fix(policy): require explicit mcp methods by default

Signed-off-by: Kris Hicks <khicks@nvidia.com>

Author: krishicks

crates/openshell-policy/src/lib.rs

@@ -750,7 +750,7 @@ fn from_proto(policy: &SandboxPolicy) -> PolicyFile {
                             || e.mcp
                                 .as_ref()
                                 .and_then(|options| options.allow_all_known_mcp_methods)
-                                .unwrap_or(true);
+                                .unwrap_or(false);
                         let rules = e
                             .rules
                             .iter()

crates/openshell-supervisor-network/data/sandbox-policy.rego

@@ -494,7 +494,7 @@ jsonrpc_family_endpoint(endpoint) if {
 }
 
 mcp_allow_all_known_mcp_methods(endpoint) if {
-	object.get(endpoint, "mcp_allow_all_known_mcp_methods", true)
+	object.get(endpoint, "mcp_allow_all_known_mcp_methods", false)
 }
 
 mcp_tool_call_narrowed_by_policy(endpoint, method) if {

crates/openshell-supervisor-network/src/l7/mod.rs

@@ -1010,7 +1010,7 @@ pub fn validate_l7_policies(data_json: &serde_json::Value) -> (Vec<String>, Vec<
             if jsonrpc_family && !access.is_empty() {
                 if protocol == "mcp" {
                     errors.push(format!(
-                        "{loc}: protocol {protocol} does not support access presets; use rules/deny_rules or omit rules for the default allow-all MCP policy"
+                        "{loc}: protocol {protocol} does not support access presets; use rules/deny_rules or set mcp.allow_all_known_mcp_methods: true for an allow-all MCP policy"
                     ));
                 } else {
                     errors.push(format!(
@@ -1128,7 +1128,7 @@ pub fn validate_l7_policies(data_json: &serde_json::Value) -> (Vec<String>, Vec<
             let mcp_allow_all_known_mcp_methods = ep
                 .get("mcp_allow_all_known_mcp_methods")
                 .and_then(serde_json::Value::as_bool)
-                .unwrap_or(true);
+                .unwrap_or(false);
             if protocol == "mcp"
                 && !has_rules
                 && access.is_empty()
@@ -1470,7 +1470,7 @@ pub fn expand_access_presets(data: &mut serde_json::Value) {
             let mcp_allow_all_known_mcp_methods = ep
                 .get("mcp_allow_all_known_mcp_methods")
                 .and_then(serde_json::Value::as_bool)
-                .unwrap_or(true);
+                .unwrap_or(false);
 
             if protocol == "mcp"
                 && access.is_empty()
@@ -1992,6 +1992,7 @@ mod tests {
                         "port": 443,
                         "path": "/mcp",
                         "protocol": "mcp",
+                        "mcp_allow_all_known_mcp_methods": true,
                         "rules": [{
                             "allow": {
                                 "tool": { "any": ["read_status", "submit_*"] }
@@ -2055,7 +2056,7 @@ mod tests {
     }
 
     #[test]
-    fn validate_mcp_tool_selectors_require_method_when_method_profile_disabled() {
+    fn validate_mcp_tool_selectors_require_method_by_default() {
         let data = serde_json::json!({
             "network_policies": {
                 "test": {
@@ -2064,7 +2065,6 @@ mod tests {
                         "port": 443,
                         "path": "/mcp",
                         "protocol": "mcp",
-                        "mcp_allow_all_known_mcp_methods": false,
                         "rules": [{
                             "allow": {
                                 "tool": "read_status"
@@ -2411,16 +2411,15 @@ mod tests {
     }
 
     #[test]
-    fn validate_mcp_requires_rules_when_method_profile_disabled() {
+    fn validate_mcp_requires_rules_by_default() {
         let data = serde_json::json!({
             "network_policies": {
                 "test": {
                     "endpoints": [{
                         "host": "mcp.example.com",
                         "port": 443,
                         "path": "/mcp",
-                        "protocol": "mcp",
-                        "mcp_allow_all_known_mcp_methods": false
+                        "protocol": "mcp"
                     }],
                     "binaries": []
                 }

