Add MCP-based skills discovery (McpSkill, McpSkillsSource, McpSkillResource)

Implement Agent Skills discovery over MCP following the SEP-2640 convention:
- McpSkillsSource: reads skill://index.json to discover skills served by an MCP server
- McpSkill: lazily fetches SKILL.md content via resources/read on demand
- McpSkillResource: wraps MCP resource results (text and binary)
- Path traversal protection in get_resource for defense in depth
- Samples for Foundry Toolbox and standalone MCP skills server
- Comprehensive unit tests (514 lines)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

python/samples/02-agents/providers/foundry/README.md

@@ -27,6 +27,7 @@ This folder contains Azure AI Foundry and Foundry Local samples for Agent Framew
 | [`foundry_chat_client_with_local_mcp.py`](foundry_chat_client_with_local_mcp.py) | Foundry Chat Client with local MCP |
 | [`foundry_chat_client_with_session.py`](foundry_chat_client_with_session.py) | Foundry Chat Client with session management |
 | [`foundry_chat_client_with_toolbox.py`](foundry_chat_client_with_toolbox.py) | Foundry Chat Client connected to a toolbox via its MCP endpoint using `MCPStreamableHTTPTool` |
+| [`foundry_chat_client_with_toolbox_skills.py`](foundry_chat_client_with_toolbox_skills.py) | Foundry Chat Client that discovers MCP-based skills from a Foundry Toolbox endpoint via `McpSkillsSource` (uses an Azure AD bearer token and the toolbox preview header) |
 
 ## FoundryLocalClient Samples
 

python/samples/02-agents/providers/foundry/foundry_chat_client_with_toolbox_skills.py

@@ -0,0 +1,91 @@
+# Copyright (c) Microsoft. All rights reserved.
+
+import asyncio
+import os
+from collections.abc import Generator
+
+import httpx
+from agent_framework import Agent, McpSkillsSource, SkillsProvider
+from agent_framework.foundry import FoundryChatClient
+from azure.core.credentials import TokenCredential
+from azure.identity import DefaultAzureCredential, get_bearer_token_provider
+from dotenv import load_dotenv
+from mcp.client.session import ClientSession
+from mcp.client.streamable_http import streamable_http_client
+
+# Load environment variables from .env file
+load_dotenv()
+
+"""
+Foundry Chat Client with Toolbox-Hosted Skills
+
+Discover Agent Skills served by a Microsoft Foundry Toolbox MCP endpoint
+and inject them into a ``FoundryChatClient`` agent via ``McpSkillsSource``.
+The toolbox's discovery document (``skill://index.json``) is read once at
+startup; SKILL.md bodies are fetched on demand as the agent uses them.
+
+Prerequisites:
+- A Microsoft Foundry project with a toolbox that exposes
+  ``skill://index.json`` with ``skill-md`` entries
+- FOUNDRY_PROJECT_ENDPOINT and FOUNDRY_MODEL environment variables set
+- FOUNDRY_TOOLBOX_MCP_SERVER_URL: the toolbox's MCP endpoint URL, e.g.
+  ``https://<account>.services.ai.azure.com/api/projects/<project>/toolboxes/<name>/mcp?api-version=v1``
+- Azure CLI authentication (``az login``)
+"""
+
+
+class _BearerAuth(httpx.Auth):
+    """Attach a fresh Foundry bearer token to every request."""
+
+    def __init__(self, credential: TokenCredential) -> None:
+        self._get_token = get_bearer_token_provider(credential, "https://ai.azure.com/.default")
+
+    def auth_flow(self, request: httpx.Request) -> Generator[httpx.Request, httpx.Response, None]:
+        request.headers["Authorization"] = f"Bearer {self._get_token()}"
+        yield request
+
+
+async def main() -> None:
+    """Example showing toolbox-hosted MCP skills for a Foundry Chat Client agent."""
+    # WARNING: DefaultAzureCredential is convenient for development but requires careful
+    # consideration in production. Consider using a specific credential (e.g.,
+    # ManagedIdentityCredential) to avoid latency, unintended credential probing, and
+    # potential security risks from fallback mechanisms.
+    credential = DefaultAzureCredential()
+
+    # HTTP client that signs every request with a fresh Foundry bearer token
+    # and advertises the toolbox preview feature flag, plus the MCP streamable
+    # HTTP transport that uses it.
+    async with (
+        httpx.AsyncClient(
+            auth=_BearerAuth(credential),
+            headers={"Foundry-Features": "Toolboxes=V1Preview"},
+            timeout=httpx.Timeout(30.0, read=300.0),
+            follow_redirects=True,
+        ) as http_client,
+        streamable_http_client(
+            url=os.environ["FOUNDRY_TOOLBOX_MCP_SERVER_URL"],
+            http_client=http_client,
+        ) as (read, write, _),
+        ClientSession(read, write) as session,
+    ):
+        await session.initialize()
+
+        # Discover skills served by the toolbox and inject them as a context provider.
+        skills_provider = SkillsProvider(McpSkillsSource(client=session))
+
+        async with Agent(
+            client=FoundryChatClient(credential=credential),
+            name="ToolboxMcpSkillsAgent",
+            instructions="You are a helpful assistant. Use available skills to answer the user.",
+            context_providers=[skills_provider],
+        ) as agent:
+            query = input("User: ").strip()  # noqa: ASYNC250
+            if not query:
+                return
+            response = await agent.run(query)
+            print(f"Assistant: {response.text}")
+
+
+if __name__ == "__main__":
+    asyncio.run(main())

