Harden Tool URL Inputs

Audit and update every requested directory so MCP-influenced values cannot hijack a URL, URI, host, or client endpoint. Use IAzureService forwarding methods or the host's injectable IEndpointValidator at the final URL boundary, with the configured Azure cloud and the narrowest appropriate allow-list.

This is a scoped implementation skill, not a report-only audit. Make the fixes and add tests unless the user explicitly requests analysis only.

Required Input and Scope

1. Accept one or many repository-relative directories under tools/.
2. Resolve every path and confirm it is inside the repository's tools/ directory. Reject files or directories outside that boundary.
3. If no directory is supplied, ask the user for at least one. If a supplied path does not exist or its intended scope is ambiguous, ask before editing.
4. Treat each supplied directory as an exhaustive scope. Do not stop after finding the first vulnerable URL flow.
5. Do not modify other tool directories. Shared changes to core/Microsoft.Mcp.Core/src/Helpers/EndpointValidator.AllowLists.cs and its tests are allowed when a scoped tool needs a new Azure service allow-list.
6. Preserve unrelated worktree changes. Read the repository and nearest scoped instructions before editing.

Pattern Sources

Before implementing, inspect the current versions of: