mcp: enforce URL policy after variable resolution - #336849
Draft
Dmitriy Vasyura (dmitrivMS) wants to merge 2 commits into
Draft
Dmitriy Vasyura (dmitrivMS) wants to merge 2 commits into
Dmitriy Vasyura (dmitrivMS) wants to merge 2 commits into
Conversation
Distinguish preliminary definition checks from authoritative resolved launch checks. Validate the local resolved connection before starting its transport, and re-evaluate active connections whenever policy changes. Add regression coverage for literal variable markers, resolved URL allow/deny rules, permitted unresolved definitions, and policy changes affecting running servers. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot started reviewing on behalf of
Dmitriy Vasyura (dmitrivMS)
September 18, 2026 21:30
View session
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Preliminary checks still defer literal markers, and reactive denial loses its blocked state after clearing unresolved connections.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
Open (2)
What changed in this PR
Enforces MCP URL policy against resolved runtime connections and reacts to policy changes.
Changes:
- Separates definition-time and resolved-runtime policy checks.
- Rechecks resolved connections before transport startup.
- Adds regression coverage for URL resolution and policy updates.
| File | Description |
|---|---|
allowedMcpServersService.ts |
Splits preliminary and authoritative checks. |
mcpManagement.ts |
Documents policy-check phases. |
mcpServer.ts |
Adds resolver-aware checks and reactive enforcement. |
allowedMcpServersService.test.ts |
Tests URL policy semantics. |
mcpService.test.ts |
Tests runtime resolution and policy updates. |
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
roblourens
previously approved these changes
Sep 18, 2026
Anthony Kim (anthonykim1)
previously approved these changes
Sep 18, 2026
Dmitriy Vasyura (dmitrivMS)
marked this pull request as draft
September 18, 2026 22:27
Keep resolved policy blocks effective after disposing a connection, including suppression of cached tools and prompts. Settle startup waits on explicit stop or disposal so policy restoration permits a retry without regressing normal transport restarts. Share configuration-variable parsing with preliminary MCP checks so literal incomplete markers do not defer allow/deny enforcement. Add regression coverage for retained blocks, definition changes, preliminary checks, and cancelled startup. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Dmitriy Vasyura (dmitrivMS)
dismissed stale reviews from Anthony Kim (anthonykim1) and roblourens
via
September 18, 2026 23:44
0052d68
Contributor
Screenshot ChangesBase: Changed (2)
|
| Before | After |
|---|---|
 |
 |
sessions/sessionChatInputToolbar/SessionChatPills_HorizontalOverflow/Light
| Before | After |
|---|---|
 |
 |
1 insignificant change(s) omitted (≤20 px, Δ≤2). See CI logs for details.
Copilot started reviewing on behalf of
Dmitriy Vasyura (dmitrivMS)
September 19, 2026 00:55
View session
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Definition updates can revive stale identities, bypass renamed-server policies, and leave cached metadata exposed under access or name restrictions.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
Resolved since last review (2)
Comment on lines
+542
to
+543
| if (resolved && definition && McpServerDefinition.equals(resolved.definition, definition)) { | ||
| return this._evaluatePolicy(resolved.identity); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
MCP URL rules must be enforced against the fully resolved launch, even if the resulting URL still contains text that resembles a configuration variable. Policy updates must also recheck existing connections and keep blocked servers from exposing cached tools or prompts.