fix(code): honor MCP server disables for plugins - #4848
Merged
Mason Daugherty (mdrxy) merged 5 commits intoJul 21, 2026
Conversation
github-actions
Bot
added
dcode
John Kennedy (jkennedyvz)
requested a review
from Johannes du Plessis (johannes117)
July 20, 2026 02:25
John Kennedy (jkennedyvz)
changed the title
John Kennedy (jkennedyvz)
enabled auto-merge (squash)
July 20, 2026 02:25
John Kennedy (jkennedyvz)
changed the title
github-actions
Bot
changed the title
Mason Daugherty (mdrxy)
changed the title
Mason Daugherty (mdrxy)
changed the title
Mason Daugherty (mdrxy)
disabled auto-merge
July 21, 2026 16:16
Mason Daugherty (mdrxy)
pushed a commit
that referenced
this pull request
Jul 22, 2026
> [!CAUTION] > Merging this PR will automatically publish to **PyPI** and create a **GitHub release**. For the full release process, see [`.github/RELEASING.md`](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md). --- _Release notes preview: keep this section in sync with the package `CHANGELOG.md`. The published GitHub release body is extracted from the merged `CHANGELOG.md` by `release.yml`, not from this PR description._ --- ## [0.1.45](deepagents-code==0.1.44...deepagents-code==0.1.45) (2026-07-22) ### Features - Added the Hooks v2 execution engine and typed hooks data models ([#4880](#4880), [#4870](#4870)) - Added a filesystem tool allowlist for `dcode` with `--allow-fs-tools` ([#4635](#4635)) - Added a GLM-5.2 harness profile ([#4710](#4710)) - Added a built-in thread inspector skill ([#4769](#4769)) - Replaced Gemini 3.5 Flash with Gemini 3.6 Flash in the model switcher ([#4890](#4890)) - Show experimental mode in the splash screen and debug console ([#4863](#4863)) - Gate debug console click-to-copy behind a checkbox ([#4810](#4810)) ### Bug Fixes - Improved scratch-file handling by allowing cleanup of agent-created scratch files and safe OS-temp scratch artifacts ([#4860](#4860), [#4869](#4869)) - Skip grading during `/goal` proposals ([#4941](#4941)) - Improved MCP approval handling: Esc now aborts project MCP approval, disabled MCP servers are honored for plugins, remembered approvals are preserved with the env allowlist, and approvals are shared across Git worktrees ([#4888](#4888), [#4848](#4848), [#4889](#4889), [#4939](#4939)) - Hardened installer downloads and paths ([#4871](#4871)) - Fixed forced `dcode update` checks to bust the CDN cache ([#4862](#4862)) - Prevented failed exit setup from stranding the app ([#4913](#4913)) - Fixed routing so `ctrl+x` goes to the focused `ask_user` input ([#4926](#4926)) - Show `-m` prompts as queued immediately on startup ([#4861](#4861)) - Kept harness-profile diagnostics out of terminal output ([#4943](#4943)) - Avoid tracking inline restart callers ([#4894](#4894)) - Fixed debug console thread ID copying on click ([#4945](#4945)) ### Performance Improvements - Reduced exit latency by coordinating async shutdown teardown ([#4831](#4831)) - Sped up local context detection ([#4922](#4922)) _End release notes preview._ --- > [!NOTE] > A **New Contributors** section is appended to the GitHub release notes automatically at publish time (see [Release Pipeline](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md#release-pipeline), step 2). --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: langchain-oss-automated-triage[bot] <248757908+langchain-oss-automated-triage[bot]@users.noreply.github.com>
Marcelo5444
pushed a commit
to Marcelo5444/deepagents
that referenced
this pull request
Jul 30, 2026
Deep Agents Code now respects explicit MCP server disables for servers bundled with installed plugins. --- Installing or enabling a plugin is the user's trust decision for all of its bundled components, including MCP servers. First-time plugin servers therefore continue to load without requiring a separate project approval. Plugin-provided MCP servers now pass through the user-level deny policy before loading. An explicitly disabled server remains disabled even when it is supplied by an installed plugin. If the MCP trust policy cannot be read, plugin servers fail closed rather than risking bypassing a saved disable. Invalid plugin MCP configuration shapes are surfaced as configuration errors. --------- Co-authored-by: corridor-security[bot] <203152403+corridor-security[bot]@users.noreply.github.com> Co-authored-by: langsmith-fleet[bot] <langsmith-fleet[bot]@users.noreply.github.com> Co-authored-by: Mason Daugherty <github@mdrxy.com> Co-authored-by: Mason Daugherty <mason@langchain.dev>
