components C7: .mcp.json server approval gate - #299
Merged
Conversation
…alog) Repo-declared MCP servers (.mcp.json, scopes project+local) are now untrusted until the user approves them, porting TS getProjectMcpServerStatus (utils.ts:351-390) + MCPServerApprovalDialog: - services/mcp_approval.py: status precedence disabled->rejected, enabled->approved, enableAll->approved, else pending; merged user->local settings read (lists unioned, scalars last-win; project tier deliberately excluded so a repo cannot self-approve - documented safer-than-TS deviation); choices persist to .clawcodex/settings.local.json. - Enforcement at both choke points: get_all_mcp_configs filters .mcp.json scopes PRE-merge (a name-colliding unapproved repo server can no longer shadow-then-drop a user-scope server - critic-reproduced bug), and get_mcp_config_by_name gates per-name resolves (reconnect/OAuth side door). Pending servers warn via the existing ValidationError channel; rejected servers drop silently. - TUI: McpApprovalScreen (enable / enable all / disable; Esc = decide later) chained at boot per pending server; enable_all short-circuits the queue; write failures report honestly and keep servers pending. - Elicitation declared GATED: the MCP client has no server->client request support, so ElicitationDialog parity stays parked with the client work (gap doc T12 corrected). 20 new tests incl. cross-scope shadowing regression and screen pilot coverage; full suite baseline-identical. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
singlaamitesh
pushed a commit
to singlaamitesh/clawcodex
that referenced
this pull request
Jul 7, 2026
…-mcp-approvals components C7: .mcp.json server approval gate
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.mcp.jsonapproval feature (MCPServerApprovalDialog.tsx+getProjectMcpServerStatus, utils.ts:351-390): repo-declared MCP servers (scopesproject+local) are untrusted until the user approves, with status precedence disabled→rejected, enabled→approved, enableAll→approved, else pending; decisions persist to.clawcodex/settings.local.json.services/mcp/config:get_all_mcp_configsfilters.mcp.jsonscopes pre-merge (fixes a critic-reproduced bug where an unapproved repo server name-colliding with a user-scope server knocked both out), andget_mcp_config_by_namegates per-name resolves (reconnect/OAuth path). Pending → warning notice via the ValidationError channel (/doctor); rejected → silent drop.McpApprovalScreenchained at boot per pending server (enable / enable all / disable; Esc = decide later, re-asked next launch);enable_allshort-circuits the queue; settings-write failures report honestly and keep servers pending.Test plan
get_all_mcp_configs, cross-scope shadowing regression, by-name gate, user-tier enableAll, non-list value guards, screen pilot (all four outcomes via real key presses), boot-chain behaviors incl. write-failure honesty🤖 Generated with Claude Code