fix(mcp): expose new tools under the server approval default (#1959) - #1978
Merged
Aaronontheweb merged 8 commits intoAug 18, 2026
Merged
Conversation
…etclaw-dev#1959) A remote MCP server can add a tool after the operator sets custom per-tool rules. The frozen McpServerToolGrants allow-list hid the new tool. The operator expected the new tool to inherit the server default posture. Make the per-tool grant posture-aware. In All posture the grant list is additive: an unnamed tool passes the audience check and inherits the server default. Allowlist posture (Team/Public) keeps the closed allow-list and stays fail-closed for an unseen tool. Model a disabled tool as approval mode Deny, and hide a Deny MCP tool from the exposed tool list for every audience. The model never receives a tool the policy will block. The TUI checkbox and the `netclaw mcp tools` grant/revoke map disable to Deny in open posture; enable over a Deny server default writes an explicit Approval override so the toggle always takes effect. The daemon drift warning fires only for Allowlist posture; All-posture grant lists are additive and produce no drift. Resolve the audience profile one time for each tool-filter pass instead of one time for each tool. The exposure checks take the resolved profile, so a large tool catalog does not re-resolve the profile per tool. Update the netclaw-operations skill with the posture-aware permission model.
Aaronontheweb
added
mcp
Aaronontheweb
changed the title
…l-hidden # Conflicts: # feeds/skills/.system/files/netclaw-operations/SKILL.md
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1959.
Problem
A remote MCP server can add a tool after a user saves custom tool rules. A stale
McpServerToolGrantslist hid the new tool from a Personal audience.The new tool should use the server approval default. An effective
Denymust still hide and block the tool.Change
AllMCP server mode does not applyMcpServerToolGrants.AllowlistMCP server mode keeps its current closed grant list.Denyremoves an MCP tool from the model tool list.Denyoverride to disable a tool in theAllmode.AutoandApproveoverrides.Allmode.This PR does not change the configuration schema. Issue #1984 tracks the larger MCP access and automatic migration cleanup.
Validation
mcp-permissionstape passed.The model eval suite needs a configured model endpoint. This test host has no endpoint, so that gate did not run locally.