fix: hide input values from tool validation error messages

Tool validation errors previously echoed the rejected input value via
pydantic's default str(ValidationError) format, leaking PII/PHI in
servers that handle sensitive data.

Set hide_input_in_errors=True on ArgModelBase.model_config so the
generated arg model never includes input_value in its error messages.
The error still describes the rule (type, constraint) but not the data.

Fixes #3572

Author: MohammadaminAlbooyeh

src/mcp/server/mcpserver/utilities/func_metadata.py

@@ -109,7 +109,7 @@ def model_dump_one_level(self) -> dict[str, Any]:
             kwargs[output_name] = value
         return kwargs
 
-    model_config = ConfigDict(arbitrary_types_allowed=True)
+    model_config = ConfigDict(arbitrary_types_allowed=True, hide_input_in_errors=True)
 
 
 class FuncMetadata(BaseModel):

tests/server/mcpserver/test_func_metadata.py

@@ -1520,3 +1520,22 @@ def fn() -> StepA | StepB: ...  # pragma: no branch
 
     meta = func_metadata(fn)
     assert meta.output_schema is None
+
+
+def test_validation_error_does_not_echo_input_value():
+    """Tool validation errors must not leak the rejected input value (PII/PHI risk).
+
+    Regression test for: https://github.com/modelcontextprotocol/python-sdk/issues/3572
+    """
+
+    def fn(name: str, age: int) -> str: ...  # pragma: no branch
+
+    meta = func_metadata(fn)
+    with pytest.raises(Exception) as exc_info:
+        meta.arg_model.model_validate({"name": "Alice", "age": "not-a-number"})
+
+    error_text = str(exc_info.value)
+    assert "not-a-number" not in error_text, "Rejected input value must not appear in validation error message"
+    assert "int_parsing" in error_text or "int" in error_text.lower(), (
+        "Error should still describe the rule (type mismatch)"
+    )