fix(adk): Propagate access token to subagents and mcp tools#1858
Conversation
… mcp tools for both the go and python adk runtimes Signed-off-by: JM Huibonhoa <jm.huibonhoa@solo.io>
Signed-off-by: JM Huibonhoa <jm.huibonhoa@solo.io>
There was a problem hiding this comment.
Pull request overview
This PR addresses end-to-end auth token propagation when KAGENT_PROPAGATE_TOKEN is set, ensuring the incoming Authorization header is forwarded both to (1) sub-agent A2A calls and (2) downstream MCP tool calls, for both the Python and Go runtimes.
Changes:
- Python: add optional Authorization forwarding to sub-agent A2A calls via
_SubagentInterceptorand propagate the token from session state into the outboundClientCallContext. - Go: implement token propagation for both remote sub-agent A2A tools and MCP transports when
KAGENT_PROPAGATE_TOKENis set. - Add unit tests in both runtimes covering the new propagation behaviors.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| python/packages/kagent-adk/src/kagent/adk/_remote_a2a_tool.py | Adds propagate-token support to sub-agent A2A calls by passing Authorization through call context + interceptor. |
| python/packages/kagent-adk/tests/unittests/test_remote_a2a_tool.py | Adds unit tests validating Authorization forwarding behavior in _SubagentInterceptor. |
| go/adk/pkg/agent/agent.go | Plumbs KAGENT_PROPAGATE_TOKEN into MCP toolset creation and remote A2A tool construction. |
| go/adk/pkg/tools/remote_a2a_tool.go | Adds an interceptor to forward Authorization from inbound A2A context into outbound sub-agent A2A calls. |
| go/adk/pkg/mcp/registry.go | Adds propagateToken behavior to MCP transport header injection (Authorization forwarded independent of AllowedHeaders). |
| go/adk/pkg/mcp/registry_test.go | Adds tests for propagateToken behavior on the MCP transport. |
| go/adk/pkg/constants/const.go | Introduces a shared constant for normalized Authorization header name. |
Comments suppressed due to low confidence (1)
python/packages/kagent-adk/src/kagent/adk/_remote_a2a_tool.py:414
- In _handle_resume, the authorization context key is set using a hard-coded string ("authorization") instead of _AUTHORIZATION_CONTEXT_KEY. For consistency with _handle_first_call and the interceptor, use the constant here as well.
call_context_state: dict[str, Any] = {_USER_ID_CONTEXT_KEY: tool_context.session.user_id}
if self._propagate_token:
incoming = tool_context.session.state.get(_HEADERS_STATE_KEY) or {}
if isinstance(incoming, dict):
auth = incoming.get("authorization") or incoming.get("Authorization")
if auth:
call_context_state["authorization"] = auth
call_context = ClientCallContext(state=call_context_state)
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
supreme-gg-gg
left a comment
There was a problem hiding this comment.
lgtm overall, I agree using KAGENT_PROPAGATE_TOKEN is a better and more consistent approach than the previous PR / #1757
Signed-off-by: JM Huibonhoa <jm.huibonhoa@solo.io>
iplay88keys
left a comment
There was a problem hiding this comment.
Looks good overall. Just a few small comments.
Signed-off-by: JM Huibonhoa <jm.huibonhoa@solo.io>
Signed-off-by: JM Huibonhoa <jm.huibonhoa@solo.io>
Signed-off-by: JM Huibonhoa <jm.huibonhoa@solo.io>
Signed-off-by: JM Huibonhoa <jm.huibonhoa@solo.io>
Signed-off-by: JM Huibonhoa <jm.huibonhoa@solo.io>
Signed-off-by: JM Huibonhoa <jm.huibonhoa@solo.io>
… propagate_token bool Signed-off-by: JM Huibonhoa <jm.huibonhoa@solo.io>
Overview
KAGENT_PROPAGATE_TOKENenv var forAgentCR's using thepythonruntime would only propagate the access token to mcp tools and not to sub agents.KAGENT_PROPAGATE_TOKENenv var for thegorun would not propagate the token to mcp or subagents as it was unimplented.Testing
kagent-tool-serverand making an a2a request to the coordinator agent then inspecting the logs. I added logs here and here for the go runtime and here for the python runtime to validate the allowed header was being added by the interceptorcloses #1745