microsoft/aspire · error · ArgumentException

A global MCP approval policy cannot be combined with custom…

Error message

A global MCP approval policy cannot be combined with custom filters.

What it means

FoundryToolboxMcpApprovalPolicy.Create enforces the OpenAI MCP require_approval wire contract: a global approval mode (a plain string) and custom always/never filter objects are mutually exclusive. Providing Global together with Always or Never filters makes the resulting wire JSON ambiguous, so an ArgumentException naming the 'policy' parameter is thrown at tool-definition construction time.

Solutions

Remove the Global mode and keep only the always/never filters.
Remove the always/never filters and keep only Global.
Split the intent across multiple MCP tool definitions with separate policies.
Validate the policy before constructing the tool definition.

Example fix

// before
new FoundryToolboxMcpApprovalPolicy { Global = Never, Always = filter }
// after
new FoundryToolboxMcpApprovalPolicy { Always = filter } // or Global only

Defensive patterns

Strategy: validation

Validate before calling

bool valid = policy.Global is null || (policy.Always is null && policy.Never is null);
if (!valid) throw new ArgumentException("Global mode cannot be combined with custom filters.");

Type guard

static bool IsExclusive(FoundryToolboxMcpApprovalPolicy p) =>
    p.Global is null ? true : (p.Always is null && p.Never is null);

Try / catch

try { toolDefinition = CreateMcpTool(...); }
catch (ArgumentException ex) when (ex.Message.Contains("cannot be combined with custom filters"))
{ logger.LogError("Approval policy sets both Global and filters; keep one."); }

Prevention

Decide between a global mode or per-tool filters when designing the policy
Never merge sample configs that mix Global and filters
Add a unit test asserting policy exclusivity before tool creation

When it happens

Trigger: Constructing a FoundryToolboxMcpApprovalPolicy with Global set to Never or Always AND also supplying an Always or Never FoundryToolboxMcpApprovalFilter in the same policy.

Common situations: Copy-pasting sample code that sets Global then adding tool-specific filters for other tools in the same policy; trying to express 'always require approval except these tools' with a single policy instead of two policies.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/a967bc3b99855e89. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Foundry/Toolbox/FoundryToolboxToolDefinition.cs:227

{
    public static ResolvedFoundryToolboxMcpApprovalPolicy? Create(
        FoundryToolboxMcpApprovalPolicy? policy)
    {
        if (policy is null)
        {
            return null;
        }

        var always = ResolvedFoundryToolboxMcpApprovalFilter.Create(
            policy.Always,
            nameof(policy.Always));
        var never = ResolvedFoundryToolboxMcpApprovalFilter.Create(
            policy.Never,
            nameof(policy.Never));

        if (policy.Global is not null && (always is not null || never is not null))
        {
            throw new ArgumentException(
                "A global MCP approval policy cannot be combined with custom filters.",
                nameof(policy));
        }

        if (policy.Global is null && always is null && never is null)
        {
            throw new ArgumentException(
                "An MCP approval policy must specify a global mode or at least one custom filter.",
                nameof(policy));
        }

        if (policy.Global is not null &&
            policy.Global is not FoundryToolboxMcpGlobalApprovalMode.Never &&
            policy.Global is not FoundryToolboxMcpGlobalApprovalMode.Always)
        {
            throw new ArgumentOutOfRangeException(
                nameof(policy),
                policy.Global,

View on GitHub (pinned to 25830f84bd)