url
 
 def register(app: FastMCP):
     @app.tool()
-    def remove(path): # $ mad-source__remote=path
+    def remove(path): # $ mad-source__ai=path
         return path
 
 
@@ -39,7 +39,7 @@ def __init__(self):
 
     def register(self):
         @self.mcp.tool()
-        def lookup(host): # $ mad-source__remote=host
+        def lookup(host): # $ mad-source__ai=host
             return host
 
 

python/ql/test/library-tests/frameworks/mcp/lowlevel_v1.py

@@ -8,15 +8,15 @@
 
 
 @server.call_tool()
-async def call_tool(name, arguments): # $ mad-source__remote=name mad-source__remote=arguments
+async def call_tool(name, arguments): # $ mad-source__ai=name mad-source__ai=arguments
     return arguments
 
 
 @lowlevel_server.read_resource()
-async def read_resource(uri): # $ mad-source__remote=uri
+async def read_resource(uri): # $ mad-source__ai=uri
     return uri
 
 
 @module_server.get_prompt()
-async def get_prompt(name, arguments): # $ mad-source__remote=name mad-source__remote=arguments
+async def get_prompt(name, arguments): # $ mad-source__ai=name mad-source__ai=arguments
     return arguments

python/ql/test/library-tests/frameworks/mcp/lowlevel_v2.py

@@ -2,15 +2,15 @@
 
 
 async def handle_call_tool(ctx, params):
-    return params.arguments # $ mad-source__remote=params.arguments
+    return params.arguments # $ mad-source__ai=params.arguments
 
 
 async def handle_read_resource(ctx, params):
-    return params.uri # $ mad-source__remote=params.uri
+    return params.uri # $ mad-source__ai=params.uri
 
 
 async def handle_get_prompt(ctx, params):
-    return params.arguments # $ mad-source__remote=params.arguments
+    return params.arguments # $ mad-source__ai=params.arguments
 
 
 async def not_registered(ctx, params):

python/ql/test/library-tests/frameworks/mcp/mcpserver_v2.py

@@ -8,21 +8,21 @@
 
 
 @server.tool()
-def run(command): # $ mad-source__remote=command
+def run(command): # $ mad-source__ai=command
     return command
 
 
 @package_server.resource("notes://{name}")
-def note(name): # $ mad-source__remote=name
+def note(name): # $ mad-source__ai=name
     return name
 
 
 @module_server.prompt()
-def summarize(topic): # $ mad-source__remote=topic
+def summarize(topic): # $ mad-source__ai=topic
     return topic
 
 
-def fetch(url): # $ mad-source__remote=url
+def fetch(url): # $ mad-source__ai=url
     return url