Skip to content

Commit 6745fe8

Browse files
clawsweeper[bot]nxmxbbdTakhoffman
authored
fix(doctor): warn when sandbox hides MCP tools (#84742)
Summary: - This bot replacement PR adds an `openclaw doctor` warning, regression coverage, gateway docs, and a changelog entry for sandbox tool policies that hide configured MCP server tools. - Reproducibility: yes. source-reproducible. Runtime policy inspection shows sandbox tool policy is a second g ... ed MCP tools, and the source PR supplies after-patch live `openclaw doctor` output showing the new warning. Automerge notes: - PR branch already contained follow-up commit before automerge: fix(doctor): mirror sandbox policy fallback - PR branch already contained follow-up commit before automerge: fix(doctor): preserve sandbox deny diagnostics - PR branch already contained follow-up commit before automerge: fix(doctor): polish sandbox MCP warnings - PR branch already contained follow-up commit before automerge: fix(doctor): warn when sandbox hides MCP tools - PR branch already contained follow-up commit before automerge: fix(clawsweeper): address review for automerge-openclaw-openclaw-8469… Validation: - ClawSweeper review passed for head 79dfc3e. - Required merge gates passed before the squash merge. Prepared head SHA: 79dfc3e Review: #84742 (comment) Co-authored-by: David Huang <nxmxbbd@gmail.com> Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com> Co-authored-by: clawsweeper[bot] <274271284+clawsweeper[bot]@users.noreply.github.com> Approved-by: takhoffman Co-authored-by: takhoffman <781889+takhoffman@users.noreply.github.com>
1 parent 2c0c9c9 commit 6745fe8

5 files changed

Lines changed: 897 additions & 6 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ Docs: https://docs.openclaw.ai
3030
- CLI/tasks: include stale-running task maintenance decisions in `openclaw tasks maintenance --json` so retained and reconcile candidates explain backing-session, cron, CLI, and wedged-subagent state. (#84691) Thanks @efpiva.
3131
- Codex app-server: keep system-prompt reports working when bootstrap hooks provide workspace files with only a path and content, so hook-supplied SOUL/IDENTITY/TOOLS/USER context still reports injected characters correctly. (#84736) Thanks @JARVIS-Glasses.
3232
- Providers/MiniMax music: stop advertising `durationSeconds` control and remove prompt-injected duration hints, so `music_generate` reports MiniMax duration as an unsupported override instead of suggesting MiniMax can enforce track length. Fixes #84508. Thanks @neeravmakwana.
33+
- Doctor: warn when sandbox tool policy hides configured MCP server tools before provider requests. (#84699) Thanks @nxmxbbd.
3334
- WhatsApp: update Baileys to `7.0.0-rc12`.
3435
- Build: suppress per-locale `rolldown-plugin-dts:fake-js` CommonJS dts warnings emitted while bundling the intentionally-inlined `zod/v4/locales/*.d.cts` files, so `pnpm build` output stays readable after the 0.25.1 plugin bump. Thanks @romneyda.
3536
- CLI/nodes: route lazy plugin-registration logs to stderr for JSON-mode `openclaw nodes` commands so stdout stays parseable. (#84684) Thanks @TurboTheTurtle.

‎docs/gateway/config-tools.md‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,38 @@ Local onboarding defaults new local configs to `tools.profile: "coding"` when un
4343
| `group:agents` | `agents_list`, `update_plan` |
4444
| `group:media` | `image`, `image_generate`, `music_generate`, `video_generate`, `tts` |
4545
| `group:openclaw` | All built-in tools (excludes provider plugins) |
46+
| `group:plugins` | Tools owned by loaded plugins, including configured MCP servers exposed through `bundle-mcp` |
47+
48+
### MCP and plugin tools inside sandbox tool policy
49+
50+
Configured MCP servers are exposed as plugin-owned tools under the `bundle-mcp` plugin id. Normal tool profiles can allow them, but `tools.sandbox.tools` is an additional gate for sandboxed sessions. If sandbox mode is `"all"` or `"non-main"`, include one of these entries in the sandbox tool allowlist when MCP/plugin tools should be visible:
51+
52+
- `bundle-mcp` for OpenClaw-managed MCP servers from `mcp.servers`
53+
- the plugin id for a specific native plugin
54+
- `group:plugins` for all loaded plugin-owned tools
55+
- exact MCP server tool names or server globs such as `outlook__send_mail` or `outlook__*` when you only want one server
56+
57+
Server globs use the provider-safe MCP server prefix, not necessarily the raw `mcp.servers` key. Non-`[A-Za-z0-9_-]` characters become `-`, names that do not start with a letter get an `mcp-` prefix, and long or duplicate prefixes may be truncated or suffixed; for example, `mcp.servers["Outlook Graph"]` uses a glob like `outlook-graph__*`.
58+
59+
```json5
60+
{
61+
agents: { defaults: { sandbox: { mode: "all" } } },
62+
mcp: {
63+
servers: {
64+
outlook: { command: "node", args: ["./outlook-mcp.js"] },
65+
},
66+
},
67+
tools: {
68+
sandbox: {
69+
tools: {
70+
alsoAllow: ["web_search", "web_fetch", "memory_search", "memory_get", "bundle-mcp"],
71+
},
72+
},
73+
},
74+
}
75+
```
76+
77+
Without that sandbox-layer entry, the MCP server can still load successfully while its tools are filtered before the provider request. Use `openclaw doctor` to catch this shape for OpenClaw-managed servers in `mcp.servers`. MCP servers loaded from bundled plugin manifests or Claude `.mcp.json` use the same sandbox gate, but this diagnostic does not enumerate those sources yet; use the same allowlist entries if their tools disappear in sandboxed turns.
4678

4779
### `tools.allow` / `tools.deny`
4880

‎docs/gateway/sandbox-vs-tool-policy-vs-elevated.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,11 @@ Available groups:
100100
- `group:agents`: `agents_list`, `update_plan`
101101
- `group:media`: `image`, `image_generate`, `music_generate`, `video_generate`, `tts`
102102
- `group:openclaw`: all built-in OpenClaw tools (excludes provider plugins)
103+
- `group:plugins`: all loaded plugin-owned tools, including configured MCP servers exposed through `bundle-mcp`
104+
105+
For sandboxed MCP servers, the sandbox tool policy is a second allow gate. If `mcp.servers` is configured but sandboxed turns only show built-in tools, add `bundle-mcp`, `group:plugins`, or a server-prefixed MCP tool name/glob such as `outlook__send_mail` or `outlook__*` to `tools.sandbox.tools.alsoAllow`, then restart/reload the gateway and recapture the tool list. Server globs use the provider-safe MCP server prefix: non-`[A-Za-z0-9_-]` characters become `-`, names that do not start with a letter get an `mcp-` prefix, and long or duplicate prefixes may be truncated or suffixed.
106+
107+
`openclaw doctor` currently checks this shape for OpenClaw-managed servers in `mcp.servers`. MCP servers loaded from bundled plugin manifests or Claude `.mcp.json` use the same sandbox gate, but this diagnostic does not enumerate those sources yet; use the same allowlist entries if their tools disappear in sandboxed turns.
103108

104109
## Elevated: exec-only "run on host"
105110

0 commit comments

Comments
 (0)