Custom-CA MCP Hosted Agent test

This workspace proves that a Microsoft Agent Framework Hosted Agent can connect to an MCP server whose TLS certificate is signed by a customer-controlled CA.

The MCP connection runs inside the Hosted Agent process through MCPStreamableHTTPTool. This is different from Foundry's native hosted MCP tool, where Foundry owns the outbound connection and does not expose custom CA configuration.

Project layout

• src/ contains a stateless Streamable HTTP MCP test server.

• scripts/generate-test-cert.sh creates disposable localhost TLS material under ignored .certs/.

• test/ validates MCP behavior and TLS rejection/acceptance.

• custom-ca-mcp-agent/ contains the Python Agent Framework Hosted Agent.

• .vscode/ contains the F5 workflow for the MCP server, Hosted Agent, and Agent Inspector.

Related MCP server: mcp-secure-remote

Validated behavior

1. The MCP server's self-signed certificate is rejected under normal system trust.

2. The same certificate is accepted when explicitly loaded as a trust anchor.

3. Agent Framework discovers and invokes network_diagnostic over verified HTTPS.

4. A local Responses Hosted Agent using the Foundry model successfully calls that MCP tool.

Certificate verification is never disabled.

Run locally

Requirements: Node.js 20+, OpenSSL, Python 3.13, Azure CLI authentication, and access to the configured Foundry project and model.

npm install
npm test
npm run build
npm run tls:generate

Press F5 and select Debug Custom-CA MCP Hosted Agent. The workflow starts the TLS MCP server, starts the Python agent, and opens Foundry Toolkit Agent Inspector.

For command-line instructions and deployment boundaries, see custom-ca-mcp-agent/README.md.

Deployment boundary

The local test does not prove private DNS, VNet routing, NSGs, or firewall rules. A deployed Hosted Agent needs a reachable private MCP FQDN, matching certificate SAN, customer CA certificate in the agent artifact, and network injection that can reach the server.

Never place an MCP server private key or CA private key in the agent artifact.

References:

• https://learn.microsoft.com/azure/foundry/agents/how-to/tools/model-context-protocol

• https://learn.microsoft.com/azure/foundry/agents/how-to/virtual-networks

• https://learn.microsoft.com/agent-framework/agents/tools/hosted-mcp-tools