{"record":{"id":"347a16b100150bda","repo":"huggingface/smolagents","slug":"loading-tools-from-mcp-requires-you-to-acknowledge","errorCode":null,"errorMessage":"Loading tools from MCP requires you to acknowledge you trust the MCP server, as it will execute code on your local machine: pass `trust_remote_code=True`.","messagePattern":"Loading tools from MCP requires you to acknowledge you trust the MCP server, as it will execute code on your local machine: pass `trust_remote_code=True`\\.","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"src/smolagents/tools.py","lineNumber":1053,"sourceCode":"\n        try:\n            from mcpadapt.core import MCPAdapt\n            from mcpadapt.smolagents_adapter import SmolAgentsAdapter\n        except ImportError:\n            raise ImportError(\n                \"\"\"Please install 'mcp' extra to use ToolCollection.from_mcp: `pip install 'smolagents[mcp]'`.\"\"\"\n            )\n        if isinstance(server_parameters, dict):\n            transport = server_parameters.get(\"transport\")\n            if transport is None:\n                transport = \"streamable-http\"\n                server_parameters[\"transport\"] = transport\n            if transport not in {\"sse\", \"streamable-http\"}:\n                raise ValueError(\n                    f\"Unsupported transport: {transport}. Supported transports are 'streamable-http' and 'sse'.\"\n                )\n        if not trust_remote_code:\n            raise ValueError(\n                \"Loading tools from MCP requires you to acknowledge you trust the MCP server, \"\n                \"as it will execute code on your local machine: pass `trust_remote_code=True`.\"\n            )\n        with MCPAdapt(server_parameters, SmolAgentsAdapter(structured_output=structured_output)) as tools:\n            yield cls(tools)\n\n\ndef tool(tool_function: Callable) -> Tool:\n    \"\"\"\n    Convert a function into an instance of a dynamically created Tool subclass.\n\n    Args:\n        tool_function (`Callable`): Function to convert into a Tool subclass.\n            Should have type hints for each input and a type hint for the output.\n            Should also have a docstring including the description of the function\n            and an 'Args:' part where each argument is described.\n    \"\"\"\n    tool_json_schema = get_json_schema(tool_function)[\"function\"]","sourceCodeStart":1035,"sourceCodeEnd":1071,"githubUrl":"https://github.com/huggingface/smolagents/blob/30bb1161095dbae2271e6bc3cc4c219cc3897a57/src/smolagents/tools.py#L1035-L1071","documentation":"Loading tools from an MCP server executes code from that server on your local machine, so smolagents requires explicit opt-in. from_mcp refuses to proceed unless `trust_remote_code=True` is passed, mirroring the transformers convention for remote code.","triggerScenarios":"Calling `ToolCollection.from_mcp(server_parameters)` without the `trust_remote_code=True` keyword argument.","commonSituations":"Copy-pasting examples that omit the flag; automated pipelines where the flag was dropped during refactor; users unaware of the security implications of MCP tool loading.","solutions":["Pass `trust_remote_code=True` once you have verified you trust the MCP server","Audit the MCP server's tool code before enabling the flag","Pin the MCP server URL to a known, TLS-protected endpoint when enabling trust"],"exampleFix":"# before\ntools = ToolCollection.from_mcp({\"url\": \"http://localhost:8000/mcp\"})\n# after\ntools = ToolCollection.from_mcp({\"url\": \"http://localhost:8000/mcp\"}, trust_remote_code=True)","handlingStrategy":"validation","validationCode":"if not TRUSTED_MCP_SERVERS:  # your allowlist of vetted server URLs\n    raise RuntimeError(\"Refusing to load untrusted MCP tools\")\ntools = ToolCollection.from_mcp(server_parameters, trust_remote_code=True)","typeGuard":null,"tryCatchPattern":"try:\n    ToolCollection.from_mcp(params, trust_remote_code=True)\nexcept ValueError as e:\n    if \"trust_remote_code\" in str(e):\n        # explicit human decision point before retrying\n        raise PermissionError(\"MCP server not on trusted allowlist\") from e\n    raise","preventionTips":["Maintain an allowlist of trusted MCP server URLs and require trust_remote_code=True only for those","Audit MCP server tool source before enabling trust","Never auto-retry with trust_remote_code=True from generic exception handlers"],"tags":["mcp","security","opt-in","valueerror"],"backgroundTag":"trust-remote-code-required","analyzedSha":"30bb1161095dbae2271e6bc3cc4c219cc3897a57","analyzedAt":"2026-08-28T18:52:54.169Z","schemaVersion":2},"datasetVersion":"2026-08-28T21:17:43.275Z"}