crates/openshell-supervisor-network/src/opa.rs

@@ -906,7 +906,7 @@ fn normalize_l7_rules_aliases(ep: &mut serde_json::Map<String, serde_json::Value
     let mcp_allow_all_known_mcp_methods = ep
         .get("mcp_allow_all_known_mcp_methods")
         .and_then(serde_json::Value::as_bool)
-        .unwrap_or(true);
+        .unwrap_or(false);
     if let Some(rules) = ep.get_mut("rules").and_then(|v| v.as_array_mut()) {
         for rule in rules {
             if let Some(allow) = rule
@@ -3285,10 +3285,12 @@ network_policies:
           max_body_bytes: 131072
         rules:
           - allow:
+              method: tools/call
               tool:
                 any: [read_status, submit_*]
         deny_rules:
-          - tool: blocked_action
+          - method: tools/call
+            tool: blocked_action
     binaries:
       - { path: /usr/bin/curl }
 "#;
@@ -3337,11 +3339,11 @@ network_policies:
         assert!(!eval_l7(&engine, &blocked));
 
         let list_tools = l7_jsonrpc_input("mcp.params.test", 8000, "/mcp", "tools/list");
-        assert!(eval_l7(&engine, &list_tools));
+        assert!(!eval_l7(&engine, &list_tools));
     }
 
     #[test]
-    fn l7_mcp_endpoint_defaults_to_allow_all_tools() {
+    fn l7_mcp_method_profile_allows_all_tools() {
         let data = r#"
 network_policies:
   mcp_default:
@@ -3352,6 +3354,8 @@ network_policies:
         path: /mcp
         protocol: mcp
         enforcement: enforce
+        mcp:
+          allow_all_known_mcp_methods: true
     binaries:
       - { path: /usr/bin/curl }
 "#;
@@ -3424,6 +3428,7 @@ network_policies:
         enforcement: enforce
         rules:
           - allow:
+              method: tools/call
               tool: read_status
     binaries:
       - { path: /usr/bin/curl }

docs/reference/policy-schema.mdx

@@ -158,7 +158,7 @@ Each endpoint defines a reachable destination and optional inspection rules.
 | `protocol` | string | No | Set to `rest` for HTTP method/path inspection, `websocket` for RFC 6455 upgrade and client text-message inspection, `graphql` for GraphQL-over-HTTP operation inspection, `mcp` for MCP Streamable HTTP request inspection, or `json-rpc` for generic JSON-RPC-over-HTTP method inspection. WebSocket endpoints can also use GraphQL operation rules for GraphQL-over-WebSocket traffic. Omit for TCP passthrough. |
 | `tls` | string | No | TLS handling mode. The proxy auto-detects TLS by peeking the first bytes of each connection and terminates it for inspected HTTPS traffic, so this field is optional in most cases. Set to `skip` to disable auto-detection for edge cases such as client-certificate mTLS or non-standard protocols. The values `terminate` and `passthrough` are deprecated and log a warning; they are still accepted for backward compatibility but have no effect on behavior. |
 | `enforcement` | string | No | `enforce` actively blocks disallowed requests. `audit` logs violations but allows traffic through. |
-| `access` | string | No | Access preset. One of `read-only`, `read-write`, or `full`. Mutually exclusive with `rules`. Not valid on `protocol: mcp` or `protocol: json-rpc`; MCP endpoints can use explicit rules or omit rules for the default allow-all MCP policy, and generic JSON-RPC endpoints must use explicit rules. |
+| `access` | string | No | Access preset. One of `read-only`, `read-write`, or `full`. Mutually exclusive with `rules`. Not valid on `protocol: mcp` or `protocol: json-rpc`; MCP uses explicit rules unless `mcp.allow_all_known_mcp_methods: true` enables the endpoint method profile, and JSON-RPC always uses explicit rules. |
 | `rules` | list of allow rule objects | No | Fine-grained protocol-specific allow rules. Mutually exclusive with `access`. |
 | `deny_rules` | list of deny rule objects | No | L7 deny rules that block specific requests even when allowed by `access` or `rules`. Deny rules take precedence over allow rules. |
 | `allowed_ips` | list of string | No | CIDR or IP allowlist for SSRF override. Exact user-declared hostname endpoints may resolve to RFC 1918 private addresses without this field, but wildcard, hostless, and policy-advisor-proposed endpoints still require `allowed_ips` for private resolved IPs. Entries overlapping loopback (`127.0.0.0/8`), link-local (`169.254.0.0/16`), or unspecified (`0.0.0.0`) are rejected at load time. |
@@ -171,14 +171,14 @@ Each endpoint defines a reachable destination and optional inspection rules.
 | `mcp` | object | No | MCP endpoint options for `protocol: mcp`. MCP endpoints must set a concrete `host` and `port` or `ports`; `protocol: mcp` alone is invalid and is not treated as a wildcard endpoint. |
 | `mcp.max_body_bytes` | integer | No | Maximum MCP JSON-RPC-over-HTTP request body bytes buffered for inspection. Defaults to `65536`. |
 | `mcp.strict_tool_names` | bool | No | Defaults to `true`. Requires `tools/call` `params.name` values to match `^[A-Za-z0-9_.-]{1,128}$` before policy evaluation. Set to `false` only for compatibility with MCP servers that intentionally use non-recommended tool names. Wildcard `tool` matchers require this to remain enabled. |
-| `mcp.allow_all_known_mcp_methods` | bool | No | Defaults to `true`. Enables the endpoint MCP method profile: omitted `rules` allow all MCP-family methods and all tools before `deny_rules`, and omitted rule `method` uses that profile. Set to `false` to require explicit MCP method rules; rules with `tool` or `params.name` must then set `method: tools/call`. |
+| `mcp.allow_all_known_mcp_methods` | bool | No | Defaults to `false`. When `true`, enables the endpoint MCP method profile: omitted `rules` allow all MCP-family methods and all tools before `deny_rules`, and omitted rule `method` uses that profile. When unset or `false`, explicit MCP method rules are required; rules with `tool` or `params.name` must set `method: tools/call`. |
 | `json_rpc` | object | No | JSON-RPC endpoint options. For `protocol: json-rpc`, `json_rpc.max_body_bytes` sets the maximum JSON-RPC-over-HTTP request body bytes buffered for inspection. Defaults to `65536`. |
 
