docs(network-policy): document custom URL-based MCP server allowlist (#5322) - #6246
Merged
Conversation
…5322) Adding a Streamable HTTP MCP server URL to OpenClaw currently fails with a 403 CONNECT tunnel because the target host is not on the default sandbox egress allowlist. The customize-network-policy guide already shows the general preset+policy-add pattern (influxdb example) but users searching for MCP-specific guidance did not find a landing section that walked through that pattern for MCP URLs. Add a Custom Recipe subsection under Dynamic Changes with: - the exact 403 symptom users see - a copy-paste preset YAML using the validated shape (preset.name kebab-case, network_policies snake, binaries list) - the policy-add command with --from-file - a Note explaining why binaries must be listed alongside endpoints - a Warning about the RFC 1123 preset name constraint Fixes #5322. Signed-off-by: Yanyun Liao <yanyunl@nvidia.com>
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
💤 Files with no reviewable changes (1)
📝 WalkthroughWalkthroughThis PR adds a URL-based MCP server documentation subsection and a test that verifies the new section’s allowlist and constraint text. ChangesCustom Recipe: URL-Based MCP Server docs
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
E2E Advisor RecommendationRequired E2E: None Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
|
Contributor
E2E Target RecommendationRequired E2E targets: None Full E2E target advisor summaryE2E Target AdvisorBase: Required E2E targets
Optional E2E targets
Relevant changed files
|
Contributor
|
🌿 Preview your docs: https://nvidia-preview-pr-6246.docs.buildwithfern.com/nemoclaw |
Contributor
PR Review Advisor (Nemotron Ultra) — No blocking findingsMerge posture: No blocking advisor findings This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision. |
Contributor
PR Review Advisor — No blocking findingsMerge posture: No blocking advisor findings This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
docs/network-policy/customize-network-policy.mdx (1)
176-178: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winHardcoded binary paths may not generalize across install methods.
/usr/local/bin/nodeand/usr/local/bin/openclawassume a specific install layout; nvm-based or user-local Node installs commonly place binaries elsewhere (e.g. under~/.nvm/...). Consider noting that users should confirm actual paths withwhich node/which openclawbefore copying this preset verbatim.✏️ Suggested addition to the Note
<Note> The `binaries` list must include every process that opens the connection. OpenClaw and its Node runtime execute as `/usr/local/bin/node` and `/usr/local/bin/openclaw`, and MCP client tools invoked from a shell (for example `curl`) need `/usr/bin/curl`. +Confirm the actual paths on your system with `which node` and `which openclaw`, since install method (for example nvm) can change these locations. A preset that lists only the endpoint but no matching binary widens the allowlist but no process is authorized to use it, so requests still fail. </Note>Also applies to: 190-194
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/network-policy/customize-network-policy.mdx` around lines 176 - 178, The preset currently hardcodes binary paths in the network policy examples, which may not match all install layouts. Update the Note in customize-network-policy.mdx to tell users to verify the actual paths for node and openclaw with commands like which node and which openclaw before copying the preset, and keep the guidance aligned with the binaries entries used in the example blocks.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@docs/network-policy/customize-network-policy.mdx`:
- Around line 176-178: The preset currently hardcodes binary paths in the
network policy examples, which may not match all install layouts. Update the
Note in customize-network-policy.mdx to tell users to verify the actual paths
for node and openclaw with commands like which node and which openclaw before
copying the preset, and keep the guidance aligned with the binaries entries used
in the example blocks.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 67eb80a3-1595-47d2-9f37-cf853e49ccf5
📒 Files selected for processing (1)
docs/network-policy/customize-network-policy.mdx
Address CodeRabbit review on PR #6246: `/usr/local/bin/node` and `/usr/local/bin/openclaw` reflect a common install layout but do not generalise to nvm-based or user-local Node installs. Softens the Note from "execute as X" to "typically execute as X", and adds a sentence telling readers to confirm the actual paths with `which node` / `which openclaw` before copying the preset verbatim. Signed-off-by: Yanyun Liao <yanyunl@nvidia.com>
cv
previously requested changes
Jul 7, 2026
cv
left a comment
cv
left a comment
Collaborator
There was a problem hiding this comment.
The new copy-paste policy needs a least-privilege and acceptance correction before merge. It currently teaches GET/POST over /** and lists both Node and OpenClaw as defaults; scope the route to the actual MCP endpoint where possible and tell users to include only the process that opens the connection. Also scope the success claim: linked #5322 uses a private OpenVPN-only host, and adding an allowlist entry does not override private-address SSRF checks or establish host routing. Add the adjacent VPN/private-destination caveat (and docs validation if available), then rerun the Review Advisor.
wscurran
added
v0.0.77
area: docs
Contributor
|
✨ |
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Collaborator
|
Addressed the requested least-privilege and acceptance corrections in 9a6fec8:
Validation passed: agent-variant docs check, markdownlint, Fern |
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage remains at 96%, unchanged from the TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most impacted files.
