MCP tools now carry structured metadata identifying which server and source they came from, for security purposes
Tools provided by MCP (Model Context Protocol) servers now carry structured metadata describing the server that's serving them: the server's configuration key name, and a source value drawn from a fixed set of options (sdk, plugin, user, project, local, dynamic, managed, enterprise, claudeai, agent) describing where that server's definition came from. The tool-wrapper builder now threads this source value through into the tool's metadata.
The metadata explicitly instructs consumers to trust the source field, not the tool's name or its mcp__ prefix, for security purposes. This closes a gap where a tool's name or prefix alone could be spoofed or misleading about where it actually came from.