 Credential rewrite recognizes the canonical `openshell:resolve:env:KEY` placeholder form and whole-token provider-shaped aliases such as `provider-OPENSHELL-RESOLVE-ENV-API_TOKEN` when the referenced environment key exists in the configured provider credentials.
 
 #### Access Levels
 
-The `access` field accepts one of the following values on REST, WebSocket, and GraphQL endpoints. MCP and JSON-RPC endpoints reject `access` because HTTP method/path presets cannot authorize JSON-RPC safely; use explicit MCP or JSON-RPC rules instead, or omit MCP rules for the default allow-all MCP policy.
+The `access` field accepts one of the following values on REST, WebSocket, and GraphQL endpoints. MCP and JSON-RPC endpoints reject `access` because HTTP method/path presets cannot authorize JSON-RPC safely. Use explicit MCP rules, set `mcp.allow_all_known_mcp_methods: true` for the MCP method profile, or use explicit JSON-RPC rules.
 
 | Value | REST expansion | WebSocket expansion | GraphQL expansion | MCP / JSON-RPC expansion |
 |---|---|---|---|---|
@@ -283,15 +283,15 @@ Do not combine `method`, `path`, or `query` with `operation_type`, `operation_na
 
 ##### MCP Allow And Deny Rules (`protocol: mcp`)
 
-MCP rules match sandbox-to-server MCP Streamable HTTP request bodies by optional MCP method and optional tool selectors. OpenShell parses the underlying JSON-RPC 2.0 envelope, validates known MCP request and notification params, and preserves unknown extension methods as policy-addressable literal method strings. Until OpenShell exposes explicit MCP version profiles, `mcp.allow_all_known_mcp_methods` defaults to `true`; with that default, rules can omit `method` and tool selectors are normalized to `tools/call` internally. Set `mcp.allow_all_known_mcp_methods: false` to require explicit MCP method rules; in that mode, rules with `tool` or `params.name` must set `method: tools/call`. By default, `tools/call` `params.name` must match the MCP-recommended tool-name pattern `^[A-Za-z0-9_.-]{1,128}$`; configure `mcp.strict_tool_names: false` on the endpoint only to allow a server that intentionally uses names outside that pattern. Wildcard `tool` matchers require `mcp.strict_tool_names` to remain enabled. JSON-RPC responses and server-to-client MCP messages on response bodies or SSE streams are relayed but are not currently parsed for policy enforcement.
+MCP rules match sandbox-to-server MCP Streamable HTTP request bodies by MCP method and optional tool selectors. OpenShell parses the underlying JSON-RPC 2.0 envelope, validates known MCP request and notification params, and preserves unknown extension methods as policy-addressable literal method strings. Until OpenShell exposes explicit MCP version profiles, `mcp.allow_all_known_mcp_methods` defaults to `false`, so endpoints require explicit MCP method rules. Set `mcp.allow_all_known_mcp_methods: true` to enable the endpoint method profile; in that mode, rules can omit `method`, and tool selectors are normalized to `tools/call` internally. By default, `tools/call` `params.name` must match the MCP-recommended tool-name pattern `^[A-Za-z0-9_.-]{1,128}$`; configure `mcp.strict_tool_names: false` on the endpoint only to allow a server that intentionally uses names outside that pattern. Wildcard `tool` matchers require `mcp.strict_tool_names` to remain enabled. JSON-RPC responses and server-to-client MCP messages on response bodies or SSE streams are relayed but are not currently parsed for policy enforcement.
 
