fix(mcp): filter tool catalog by the sandbox tool allowlist - #1450
Open
ivpusic wants to merge 1 commit into
Open
fix(mcp): filter tool catalog by the sandbox tool allowlist#1450ivpusic wants to merge 1 commit into
ivpusic wants to merge 1 commit into
Conversation
The MCP endpoint advertised every discovered tool, but sandboxes only install tools admitted by TOOL_ALLOWLIST/TOOL_BLOCKLIST, so tools/list included entries whose calls could only fail in the tool host -- and clients plan around those phantom tools. Filter the MCP catalog with the same lists, parsed from SESSION_SANDBOX_EXTRA_ENV (the exact values sandbox pods boot with), matching the sandbox shim gate: package directory name or pyproject project name, unset meaning unrestricted. Covers both tools/list and the tools/call lookup.
ivpusic
marked this pull request as ready for review
August 21, 2026 11:29
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The MCP endpoint advertises every discovered tool, but sandboxes only install tools admitted by
TOOL_ALLOWLIST/TOOL_BLOCKLIST(services/sandbox/install_tool_shims.py).tools/listtherefore includes entries whose calls can only fail in the tool host, and MCP clients plan around those phantom tools.Filter the MCP tool catalog with the same lists, parsed from
SESSION_SANDBOX_EXTRA_ENV— the exact values sandbox pods boot with, so the advertised catalog cannot drift from what the tool host enforces. Matching mirrors the sandbox shim gate: package directory name or pyproject project name; unset or empty lists mean unrestricted (backward compatible for deployments without an allowlist). Since bothtools/listand thetools/calllookup resolve through the catalog, non-admitted tools disappear from the listing and calls to them return "unknown tool" instead of dispatching to a sandbox that never installed them.Validation:
cargo fmt --all --check,cargo clippy --workspace --all-targets -- -D warnings,cargo test -p centaur-api-server(MCP module: 19 passed, including 3 new tests for default admit-all, dir/project-name + blocklist matching, and catalog wiring end to end).