fix(mcp): refuse the reserved tool name set_model_response - #7145

Fixes #7144

Problem

_RESERVED_TOOL_NAMES exists to refuse MCP tool names the framework itself puts on the wire. set_model_response belongs to that class but was not in the set, so a server advertising it was accepted where transfer_to_agent and the adk_request_* names are rejected.

It is a framework-owned wire name on every count:

• SetModelResponseTool is injected whenever output_schema is set alongside other tools — flows/llm_flows/prompt/_schema.py:54

  set_response_tool = SetModelResponseTool(agent.output_schema)
  llm_request.append_tools([set_response_tool])

• the framework then instructs the model to answer through that name (_schema.py:57-64), and
• base_llm_flow.py reads the result back by the same name — "Check if this is a set_model_response function response".

LlmRequest.append_tools resolves the resulting duplicate by last-wins with only a warning:

if tool.name in self.tools_dict:
    # Both declarations are still advertised to the model, but only one
    # tool can hold the name, so calls land on the survivor.
    logging.warning("Duplicate tool name %r: ...", tool.name)
self.tools_dict[tool.name] = tool

So a server-supplied set_model_response competes for the name, and if it is the survivor the agent's structured final answer is dispatched to the third-party server rather than captured by the framework — precisely the outcome this guard was added to prevent.

Fix

 _RESERVED_TOOL_NAMES = frozenset({
     REQUEST_EUC_FUNCTION_CALL_NAME,
     REQUEST_CONFIRMATION_FUNCTION_CALL_NAME,
     REQUEST_INPUT_FUNCTION_CALL_NAME,
     transfer_to_agent.__name__,
+    # Injected by the output-schema processor whenever output_schema is set
+    # alongside other tools (flows/llm_flows/prompt/_schema.py) and read back
+    # by name in base_llm_flow.py, so it is a framework-owned wire name too.
+    # Spelled out because the function is defined inside
+    # SetModelResponseTool.__init__ and is not importable.
+    'set_model_response',
 })

The name is written literally rather than as something.__name__, unlike transfer_to_agent: the callable is defined inside SetModelResponseTool.__init__, so there is no module-level binding to import. Importing it would have raised ImportError for every importer of mcp_tool.

Tests

Both existing reserved-name tests are extended rather than duplicated:

• test_mcp_tool.py::test_init_reserved_name — adds "set_model_response" to the parametrized list, asserting MCPTool construction raises ValueError.
• test_mcp_toolset.py::test_get_tools_skips_reserved_names — the server now also advertises set_model_response; the assertion that only valid_tool survives is unchanged.

Scope note

I checked only this name end to end. Other in-model names (google_search, url_context, code_execution, …) may warrant the same treatment, but I could not confirm each reaches tools_dict, so they are deliberately not included here.