Updated |
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
test/policy-roundtrip-docs.test.ts (1)
34-34: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winTest title missing local issue reference suffix.
Per the coding guidelines for
**/*.test.ts, titles should be behavior-oriented (this one is) and include a local issue reference as a final(#1234)suffix. This PR is tied to issue#5322, but the title omits that reference.As per coding guidelines,
`**/*.test.ts`: Write behavior-oriented test titles, and put local issue references in a final `(`#1234`)` suffix.✏️ Suggested title update
- it("keeps the URL-based MCP recipe least-privilege and narrowly scoped", () => { + it("keeps the URL-based MCP recipe least-privilege and narrowly scoped (`#5322`)", () => {🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/policy-roundtrip-docs.test.ts` at line 34, Update the test title in the relevant test case to keep the behavior-oriented wording and append the local issue reference as a final “(`#5322`)” suffix, using the existing test name in the `it(...)` block within `policy-roundtrip-docs.test.ts` as the place to make the change.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@test/policy-roundtrip-docs.test.ts`:
- Line 34: Update the test title in the relevant test case to keep the
behavior-oriented wording and append the local issue reference as a final
“(`#5322`)” suffix, using the existing test name in the `it(...)` block within
`policy-roundtrip-docs.test.ts` as the place to make the change.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: d6fef3aa-48cf-47ad-b62b-23d477f1c15d
📒 Files selected for processing (2)
docs/network-policy/customize-network-policy.mdxtest/policy-roundtrip-docs.test.ts
✅ Files skipped from review due to trivial changes (1)
- docs/network-policy/customize-network-policy.mdx
prekshivyas
approved these changes
Jul 8, 2026
prekshivyas
left a comment
prekshivyas
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed the final least-privilege MCP recipe and regression guard. Exact /mcp GET/POST paths, a single connection-opening binary, sandbox-internal path verification, explicit SSRF/private/VPN and OAuth EAI_AGAIN scope caveats, and an anti-regression docs test are present. Both PR Advisors recommend merge-as-is, E2E Advisor requires no extra targets, and the complete GitHub CI/platform/sandbox E2E matrix is green. The original cv change request is addressed; re-review is requested.
cv
dismissed
their stale review
July 8, 2026 16:18
Addressed on current head 3c4aabd: the recipe now uses exact /mcp paths, a single connection-opening binary, and explicit private/VPN/SSRF scope caveats with regression coverage. Dismissing this stale review after exact-head re-audit.
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Collaborator
|
Maintainer salvage complete at |
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
21 tasks
cv
pushed a commit
that referenced
this pull request
Jul 9, 2026
<!-- markdownlint-disable MD041 --> ## Summary Adds the pre-tag v0.0.79 release notes entry to `docs/about/release-notes.mdx` so the release plan can be generated after docs merge. The entry summarizes the merged v0.0.79 release train across inference, diagnostics, runtime hardening, policies, onboarding recovery, and release validation. ## Changes - Added the v0.0.79 release notes section with linked follow-up documentation for OpenRouter onboarding, managed vLLM changes, completion and logging, Deep Agents runtime limits, policy updates, onboarding recovery, and release validation. - Source summary: - #6461 -> `docs/about/release-notes.mdx`: Documents OpenRouter onboarding support and links to inference/provider references. - #6271 and #6272 -> `docs/about/release-notes.mdx`: Documents shell completion and structured logging highlights. - #6465, #6539, #6570, and #6528 -> `docs/about/release-notes.mdx`: Documents status route-drift, orphaned sandbox, gateway cleanup, and DGX Spark express-install diagnostics. - #6523, #6551, #6484, #6488, #6324, and #6542 -> `docs/about/release-notes.mdx`: Documents managed vLLM, Qwen3.6 tool parser, compaction, and timeout/readiness improvements. - #6559, #6538, #6560, #6568, #6552, #6567, and #6587 -> `docs/about/release-notes.mdx`: Documents runtime, credential, proxy, PID namespace, TOML, and provider-state hardening. - #6541, #5415, #6246, #6496, and #6573 -> `docs/about/release-notes.mdx`: Documents GitHub policy, Gmail policy, MCP allowlist, WhatsApp, and messaging-variant updates. - #6253, #6572, #6444, #6536, and #5860 -> `docs/about/release-notes.mdx`: Documents onboarding resume and create-step recovery improvements. - #6508, #6527, #5506, #6588, #6446, #6447, #6582, #6296, #6367, #6397, and #6505 -> `docs/about/release-notes.mdx`: Documents docs, release-risk, and E2E validation updates. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check exactly one tests line and one docs line. Check other lines when applicable. Add every requested justification or approval reference. --> - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: Release-note prose only. