fix(agent-os): enforce TLS for configured MCP URLs

[Artem (pararti)]

Related Issue

Fixes #3785

Problem & Solution

McpAuthPolicy.check() enforced require_tls only against the URL supplied by the caller. When the caller omitted that argument, a non-TLS URL already stored in the matching McpServerEntry was never evaluated.

This PR selects the effective URL as the caller URL or the configured entry URL. The caller URL retains priority because it describes the connection being checked. If both sources are empty, the existing behavior remains unchanged and the TLS gate is skipped, preserving S10.12 compatibility.

Impact on Your Work

Configured MCP server URLs now receive the same TLS scheme enforcement as caller-supplied URLs.

Timeline

None.

Alternatives Considered

• Requiring every caller to repeat the configured URL would leave the configuration path unenforced.
• Rejecting entries when both URL sources are empty would change the existing S10.12 conformance behavior and is outside the scope of this fix.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Maintenance (dependency updates, CI/CD, refactoring)
• Security fix

Package(s) Affected

Core & runtime:

• agent-governance-toolkit-core
• agent-primitives
• agent-os
• agent-mesh
• agent-runtime
• agent-sre
• agent-compliance

Governance & security:

• agent-mcp-governance
• agent-rag-governance
• agent-sandbox
• agent-discovery
• agt-policies
• policy-engine

Platform & tooling:

• agent-hypervisor
• agent-lightning
• agent-marketplace
• agent-governance-toolkit-cli
• agent-governance-toolkit-integrations
• agent-governance-toolkit-protocols
• agentmesh-integrations (framework integrations)

CLI plugins:

• agent-governance CLI plugins (copilot-cli / claude-code / opencode / antigravity-cli)

Shared / other:

• schemas
• action (GitHub Action)
• examples
• docs / root

Testing

Unit Testing

Added an 18-case parameterized matrix covering:

• require_tls=True and False
• empty, HTTPS, and HTTP caller URLs
• empty, HTTPS, and HTTP configured entry URLs
• caller URL precedence
• the compatible empty-both-sources behavior

Manual Testing

pytest agent-governance-python/agent-os/tests/test_mcp_auth_enforcement.py -q
35 passed, 1 deprecation warning

git diff --check passes. Ruff reports the same four existing file-level findings as main; none are introduced by the changed lines. The direct conformance module was not collectable in this local checkout because the compiled agent_control_specification._native module is unavailable; the regression matrix directly pins the S10.12 empty-both behavior.

Checklist

• I have linked a related issue above, or completed "Problem & Solution", "Impact on Your Work", and "Alternatives Considered"
• My code follows the project style guidelines (ruff check)
• I have added tests that prove my fix/feature works
• All new and existing tests pass (pytest) — the scoped suite passes; the full package suite was not run locally
• I have updated documentation as needed
• I have signed the Microsoft CLA — pending CLA bot verification

Attribution & Prior Art

• This contribution does not contain code copied or derived from other projects without attribution
• Any external projects that inspired this design are credited in code comments or documentation
• If this PR implements functionality similar to an existing open-source project, I have listed it below

Prior art / related projects (if any):

The configured-URL fallback was previously discussed within this repository in #3512 and was raised again in #3785. No external project code was copied or adapted.

AI Assistance

• I can explain every meaningful change in this PR: what it does, why, and what tradeoffs were considered
• I have run tests and verification appropriate for this change
• No part of this PR was autonomously submitted by an AI agent without my review
• I have not used AI to generate review comments on others' PRs

Codex was used to inspect the issue, draft the regression matrix and minimal patch, and prepare this PR text. All changes were reviewed and explicitly approved by the contributor before submission.

IP, Patents, and Licensing

• This contribution does not implement patent-pending or patent-encumbered techniques
• This contribution does not require an NDA or licensing agreement to understand or use
• Any AI tools used have terms compatible with the MIT License

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

Welcome to the Agent Governance Toolkit! Thanks for your first pull request.
Please ensure tests pass, code follows style (ruff check), and you have signed the CLA.
See our Contributing Guide.

[github-actions]

PR Review Summary

Check	Status	Details
🔍 Code Review	⚠️ Missing	No current-run comment
🛡️ Security Scan	⚠️ Missing	No current-run comment
🔄 Breaking Changes	⚠️ Missing	No current-run comment
📝 Docs Sync	⚠️ Missing	No current-run comment
🧪 Test Coverage	⚠️ Missing	No current-run comment

Verdict: ⚠️ AI review incomplete; ready for human review

AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims.

[Artem (pararti)]

@microsoft-github-policy-service agree

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.