Fail closed when retrying untrusted local MCP servers

Startup already filtered local-source servers before spawn. Retry went
through late connect with no trust check, so Deny still launched the
command. Apply the same filter on that path.

Author: TheGreatAxios

src/agent/tools.ts

@@ -31,7 +31,11 @@ import { createExaMCPServerConfig, isBuiltinExaMCPServer } from "../mcp/exa.js";
 import { mcpClientToAgentTools } from "../mcp/plugin.js";
 import { createDynamicToolRunner, type DynamicToolRunner } from "../tui/dynamic-tool-runner.js";
 import type { MCPServerConfig, Settings } from "../config/settings.js";
-import { filterMcpServersForConnect, type ProjectTrustStore } from "../trust/project-trust.js";
+import {
+  filterMcpServersForConnect,
+  mcpServerFingerprint,
+  type ProjectTrustStore,
+} from "../trust/project-trust.js";
 import type { ToolWatchdogConfig } from "../tui/tool-execution-watchdog.js";
 import type { SessionMode } from "../config/session-mode.js";
 import { sessionModeEnablesSubAgents } from "../config/session-mode.js";
@@ -547,6 +551,38 @@ export async function createAgentToolset(args: AgentToolsetArgs): Promise<AgentT
   const mcpAbortController = new AbortController();
   let disposed = false;
   let disposal: Promise<void> | undefined;
+  let mcpTrustStore: ProjectTrustStore = projectTrust ?? {
+    trustedPluginPaths: [],
+    trustedMcpFingerprints: [],
+  };
+  const untrustedLocalError = `Not trusted for this project (see ${SETTINGS_DIR_NAME}/trust.json)`;
+
+  const filterServersForConnect = async (
+    servers: MCPServerConfig[],
+  ): Promise<MCPServerConfig[]> => {
+    const allowed = await filterMcpServersForConnect(servers, {
+      source: mcpServersSource,
+      store: mcpTrustStore,
+      cwd,
+      ...(requestMcpTrust !== undefined ? { requestTrust: requestMcpTrust } : {}),
+    });
+    if (mcpServersSource !== "local") return allowed;
+    // Remember grants so connectOneMCPServer does not re-prompt after startup TOFU.
+    let fingerprints = mcpTrustStore.trustedMcpFingerprints;
+    let changed = false;
+    for (const server of allowed) {
+      if (isBuiltinExaMCPServer(server)) continue;
+      const fp = mcpServerFingerprint(server);
+      if (!fingerprints.includes(fp)) {
+        fingerprints = [...fingerprints, fp];
+        changed = true;
+      }
+    }
+    if (changed) {
+      mcpTrustStore = { ...mcpTrustStore, trustedMcpFingerprints: fingerprints };
+    }
+    return allowed;
+  };
 
   const connectOneMCPServer = (
     config: MCPServerConfig,
@@ -563,6 +599,18 @@ export async function createAgentToolset(args: AgentToolsetArgs): Promise<AgentT
         : AbortSignal.any([mcpAbortController.signal, signal]);
 
     const run = (async () => {
+      if (mcpServersSource === "local") {
+        const allowed = await filterServersForConnect([config]);
+        if (disposed) return;
+        if (allowed.length === 0) {
+          callbacks.onStatus({
+            name: config.name,
+            state: "failed",
+            error: untrustedLocalError,
+          });
+          return;
+        }
+      }
       callbacks.onStatus({ name: config.name, state: "connecting" });
       let result: MCPConnectResult;
       try {
@@ -657,12 +705,7 @@ export async function createAgentToolset(args: AgentToolsetArgs): Promise<AgentT
     signal?: AbortSignal,
   ): Promise<void> => {
     if (disposed) return;
-    const toConnect = await filterMcpServersForConnect(mcpServers, {
-      source: mcpServersSource,
-      store: projectTrust ?? { trustedPluginPaths: [], trustedMcpFingerprints: [] },
-      cwd,
-      ...(requestMcpTrust !== undefined ? { requestTrust: requestMcpTrust } : {}),
-    });
+    const toConnect = await filterServersForConnect(mcpServers);
     if (disposed) return;
     await Promise.all(toConnect.map((config) => connectOneMCPServer(config, callbacks, signal)));
     if (disposed) return;
@@ -674,7 +717,7 @@ export async function createAgentToolset(args: AgentToolsetArgs): Promise<AgentT
           callbacks.onStatus({
             name: server.name,
             state: "failed",
-            error: `Not trusted for this project (see ${SETTINGS_DIR_NAME}/trust.json)`,
+            error: untrustedLocalError,
           });
         }
       }

