fix(mcp): fail unsuccessful verification

[apurvvkumaria]

Outcome

MCP tool discovery now fails closed when either the sandbox command or its structured result reports failure. The result preserves the command status, classifies the failed stage, exits non-zero for automation, and keeps credentials and untrusted response text out of diagnostics.

Reason

Hermes can return command status 0 after a connection or authentication failure. Callers that trusted only that status could record an unusable managed MCP endpoint as verified.

Related issues

Fixes #10944

Part of #10942

Related to #6901, #7104, and #8697.

PR #11087 was inspected as prior evidence only. This candidate was implemented independently from current main and makes no change to that PR.

Changes

• Upgrade the shared reviewed discovery result to protocol 2 with commandStatus, failedStage, and failureClass. The host checks a non-zero command status before parsing output, and a zero-status structured failure remains a failure.
• Classify refusal, DNS, TLS, and timeout failures as connection failures; classify HTTP 401 and 403 as authentication failures; and retain protocol and tool-operation classifications without returning endpoint error text or response bodies.
• Make mcp status <server> --tools exit non-zero unless discovery succeeds. Preflight skips, missing runtimes, malformed frames, structured failures, and non-zero sandbox commands therefore remain machine-detectable failures.
• Update the existing managed-image contract, reviewed bundle, workflow checks, and image tests together so all managed agent images expose the same exact protocol.
• Extend the existing Hermes MCP live scenario with successful authenticated initialization and paginated tools/list, denied authentication with HTTP 401, redacted diagnostics, fixture credential restoration, and exact NemoClaw, Hermes, OpenShell, operating-system, and container-runtime evidence.
• Keep discovery at initialize, notifications/initialized, and paginated tools/list. Issue Add opt-in live MCP tool discovery to mcp status #6901 accepted this opt-in discovery contract and explicitly excluded tools/call; existing real Hermes adapter calls remain in the live scenario for the final-use requirement from Hermes MCP rebuild reports verified on OpenShell v0.0.101 but first provider-backed tool call returns HTTP 500 #8697.
• Keep lifecycle ownership unchanged. Onboarding does not have a mandatory MCP network verifier today, so this change does not create a new supported onboarding gate. Existing restart and rebuild recovery validation remains fail-closed: an unverified MCP restore keeps post-restore incomplete, as covered by the focused rebuild recovery tests.

Verification

• npx vitest run --project cli src/lib/actions/sandbox/mcp-bridge-tool-discovery.test.ts src/lib/actions/sandbox/mcp-tool-discovery-runtime.test.ts src/lib/actions/sandbox/mcp-bridge-status-resolution.test.ts src/lib/actions/sandbox/rebuild-flow-recovery.test.ts src/lib/actions/sandbox/rebuild-post-restore-phase.test.ts src/lib/actions/sandbox/rebuild-hermes-post-restore.test.ts — 157 passed.
• npx vitest run --project e2e-support test/e2e/support/mcp-bridge-tool-discovery.test.ts — 51 passed.
• npx vitest run --project integration test/mcp/mcp-tool-discovery-image-contract.test.ts test/inference/managed/managed-image-publication-workflow.test.ts — 52 passed.
• npm --prefix tools/mcp-tool-discovery-runtime test — passed.
• npm --prefix tools/mcp-tool-discovery-runtime run typecheck — passed.
• npm --prefix tools/mcp-tool-discovery-runtime run bundle:reviewed:check — passed.
• npm run typecheck:cli — passed.
• npm run test:changed — 2,074 passed and 15 skipped with the repository-pinned macOS Python test dependencies available.
• npm run docs — passed with 0 Fern errors.
• npm run checks:repository — passed.
• npm run e2e:assertions:check — passed without increasing the assertion budget.
• npx tsx scripts/checks/e2e-mock-parity.mts --base origin/main — passed.
• npm run validate:pr — pre-commit, commit-message, and pre-push validation passed.
• Images / Build, Test, and Publish Managed Images — both exact OpenClaw managed-image MCP discovery passes and the exact all-agent managed runtime activation passed for candidate 0689940 before the review repairs. Each MCP pass exercised authenticated discovery, denied authentication, and the fixture-credential artifact scan.
• The validation hooks ran gitleaks successfully. The diff contains no secrets, API keys, or credentials.

Review notes

The canonical sensitive-path policy at base 3e605bc55b4a660b03bf1e132bdd9725078e346c classifies .github/workflows/managed-images.yaml, agents/hermes/Dockerfile, agents/langchain-deepagents-code/Dockerfile, and tools/mcp-tool-discovery-runtime/** as sensitive.

