Pydantic AI keeps MCP tokens out of traces

In plain English

Your agent’s traces might be holding keys they were never meant to keep.

Pydantic AI is a Python framework for building AI agents. MCP lets an agent use tools that live on another server, and OpenTelemetry records a trace of each request so you can debug it later. The maintainers published both fixes on Oct 20, 2026.

Credentials that could end up in traces

With request tracing on, provider-native MCP tools (MCPServerTool, including MCP(native=True)) could write MCP server URLs, authorization tokens and custom header values into OpenTelemetry traces, even with include_content=False.

A URL-based MCP capability could also expose a credential that was part of its URL, through a name built from that URL. Anyone who can read those traces could see the values.

On v1, MCP(url=...) uses provider-native MCP by default when the model supports it. On v2, local MCP is the default. A plain MCPToolset passed through toolsets= with an id you chose isn’t affected.

Tool calls that skipped the model

The Vercel AI and AG-UI adapters connect an agent to a chat front end. A client could shape the history it sent so the agent ran a tool with arguments the client chose, without a model request.

Arguments are still checked against the tool’s schema, and tools that require approval don’t run this way. Only v2 is affected.

You’re affected only if all of these apply:

• You serve an agent through the Vercel AI or AG-UI adapter.
• You pass your own non-empty server-side message_history to the adapter.
• manage_system_prompt is 'server' (the default).
• You count on the model or a model-request hook, rather than the tool itself or before_tool_execute, to limit how a tool that doesn’t require approval gets called.

What to do

• Upgrade pydantic-ai or pydantic-ai-slim to 2.58.0, or to 1.107.8 if you’re on v1.
• Restrict who can open your older traces.
• Rotate any credentials those traces exposed.
• On v2, if you run a URL-based MCP under Temporal with tracing on, also pass an explicit id= to MCP, but only after in-flight workflows finish, because it renames the MCP activities.
• Can’t upgrade the adapters yet? Enforce authorization inside each tool function, put guardrails in before_tool_execute, and require approval for tools whose effects matter.