Marcelo5444
pushed a commit
to Marcelo5444/deepagents
that referenced
this pull request
Jul 30, 2026
> [!CAUTION] > Merging this PR will automatically publish to **PyPI** and create a **GitHub release**. For the full release process, see [`.github/RELEASING.md`](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md). --- _Release notes preview: keep this section in sync with the package `CHANGELOG.md`. The published GitHub release body is extracted from the merged `CHANGELOG.md` by `release.yml`, not from this PR description._ --- ## [0.1.45](langchain-ai/deepagents@deepagents-code==0.1.44...deepagents-code==0.1.45) (2026-07-22) ### Features - Added the Hooks v2 execution engine and typed hooks data models ([langchain-ai#4880](langchain-ai#4880), [langchain-ai#4870](langchain-ai#4870)) - Added a filesystem tool allowlist for `dcode` with `--allow-fs-tools` ([langchain-ai#4635](langchain-ai#4635)) - Added a GLM-5.2 harness profile ([langchain-ai#4710](langchain-ai#4710)) - Added a built-in thread inspector skill ([langchain-ai#4769](langchain-ai#4769)) - Replaced Gemini 3.5 Flash with Gemini 3.6 Flash in the model switcher ([langchain-ai#4890](langchain-ai#4890)) - Show experimental mode in the splash screen and debug console ([langchain-ai#4863](langchain-ai#4863)) - Gate debug console click-to-copy behind a checkbox ([langchain-ai#4810](langchain-ai#4810)) ### Bug Fixes - Improved scratch-file handling by allowing cleanup of agent-created scratch files and safe OS-temp scratch artifacts ([langchain-ai#4860](langchain-ai#4860), [langchain-ai#4869](langchain-ai#4869)) - Skip grading during `/goal` proposals ([langchain-ai#4941](langchain-ai#4941)) - Improved MCP approval handling: Esc now aborts project MCP approval, disabled MCP servers are honored for plugins, remembered approvals are preserved with the env allowlist, and approvals are shared across Git worktrees ([langchain-ai#4888](langchain-ai#4888), [langchain-ai#4848](langchain-ai#4848), [langchain-ai#4889](langchain-ai#4889), [langchain-ai#4939](langchain-ai#4939)) - Hardened installer downloads and paths ([langchain-ai#4871](langchain-ai#4871)) - Fixed forced `dcode update` checks to bust the CDN cache ([langchain-ai#4862](langchain-ai#4862)) - Prevented failed exit setup from stranding the app ([langchain-ai#4913](langchain-ai#4913)) - Fixed routing so `ctrl+x` goes to the focused `ask_user` input ([langchain-ai#4926](langchain-ai#4926)) - Show `-m` prompts as queued immediately on startup ([langchain-ai#4861](langchain-ai#4861)) - Kept harness-profile diagnostics out of terminal output ([langchain-ai#4943](langchain-ai#4943)) - Avoid tracking inline restart callers ([langchain-ai#4894](langchain-ai#4894)) - Fixed debug console thread ID copying on click ([langchain-ai#4945](langchain-ai#4945)) ### Performance Improvements - Reduced exit latency by coordinating async shutdown teardown ([langchain-ai#4831](langchain-ai#4831)) - Sped up local context detection ([langchain-ai#4922](langchain-ai#4922)) _End release notes preview._ --- > [!NOTE] > A **New Contributors** section is appended to the GitHub release notes automatically at publish time (see [Release Pipeline](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md#release-pipeline), step 2). --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: langchain-oss-automated-triage[bot] <248757908+langchain-oss-automated-triage[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Deep Agents Code now respects explicit MCP server disables for servers bundled with installed plugins.
Installing or enabling a plugin is the user's trust decision for all of its bundled components, including MCP servers. First-time plugin servers therefore continue to load without requiring a separate project approval.
Plugin-provided MCP servers now pass through the user-level deny policy before loading. An explicitly disabled server remains disabled even when it is supplied by an installed plugin. If the MCP trust policy cannot be read, plugin servers fail closed rather than risking bypassing a saved disable. Invalid plugin MCP configuration shapes are surfaced as configuration errors.