python/samples/02-agents/skills/README.md

@@ -12,6 +12,7 @@ Start with file-based or code-defined skills, then explore combining them and ad
 | [**code_defined_skill**](code_defined_skill/) | Define skills entirely in Python code using `Skill`, `@skill.resource`, and `@skill.script` decorators. Uses a code-defined unit-converter skill. |
 | [**class_based_skill**](class_based_skill/) | Define skills as Python classes using `ClassSkill` with `@ClassSkill.resource` and `@ClassSkill.script` decorators for auto-discovery. Uses a class-based unit-converter skill. |
 | [**mixed_skills**](mixed_skills/) | Combine code-defined, class-based, and file-based skills in a single agent. Uses a code-defined volume-converter, a class-based temperature-converter, and a file-based unit-converter. |
+| [**mcp_based_skill**](mcp_based_skill/) | Discover skills served over the [Model Context Protocol (MCP)](https://modelcontextprotocol.io) via `McpSkillsSource`. Connects to a remote MCP server that exposes skills as `skill://...` resources following the SEP-2640 convention. |
 | [**script_approval**](script_approval/) | Require human-in-the-loop approval before executing skill scripts |
 
 ## Key Concepts

python/samples/02-agents/skills/mcp_based_skill/README.md

@@ -0,0 +1,51 @@
+# MCP-Based Agent Skills Sample
+
+This sample demonstrates how to discover **Agent Skills served over MCP** with an `Agent`.
+
+## What it demonstrates
+
+- Connecting to a remote MCP server (over streamable HTTP) that exposes skill
+  resources following the SEP-2640 convention.
+- Building a `SkillsProvider` from an `McpSkillsSource`, which reads
+  `skill://index.json` (SEP-2640 canonical discovery) and constructs skills from
+  the index entries.
+- The progressive disclosure pattern across MCP: advertise → load → read
+  resources, exactly as for filesystem-backed skills.
+
+## Running the Sample
+
+### Prerequisites
+
+- Python 3.10+
+- An [Azure AI Foundry](https://ai.azure.com/) project with a deployed model
+- Azure CLI authentication (`az login`)
+- A running MCP server that hosts SEP-2640 skill resources (see "Providing
+  an MCP server" below)
+
+### Setup
+
+Set the following environment variables (in a `.env` file or your shell):
+
+```powershell
+$env:FOUNDRY_PROJECT_ENDPOINT="https://your-endpoint.services.ai.azure.com/api/projects/your-project"
+$env:FOUNDRY_MODEL="gpt-4o-mini"
+$env:MCP_SKILLS_SERVER_URL="https://your-mcp-server.example.com/mcp"
+```
+
+### Run
+
+```powershell
+python mcp_based_skill.py
+```
+
+## Providing an MCP server
+
+This sample is a **consumer**: it does not host an MCP server itself. To try
+it end-to-end you need an MCP server that exposes the SEP-2640 skill
+resources (`skill://index.json` plus per-skill `SKILL.md`).
+
+- See [`samples/02-agents/mcp/agent_as_mcp_server.py`](../../mcp/agent_as_mcp_server.py)
+  for an example of hosting an MCP server via the Agent Framework.
+- The Model Context Protocol working group maintains reference MCP-skills
+  servers at
+  [`modelcontextprotocol/experimental-ext-skills`](https://github.com/modelcontextprotocol/experimental-ext-skills).

