Motivation & Context

This pull request updates the documentation for the __init__ method in the python/packages/core/agent_framework/_mcp.py file to clarify security considerations when configuring custom HTTP clients and headers. The main focus is on preventing sensitive header leakage during cross-origin redirects.

Security and documentation improvements:

• Added explicit warnings to the docstring about the risks of leaking sensitive headers (like authentication tokens) when using a custom http_client, and clarified that the framework's built-in header_provider only attaches headers to requests matching the configured origin. Users must enforce this origin-scoped policy themselves if supplying headers via a custom client.
• Clarified that the header_provider hook attaches headers only to requests matching the configured origin, and reiterated the need for users to enforce this policy when using custom clients.

Description & Review Guide

• What are the major changes?
  • Security and documentation improvements
• What is the impact of these changes?
  • Public guidance for our customers
• What do you want reviewers to focus on?
  • The accuracy of the commens

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.