The PR Review Advisor completed for candidate 0689940813e02c30571dd19dd64821a66dfb6f01. This candidate resolves its documentation drift, older discovery-protocol recovery, and exact Dockerfile instruction-hash findings. The architecture specialist recommended one writable protocol owner across the host, bundled sandbox runtime, Dockerfiles, and workflow. I did not apply that recommendation because those consumers cross host/sandbox and source/generated-image trust boundaries. The host cannot import the sandbox runtime, while Dockerfile and workflow literals are exact publication assertions. The reduction specialist found the independent boundary checks appropriate, and the contract tests continue to require exact agreement.

I self-reviewed the complete NVIDIA/NemoClaw candidate at 3970b654138630b603bab7f772b0bdb8fb2ffb7f, including input trust, command construction, credential handling and redaction, process and structured-result classification, retry and cleanup behavior, lifecycle failure propagation, managed-image publication, the review repairs, and the conflict-free integration of current main. I found no unresolved candidate-owned blocker. This draft awaits evaluation of the current candidate.

---

Signed-off-by: Apurv Kumaria akumaria@nvidia.com

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-11223.docs.buildwithfern.com/nemoclaw

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall line coverage in commit 3970b65 in the codex/fix-10944-mcp-... branch remains at 96%, unchanged from commit 3e605bc in the main branch.

TypeScript / code-coverage/cli

The overall line coverage in commit 3970b65 in the codex/fix-10944-mcp-... branch remains at 83%, unchanged from commit 3e605bc in the main branch.

Show a line coverage summary of the most impacted files.

File	main 3e605bc	codex/fix-10944-mcp-... 3970b65	+/-
src/lib/onboard...-desktop-gpu.ts	97%	81%	-16%
src/lib/inferen...ocal-runtime.ts	97%	87%	-10%
src/lib/onboard...on-authority.ts	88%	82%	-6%
src/lib/actions...oy-execution.ts	94%	91%	-3%
src/lib/onboard...ce-lifecycle.ts	82%	80%	-2%
src/lib/actions...dbox/destroy.ts	88%	87%	-1%
src/lib/onboard...-transaction.ts	69%	70%	+1%
src/lib/onboard...ed-lifecycle.ts	75%	77%	+2%
src/lib/onboard...eate-journal.ts	82%	87%	+5%
src/lib/onboard...w-auto-apply.ts	73%	86%	+13%

---

_{Updated September 08, 2026 19:01 UTC}

[github-actions]

PR Review Advisor finished for commit 0689940. Include the Advisor findings in the complete PR feedback collection. Verify and group valid findings before repair.

All previous runs

[apurvvkumaria]

PR Review Advisor needs a maintainer decision for the current candidate 3970b654138630b603bab7f772b0bdb8fb2ffb7f.

All ordinary CI and exact managed-image checks passed for this candidate. The exact OpenClaw MCP discovery checks passed twice, including authenticated discovery and denied authentication. The operability and recovery specialist also completed and reported no defect.

Eight Advisor specialists in workflow run 34264866154 did not produce their expected review artifacts:

Specialist	Job	Expected artifact
Architecture and standard work	102191965651	pr-review-specialist-architecture-standard-work-1
Customer value and behavior	102191965653	pr-review-specialist-customer-value-behavior-1
Documentation and standard work	102191965654	pr-review-specialist-documentation-standard-work-1
Security and built-in quality	102191965671	pr-review-specialist-security-built-in-quality-1
Verification and mistake proofing	102191965701	pr-review-specialist-verification-mistake-proofing-1
Reduction and simplification	102191965703	pr-review-specialist-reduction-simplification-1
Migration completion	102191965718	pr-review-specialist-migration-completion-1
Delivery flow	102191965794	pr-review-specialist-delivery-flow-1

The architecture, customer, verification, and reduction jobs reached the 900-second provider timeout. The documentation, security, migration, and delivery jobs exhausted provider retries with HTTP 429 responses. Their upload steps then had no files to publish.

Per the PR follow-up policy, I kept the candidate unchanged and did not rerun the workflow. Maintainers: please decide whether to rerun the full PR Review Advisor workflow for this exact candidate or defer the incomplete Advisor evaluation.

[apurvvkumaria]

Maintainer decision for candidate 3970b654138630b603bab7f772b0bdb8fb2ffb7f: the incomplete PR Review Advisor evaluation from run 34264866154 is explicitly accepted and deferred. Do not rerun it for this candidate.

The eight missing specialist artifacts are treated as optional review evidence for this candidate; they produced no blocking findings. This decision does not waive new findings or required-check failures that appear later.

[apurvvkumaria]

Closing in favor of #11087, which is the active implementation for #10944.