-Use `rules` for MCP allow rules and `deny_rules` for MCP deny rules. Deny rules take precedence over allow rules. If an MCP endpoint omits `rules` while `mcp.allow_all_known_mcp_methods` is unset or `true`, OpenShell allows all MCP-family methods and all tools, then applies any `deny_rules`. If `mcp.allow_all_known_mcp_methods` is `false`, the endpoint must define explicit rules. A broad allow or deny rule whose method matcher includes `tools/call` cannot be combined with tool-specific allow rules because it would bypass or erase the tool filter; add `tool` or `params.name` to scope `tools/call`, or remove the tool-specific rules. In a batch request, one denied call denies the full batch.
+Use `rules` for MCP allow rules and `deny_rules` for MCP deny rules. Deny rules take precedence over allow rules. If an MCP endpoint sets `mcp.allow_all_known_mcp_methods: true` and omits `rules`, OpenShell allows all MCP-family methods and all tools, then applies any `deny_rules`. Otherwise, the endpoint must define explicit rules. A broad allow or deny rule whose method matcher includes `tools/call` cannot be combined with tool-specific allow rules because it would bypass or erase the tool filter; add `tool` or `params.name` to scope `tools/call`, or remove the tool-specific rules. In a batch request, one denied call denies the full batch.
 
 | Field | Type | Required | Description |
 |---|---|---|---|
-| `method` | string | No | MCP method name, such as `initialize`, `tools/list`, `tools/call`, or an unknown extension method. Globs are accepted only for the `tools/` method family, such as `tools/*`. Required when `mcp.allow_all_known_mcp_methods` is `false`; otherwise omitted method uses the endpoint method profile. Do not use `method: "*"` for MCP; omit `method` to use the allow-all MCP method profile. |
-| `tool` | string or matcher | No | Convenience matcher for `tools/call` `params.name`. Supports a glob string or `{ any: [...] }`. When `mcp.allow_all_known_mcp_methods` is `false`, `method` must also be set to `tools/call`; validation fails otherwise. Omit to match every tool. |
-| `params` | map | No | MCP currently accepts only `params.name` as a lower-level tool-name matcher. When `mcp.allow_all_known_mcp_methods` is `false` and `params.name` is present, `method` must also be set to `tools/call`; validation fails otherwise. Tool argument matching is not supported yet; allowed tools accept all argument payloads by default. |
+| `method` | string | No | MCP method name, such as `initialize`, `tools/list`, `tools/call`, or an unknown extension method. Globs are accepted only for the `tools/` method family, such as `tools/*`. Required unless `mcp.allow_all_known_mcp_methods` is `true`; when that option is true, omitted method uses the endpoint method profile. Do not use `method: "*"` for MCP; omit `method` only when using the allow-all MCP method profile. |
+| `tool` | string or matcher | No | Convenience matcher for `tools/call` `params.name`. Supports a glob string or `{ any: [...] }`. Requires `method: tools/call` unless `mcp.allow_all_known_mcp_methods` is `true`; validation fails otherwise. Omit to match every tool. |
+| `params` | map | No | MCP currently accepts only `params.name` as a lower-level tool-name matcher. Requires `method: tools/call` unless `mcp.allow_all_known_mcp_methods` is `true`; validation fails otherwise. Tool argument matching is not supported yet; allowed tools accept all argument payloads by default. |
 
 Example MCP rules:
 
@@ -306,13 +306,17 @@ endpoints:
       max_body_bytes: 131072
     rules:
       - allow:
+          method: tools/call
           tool: search_web
       - allow:
+          method: tools/call
           tool:
             any: [create_issue, list_issues]
     deny_rules:
-      - tool: send_email
-      - tool: execute_code
+      - method: tools/call
+        tool: send_email
+      - method: tools/call
+        tool: execute_code
 ```
 
 ##### JSON-RPC Allow Rule (`protocol: json-rpc`)