python/samples/02-agents/skills/mcp_based_skill/mcp_based_skill.py

@@ -0,0 +1,88 @@
+# Copyright (c) Microsoft. All rights reserved.
+
+import asyncio
+import os
+
+# Uncomment this filter to suppress the experimental Skills warning before
+# using the sample's Skills APIs.
+# import warnings
+# warnings.filterwarnings("ignore", message=r"\[SKILLS\].*", category=FutureWarning)
+from agent_framework import Agent, McpSkillsSource, SkillsProvider
+from agent_framework.foundry import FoundryChatClient
+from azure.identity import AzureCliCredential
+from dotenv import load_dotenv
+from mcp.client.session import ClientSession
+from mcp.client.streamable_http import streamable_http_client
+
+"""
+MCP-Based Agent Skills
+
+This sample demonstrates how to discover Agent Skills served over the
+Model Context Protocol (MCP) using :class:`McpSkillsSource`.
+
+The sample connects to a remote MCP server that exposes skill resources
+under the ``skill://`` URI scheme:
+
+* ``skill://index.json`` — discovery document listing all skills
+* ``skill://<skill-name>/SKILL.md`` — the skill instructions
+
+To run, set ``MCP_SKILLS_SERVER_URL`` to the streamable HTTP endpoint of an
+MCP server that hosts the skill resources.
+"""
+
+
+async def main() -> None:
+    """Connect to a remote MCP skills server and run the agent."""
+    load_dotenv()
+
+    endpoint = os.environ["FOUNDRY_PROJECT_ENDPOINT"]
+    deployment = os.environ.get("FOUNDRY_MODEL", "gpt-4o-mini")
+    mcp_url = os.environ["MCP_SKILLS_SERVER_URL"]
+
+    print("Discovering MCP-based skills")
+    print("-" * 60)
+
+    # 1. Connect to the MCP server over streamable HTTP.
+    async with streamable_http_client(url=mcp_url) as (read, write, _), ClientSession(read, write) as session:
+        await session.initialize()
+
+        # 2. Build a SkillsProvider that discovers skills over MCP.
+        #    McpSkillsSource reads skill://index.json and creates one
+        #    McpSkill per skill-md entry; SKILL.md bodies are fetched
+        #    on demand via resources/read.
+        skills_provider = SkillsProvider(McpSkillsSource(client=session))
+
+        # 3. Run the agent.
+        client = FoundryChatClient(
+            project_endpoint=endpoint,
+            model=deployment,
+            credential=AzureCliCredential(),
+        )
+
+        async with Agent(
+            client=client,
+            instructions="You are a helpful assistant. Use available skills to answer the user.",
+            context_providers=[skills_provider],
+        ) as agent:
+            response = await agent.run(
+                "What skills do you have?"
+            )
+            print(f"Agent: {response}\n")
+
+
+if __name__ == "__main__":
+    asyncio.run(main())
+
+
+"""
+Sample output:
+
+Discovering MCP-based skills
+------------------------------------------------------------
+Agent: Here are your conversions:
+
+1. **26.2 miles -> 42.16 km** (a marathon distance)
+2. **75 kg -> 165.35 lbs**
+
+Conversion factors used: miles * 1.60934 and kilograms * 2.20462.
+"""