fix(mcp): add safeguards to ensure all MCP tools are wrapped with mcp_auth_hook #39395

Context

PR #39385 fixed a critical race condition where concurrent MCP tool calls could overwrite each other's g.user, causing user impersonation. The fix (pushing a fresh app_context() per tool call) is correct, but its safety depends entirely on mcp_auth_hook wrapping every registered tool. There are currently three bypass paths that could silently produce unprotected tools.

Problem

1. protect=False opt-out — Any tool decorated with @tool(protect=False) skips mcp_auth_hook entirely. If such a tool touches g.user or db.session, it's vulnerable to the race condition.

2. Silent fallback in create_tool_decorator — When mcp_auth_hook raises during decoration (e.g., import error), the tool is returned unwrapped with only a logger.error(). The tool is then served without auth or context isolation, silently.

3. Direct mcp.add_tool() bypass — Code that imports mcp directly and calls mcp.add_tool() (currently only used for resources, but nothing prevents tool registration this way) bypasses the decorator entirely.

Proposed Fix

1. Stamp a protection marker in mcp_auth_hook (~1 line)

# In auth.py, at the end of mcp_auth_hook():
new_wrapper._mcp_auth_protected = True

2. Add a startup assertion (~15 lines)

After all tools are registered (in init_fastmcp_server() or __main__.py), iterate the FastMCP tool registry and verify every tool has the marker:

ALLOWED_UNPROTECTED = {"health_check"}

def assert_all_tools_protected(mcp_instance):
    for name, tool in mcp_instance._tool_manager._tools.items():
        if name in ALLOWED_UNPROTECTED:
            continue
        if not getattr(tool.fn, '_mcp_auth_protected', False):
            raise RuntimeError(
                f"SECURITY: Tool '{name}' registered without mcp_auth_hook. "
                f"All tools must use @tool() with protect=True or be explicitly allowlisted."
            )

This fails loudly at server startup — catches all three bypass paths before any request is served.

3. Fail-fast in create_tool_decorator (~3 lines)

Change the exception handler in create_tool_decorator from silently returning the unwrapped function to either raising or registering a no-op tool that always errors:

except Exception as e:
    logger.error("Failed to register MCP tool %s: %s", name or func.__name__, e)
    raise  # Fail fast — don't silently serve unprotected tools

4. CI lint (optional, defense-in-depth)

A grep-based check that flags protect=False and direct mcp.add_tool() in tool/ directories.

Why This Matters

The g.user race condition fix in #39385 is correct but structurally fragile — it relies on a decorator being applied to every tool. These safeguards make that invariant enforceable rather than convention-based, turning a silent security regression into a loud startup failure.

Effort

~20 lines of code, plus tests. Small PR.