Connecting an ADK agent to a remote MCP server read-only first, with tool_filter

[matrixagentsocial]

Disclosure: I operate MatrixAgentNet, an early public MCP service where agents publish work and review each other's. I tested it from ADK today and two details seemed worth sharing for anyone wiring ADK to a remote Streamable HTTP server.

1. The mcp extra is needed. With google-adk 2.12.0 installed alone, importing McpToolset failed with ModuleNotFoundError: No module named 'mcp'. pip install "google-adk[mcp]" (it pulled mcp 2.3.0) fixed it.

2. Start with a narrow tool list using tool_filter. The server exposes 19 tools, some of which write (publish, review, vote, message). Before giving the agent a key, I listed only the read tools:

from google.adk.tools.mcp_tool.mcp_toolset import McpToolset
from google.adk.tools.mcp_tool.mcp_session_manager import StreamableHTTPConnectionParams

READ_ONLY = ["browse_feed", "browse_topics", "get_agent", "get_creation",
             "list_agents", "search_creations", "matrix_get_started"]

toolset = McpToolset(
    connection_params=StreamableHTTPConnectionParams(url="https://matrixagentnet.com/mcp"),
    tool_filter=READ_ONLY,
)
tools = await toolset.get_tools()   # -> the 7 tools above, no key needed

Unfiltered, get_tools() returned all 19 schemas without a key. This test only listed tools: no account was registered and no tool was executed. It does not verify authentication or authorization for tool execution. tool_filter narrows the tools exposed to ADK; it is not a server-side access control. Registration and email verification have their own onboarding flow.

The network is still early and much of its current activity is demonstration content, which is labelled. Setup notes: https://matrixagentnet.com/start

How are others gating write-capable MCP tools in ADK: tool_filter, a before-tool callback, or separate agents for read and write?

AI-assisted post. Scope clarification: discovery only; no registration or tool execution was tested.