Fix outbound MCP tool calls that wrap parameters in kwargs

[Bionic711]

Issue

Outbound MCP tool calls can forward tool parameters under a kwargs wrapper instead of as top-level MCP tool arguments. This breaks MCP servers such as Splunk that require schema fields like type, because the server receives kwargs but cannot see the required field.

Steps to Reproduce

1. Configure an outbound MCP action with a discovered tool that has required input parameters, such as a Splunk MCP tool requiring type.
2. Invoke the tool through SimpleChat's Semantic Kernel MCP action surface.
3. Observe the MCP server validation response.

Expected Behavior

SimpleChat forwards tool inputs as top-level fields inside the MCP tools/call arguments object, for example { "type": "..." }.

Actual Behavior

SimpleChat can forward { "kwargs": { "type": "..." } }, so the MCP server reports missing required fields such as type. Tools without parameters can still work, which makes the issue appear only for parameterized tools.

Impact

P1 user-facing integration bug. Parameterized outbound MCP tools cannot reliably execute against standards-compliant MCP servers, blocking external-system actions such as Splunk queries while leaving no-parameter tools unaffected.

Notes

The MCP protocol expects tools/call parameters to include name and an arguments object whose properties are the tool parameters. The likely SimpleChat code path is the dynamic MCP Semantic Kernel function wrapper in semantic_kernel_plugins/mcp_plugin.py, which receives **kwargs and forwards the resulting mapping into the MCP factory. The fix should normalize wrapper-shaped arguments before schema validation and before the native MCP connector invocation, while preserving legitimate tools that intentionally define a top-level kwargs field.

[Bionic711]

Implemented locally on branch fix/mcp-kwargs-argument-normalization.

Summary:

• Added schema-aware outbound MCP argument normalization so single-key {"kwargs": {...}} wrappers are unwrapped before JSON Schema validation and native MCP invocation.
• Preserved legitimate tools that explicitly define a top-level kwargs property in their input schema.
• Wired the normalization into McpPlugin.call_tool(...) before validation/invocation.
• Added functional_tests/test_mcp_tool_argument_normalization.py covering Splunk-style required type, direct arguments, legitimate kwargs schema, no-argument calls, and the McpPlugin.call_tool(...) path.
• Bumped app version to 0.250.127 and added a release note entry under v0.250.127.

Validation:

• python functional_tests\test_mcp_tool_argument_normalization.py
• .\.venv\Scripts\python.exe functional_tests\test_mcp_tool_argument_normalization.py
• .\.venv\Scripts\python.exe functional_tests\test_mcp_action_manifest_workflow.py
• .\.venv\Scripts\python.exe functional_tests\test_mcp_phase2_probe_metadata.py
• .\.venv\Scripts\python.exe functional_tests\test_app_version_assertion_guardrails.py
• .\.venv\Scripts\python.exe -m py_compile application\single_app\functions_mcp_operations.py application\single_app\semantic_kernel_plugins\mcp_plugin.py functional_tests\test_mcp_tool_argument_normalization.py application\single_app\config.py
• XSS and broken-access-control guardrails passed on the changed app files.
• git diff --check passed.

Notes:

• A full-file whitespace probe over config.py still reports legacy trailing whitespace in untouched import sections; the changed version line passes git diff --check.

[Bionic711]

Follow-up: added factory-level defense-in-depth as well.

• McpPluginFactory.call_tool_from_config(...) now normalizes wrapped kwargs when matching cached MCP tool metadata is available.
• The factory path stays conservative when no cached tool metadata exists, preserving the wrapper for unknown tools instead of guessing.
• Regression coverage now validates both the McpPlugin.call_tool(...) path and direct factory callers.
• Targeted validation was rerun successfully, including MCP normalization, MCP action manifest workflow, MCP probe metadata, app-version guardrail, py_compile, XSS guardrail, broken-access-control guardrail, and git diff --check.