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each applicable item only when supported by the requested evidence. Run targeted tests once per relevant change set and rerun after later edits or hook autofixes that can affect the tested behavior. Do not rerun hook-covered checks. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: Tests not applicable, release-note prose only. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Docs validation note: `npm run docs:check-agent-variants && npm run docs:check-routes && git diff --check` passed. Full `npm run docs` is currently blocked before Fern validation because the pinned `fern-api@5.65.2` package is unavailable from npm (`ETARGET No matching version found`). --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Julie Yaunches <jyaunches@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added release notes for v0.0.79 with a new summary of recent improvements, including onboarding and inference options, operator/CLI diagnostics, sandbox recovery hardening, runtime limits, network policy behavior, and release validation updates. * Added updated references and links for the latest release. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
…VIDIA#5322) (NVIDIA#6246) ## Summary Adding a Streamable HTTP MCP server URL to OpenClaw currently fails with a `HTTP 403 Forbidden` CONNECT tunnel because the sandbox egress proxy has no allowlist entry for the target host. The `customize-network-policy` guide already shows the general preset + `policy-add` pattern (influxdb example) but a user searching for MCP-specific guidance did not find a landing section that walked that pattern through for MCP URLs (NVIDIA#5322 reporter and one confirmer both fell into this gap and worked around it with a reverse proxy). Closes NVIDIA#5322. ## Changes - `docs/network-policy/customize-network-policy.mdx`: add a "Custom Recipe: URL-Based MCP Server" subsection under Dynamic Changes. Content: - the exact `CONNECT tunnel failed, response 403` symptom users see - a copy-paste preset YAML in the validated shape (`preset.name` kebab-case RFC 1123, `network_policies` snake, an explicit `binaries` list) - the `nemoclaw <sandbox> policy-add --from-file` command - a `<Note>` explaining why `binaries` must be listed alongside endpoints (endpoint-only preset widens the allowlist but no process is authorised to use it) - a `<Warning>` about the RFC 1123 label constraint on `preset.name` The recipe was reproduced end-to-end on Ubuntu 24.04 with a live sandbox before it was written: `curl -sv https://<host>` produced `HTTP/1.1 403 Forbidden` + `CONNECT tunnel failed`, then `nemoclaw my-assistant policy-add --from-file` (with the exact YAML in the guide) bumped policy version, printed `Widening sandbox egress — adding: <host>`, and the same `curl` returned `200 Connection Established`. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Verification - [x] `npx prek run --all-files` passes - [x] `npm test` passes - [ ] Tests added or updated for new or changed behavior - [x] No secrets, API keys, or credentials committed - [x] Docs updated for user-facing behavior changes - [x] `make docs` builds without warnings (doc changes only) — `npm run docs:strict`: 0 errors, 2 warnings (both pre-existing) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) ## AI Disclosure - [x] AI-assisted — tool: Claude Code <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary * **Documentation** * Added a new “Custom Recipe: URL-Based MCP Server” subsection under Dynamic Changes, including a least-privilege preset example and how to apply it to a running sandbox. * Documented the `HTTP 403 Forbidden` CONNECT-tunnel failure mode, plus guidance to keep `binaries` and endpoint rules narrowly scoped (e.g., `/mcp` with `GET`/`POST`), and clarified preset naming/formatting constraints. * **Tests** * Added a doc-content verification test to ensure the subsection contains the expected allowlist rules, avoids wildcard paths, and includes the specified constraint/warning text. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Yanyun Liao <yanyunl@nvidia.com> --------- Signed-off-by: Yanyun Liao <yanyunl@nvidia.com> Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> Signed-off-by: Carlos Villela <cvillela@nvidia.com> Co-authored-by: Prekshi Vyas <prekshiv@nvidia.com> Co-authored-by: Apurv Kumaria <akumaria@nvidia.com> Co-authored-by: Carlos Villela <cvillela@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary Adds the pre-tag v0.0.79 release notes entry to `docs/about/release-notes.mdx` so the release plan can be generated after docs merge. The entry summarizes the merged v0.0.79 release train across inference, diagnostics, runtime hardening, policies, onboarding recovery, and release validation. ## Changes - Added the v0.0.79 release notes section with linked follow-up documentation for OpenRouter onboarding, managed vLLM changes, completion and