fix(config): load validated MCP toolsets under adk web

[ftnext]

Link to Issue or Description of Change

1. Link to an existing issue:

• Closes: Allow validated McpToolset args in local YAML agents served by adk web #6735
• Related: Restrict builder YAML code references #5292
• Related: Security: resolve_code_reference() allows importing arbitrary Python modules via YAML agent config #5822

Problem:

adk web recursively rejects every YAML key named args as part of the defense against CVE-2026-4810.
This also rejects declarative configuration for the built-in McpToolset.

As a result, a local root_agent.yaml containing McpToolset.args is skipped by the agent loader.
The app is then unknown to the API server and POST /run_sse returns 404.

Solution:

Add a static registry of ADK-owned built-ins whose YAML arguments can be validated without resolving a config-supplied Python reference.

This change:

• matches the literal built-in name McpToolset;
• validates its arguments with the ADK-owned McpToolsetConfig;
• never imports a module selected by the YAML tool name;
• limits the exception to the tools field of a built-in LlmAgent;
• continues rejecting args for custom tools, factories, custom agents, and unregistered built-ins;
• rejects YAML values for callable fields such as httpx_client_factory;
• preserves the existing default rejection of config-supplied stdio servers;
• honors ADK_ALLOW_CONFIG_STDIO_MCP_SERVERS=1 for explicitly trusted stdio configurations;
• updates the config-based Notion MCP sample to document adk web.

This change applies only to agent configurations loaded from the local agents directory.

Agent Builder uploads continue to reject every args key.
Builder support is intentionally out of scope because accepting uploaded remote MCP URLs requires a separate SSRF policy.

Testing Plan

Unit Tests:

• I have added or updated unit tests for my change.
• All relevant unit tests pass locally.

uv run pytest \
  tests/unittests/agents/test_agent_config.py \
  tests/unittests/tools/mcp_tool/test_mcp_toolset.py \
  -q

196 passed

Covered behaviors:

• a registered remote McpToolset loads through the public config API;
• an explicitly opted-in stdio McpToolset loads, including nested command args;
• unregistered tool arguments remain blocked;
• callable MCP configuration fields are rejected;
• a custom agent cannot opt into the exception using a lookalike tools field;
• existing module-reference protections continue to pass.

Type checking:

mypy src/google/adk/agents/config_agent_utils.py

Success: no issues found in 1 source file

Pre-commit:

check yaml............................................Skipped
fix end of files.....................................Passed
trim trailing whitespace............................Passed
ruff.................................................Passed
isort................................................Passed
pyink................................................Passed
addlicense...........................................Passed
Check new Python files...............................Passed
ADK Compliance Checks...............................Passed
mdformat.............................................Passed
codespell............................................Passed

Manual End-to-End (E2E) Tests:

The YAML sample was loaded with the Web YAML denylist enabled

• Run the complete adk web chat flow.

Checklist

• I have read the CONTRIBUTING.md document.
• I have performed a self-review of my own code.
• I have commented my code, particularly in hard-to-understand areas.
• I have added tests that prove my fix is effective.
• Relevant new and existing unit tests pass locally.
• Pre-commit passes for all changed files.
• I have manually tested the complete ADK Web UI flow.
• The corresponding user-facing documentation change is prepared in google/adk-docs.
• Any dependent changes are N/A.

Additional context

This is a positive allowlist layered on top of the existing YAML key denylist, module blocklist, Builder project-boundary checks, and stdio opt-in.

It does not weaken the Agent Builder upload restrictions.