Pydantic AI 2.58 fixes two security problems in MCP and UI adapters

A team shipping an agent on top of pydantic-ai added OpenTelemetry tracing so an on-call engineer could see every tool call. Pydantic says that tracing has, until this release, also been writing their Model Context Protocol server URLs, authorization tokens and custom header values into the trace, with include_content=False set.

Pydantic AI 2.58.0 carries two medium-severity security advisories and ships the fix for both. The library has 20,744 stars on GitHub.

The telemetry advisory

GHSA-xv4x-g8mx-ch56 covers two paths in provider-native MCP configuration. In the first, server URLs, authorization tokens and custom header values could reach OpenTelemetry request traces even when include_content=False was set, which is the setting an operator uses when the trace should record call shapes but not call bodies. In the second, URL-based MCP capabilities could expose a credential that was embedded in the identifier derived from the URL. Pydantic's own advice is to restrict access to historical traces and to rotate exposed credentials, in that order. Fixed in 2.58.0 and in the v1 line's 1.107.8.

Pydantic also publishes a Temporal-specific note. URL-based MCP activity names are deliberately unchanged in this release, so in-flight Temporal workflows do not break on rename. Teams with Temporal tracing enabled are asked to pass an explicit id= to each MCP once in-flight workflows have completed, because changing it will rename the activities.

The UI adapter advisory

GHSA-5pfm-2g3g-gh85 is narrower in scope and more direct in effect. With a non-empty server-side message_history and manage_system_prompt='server', which is the default, the Vercel AI and AG-UI adapters could execute any available tool with arguments the client chose, without the model being asked at all. In practice this means a request carrying a crafted history could call a tool directly. Approval-required tools are not reachable this way, pydantic says. Fixed in 2.58.0, and v1 is unaffected.

What else is in this release

The release also tightens how usage accounting works around resumed suspended runs, so a suspended response counts only in the run that produced it, in RunUsage, UsageLimits and SpendLimits. The DBOS integration gets its own compatibility caveat worth reading in advance: workflows using Planning with an event_stream_handler may not recover across the upgrade, so pydantic asks operators to let in-flight workflows finish before deploying the new version.

New features include ModelSettings['max_retries'] and ModelSettings['request_timeout'] to put bounds on provider SDK retries and total request time, a run-level timeout= and RunContext.deadline to cap a whole agent run, a message-store rewrite that stops SqliteStepStore, PostgresStepStore and MongoStepStore repeating the whole history in every snapshot, and an openai-chatgpt provider that lets an app user sign in with ChatGPT and spend their own plan.

Teams running pydantic-ai with MCP and OpenTelemetry should treat this as a credential-rotation release rather than a routine upgrade. The upgrade stops new tokens leaking, but any token already in a stored trace is already readable to whoever can read that trace. Teams using the Vercel AI or AG-UI adapters with server-side history and the default system-prompt management should upgrade before the next request.

Source

Pydantic AI v2.58.0 release notes, Pydantic.