logging, Deep Agents runtime limits, policy updates, onboarding recovery, and release validation. - Source summary: - NVIDIA#6461 -> `docs/about/release-notes.mdx`: Documents OpenRouter onboarding support and links to inference/provider references. - NVIDIA#6271 and NVIDIA#6272 -> `docs/about/release-notes.mdx`: Documents shell completion and structured logging highlights. - NVIDIA#6465, NVIDIA#6539, NVIDIA#6570, and NVIDIA#6528 -> `docs/about/release-notes.mdx`: Documents status route-drift, orphaned sandbox, gateway cleanup, and DGX Spark express-install diagnostics. - NVIDIA#6523, NVIDIA#6551, NVIDIA#6484, NVIDIA#6488, NVIDIA#6324, and NVIDIA#6542 -> `docs/about/release-notes.mdx`: Documents managed vLLM, Qwen3.6 tool parser, compaction, and timeout/readiness improvements. - NVIDIA#6559, NVIDIA#6538, NVIDIA#6560, NVIDIA#6568, NVIDIA#6552, NVIDIA#6567, and NVIDIA#6587 -> `docs/about/release-notes.mdx`: Documents runtime, credential, proxy, PID namespace, TOML, and provider-state hardening. - NVIDIA#6541, NVIDIA#5415, NVIDIA#6246, NVIDIA#6496, and NVIDIA#6573 -> `docs/about/release-notes.mdx`: Documents GitHub policy, Gmail policy, MCP allowlist, WhatsApp, and messaging-variant updates. - NVIDIA#6253, NVIDIA#6572, NVIDIA#6444, NVIDIA#6536, and NVIDIA#5860 -> `docs/about/release-notes.mdx`: Documents onboarding resume and create-step recovery improvements. - NVIDIA#6508, NVIDIA#6527, NVIDIA#5506, NVIDIA#6588, NVIDIA#6446, NVIDIA#6447, NVIDIA#6582, NVIDIA#6296, NVIDIA#6367, NVIDIA#6397, and NVIDIA#6505 -> `docs/about/release-notes.mdx`: Documents docs, release-risk, and E2E validation updates. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check exactly one tests line and one docs line. Check other lines when applicable. Add every requested justification or approval reference. --> - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: Release-note prose only. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each applicable item only when supported by the requested evidence. Run targeted tests once per relevant change set and rerun after later edits or hook autofixes that can affect the tested behavior. Do not rerun hook-covered checks. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: Tests not applicable, release-note prose only. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Docs validation note: `npm run docs:check-agent-variants && npm run docs:check-routes && git diff --check` passed. Full `npm run docs` is currently blocked before Fern validation because the pinned `fern-api@5.65.2` package is unavailable from npm (`ETARGET No matching version found`). --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Julie Yaunches <jyaunches@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added release notes for v0.0.79 with a new summary of recent improvements, including onboarding and inference options, operator/CLI diagnostics, sandbox recovery hardening, runtime limits, network policy behavior, and release validation updates. * Added updated references and links for the latest release. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adding a Streamable HTTP MCP server URL to OpenClaw currently fails
with a
HTTP 403 ForbiddenCONNECT tunnel because the sandbox egressproxy has no allowlist entry for the target host. The
customize-network-policyguide already shows the generalpreset +
policy-addpattern (influxdb example) but a user searchingfor MCP-specific guidance did not find a landing section that walked
that pattern through for MCP URLs (#5322 reporter and one confirmer
both fell into this gap and worked around it with a reverse proxy).
Closes #5322.
Changes
docs/network-policy/customize-network-policy.mdx: add a"Custom Recipe: URL-Based MCP Server" subsection under Dynamic
Changes. Content:
CONNECT tunnel failed, response 403symptom users see(
preset.namekebab-case RFC 1123,network_policiessnake, anexplicit
binarieslist)nemoclaw <sandbox> policy-add --from-filecommand<Note>explaining whybinariesmust be listed alongsideendpoints (endpoint-only preset widens the allowlist but no
process is authorised to use it)
<Warning>about the RFC 1123 label constraint onpreset.nameThe recipe was reproduced end-to-end on Ubuntu 24.04 with a live
sandbox before it was written:
curl -sv https://<host>producedHTTP/1.1 403 Forbidden+CONNECT tunnel failed, thennemoclaw my-assistant policy-add --from-file(with the exact YAMLin the guide) bumped policy version, printed
Widening sandbox egress — adding: <host>, and the samecurlreturned200 Connection Established.Type of Change
Verification
npx prek run --all-filespassesnpm testpassesmake docsbuilds without warnings (doc changes only) —npm run docs:strict: 0 errors, 2 warnings (both pre-existing)AI Disclosure
Summary by CodeRabbit
Summary
Documentation
HTTP 403 ForbiddenCONNECT-tunnel failure mode, plus guidance to keepbinariesand endpoint rules narrowly scoped (e.g.,/mcpwithGET/POST), and clarified preset naming/formatting constraints.Tests
Signed-off-by: Yanyun Liao yanyunl@nvidia.com