tests/unit/tui/agent-tools.test.ts

@@ -3,6 +3,7 @@ import type { ToolDefinition, ToolCall } from "@intx/types/runtime";
 import { TOOL_NAMES } from "@intx/tools-posix";
 import { createPermissionGate } from "../../../src/permission/gate.js";
 import type { PermissionGate } from "../../../src/permission/gate.js";
+import { mcpServerFingerprint } from "../../../src/trust/project-trust.js";
 import { withMockedModule } from "../../helpers/mock-module.js";
 
 const mockDispose = mock(async () => {});
@@ -362,6 +363,136 @@ test("headless MCP connection does not wait for interactive OAuth", async () =>
   expect(mockConnectMCPServer.mock.calls[0]?.[1]?.onAuthURL).toBeUndefined();
 });
 
+const localStdioServer = { name: "evil", command: "evil-bin" };
+const globalHttpServer = {
+  name: "linear",
+  type: "http" as const,
+  url: "https://mcp.example.test/mcp",
+};
+
+test("late connect of an untrusted local-source server does not spawn", async () => {
+  mockConnectMCPServer.mockClear();
+  const statuses: { name: string; state: string; error?: string }[] = [];
+  const toolset = await createAgentToolset({
+    cwd: "/fake",
+    permissionGate: fakePermissionGate,
+    onOperatorGate: async () => ({ kind: "cancel" }),
+    mcpServers: [localStdioServer],
+    mcpServersSource: "local",
+    projectTrust: { trustedPluginPaths: [], trustedMcpFingerprints: [] },
+  });
+
+  await toolset.connectMCPServer(localStdioServer, {
+    interactiveAuth: false,
+    onStatus: (status) => statuses.push(status),
+    onToolsChanged: () => {},
+  });
+
+  expect(mockConnectMCPServer).not.toHaveBeenCalled();
+  expect(statuses).toHaveLength(1);
+  expect(statuses[0]?.name).toBe("evil");
+  expect(statuses[0]?.state).toBe("failed");
+  expect(statuses[0]?.error).toMatch(/Not trusted for this project/);
+  await toolset.dispose();
+});
+
+test("late connect of an untrusted local-source server fail-closes when requestMcpTrust denies", async () => {
+  mockConnectMCPServer.mockClear();
+  let trustAsks = 0;
+  const toolset = await createAgentToolset({
+    cwd: "/fake",
+    permissionGate: fakePermissionGate,
+    onOperatorGate: async () => ({ kind: "cancel" }),
+    mcpServers: [localStdioServer],
+    mcpServersSource: "local",
+    projectTrust: { trustedPluginPaths: [], trustedMcpFingerprints: [] },
+    requestMcpTrust: async () => {
+      trustAsks += 1;
+      return false;
+    },
+  });
+
+  await toolset.connectMCPServer(localStdioServer, {
+    interactiveAuth: false,
+    onStatus: () => {},
+    onToolsChanged: () => {},
+  });
+
+  expect(trustAsks).toBe(1);
+  expect(mockConnectMCPServer).not.toHaveBeenCalled();
+  await toolset.dispose();
+});
+
+test("late connect of a trusted local-source server still connects", async () => {
+  mockConnectMCPServer.mockClear();
+  const toolset = await createAgentToolset({
+    cwd: "/fake",
+    permissionGate: fakePermissionGate,
+    onOperatorGate: async () => ({ kind: "cancel" }),
+    mcpServers: [localStdioServer],
+    mcpServersSource: "local",
+    projectTrust: {
+      trustedPluginPaths: [],
+      trustedMcpFingerprints: [mcpServerFingerprint(localStdioServer)],
+    },
+  });
+
+  await toolset.connectMCPServer(localStdioServer, {
+    interactiveAuth: false,
+    onStatus: () => {},
+    onToolsChanged: () => {},
+  });
+
+  expect(mockConnectMCPServer).toHaveBeenCalledTimes(1);
+  expect(mockConnectMCPServer.mock.calls[0]?.[0]).toEqual(localStdioServer);
+  await toolset.dispose();
+});
+
+test("late connect of a global-source HTTP server does not require trust", async () => {
+  mockConnectMCPServer.mockClear();
+  const toolset = await createAgentToolset({
+    cwd: "/fake",
+    permissionGate: fakePermissionGate,
+    onOperatorGate: async () => ({ kind: "cancel" }),
+    mcpServers: [globalHttpServer],
+    mcpServersSource: "global",
+    projectTrust: { trustedPluginPaths: [], trustedMcpFingerprints: [] },
+  });
+
+  await toolset.connectMCPServer(globalHttpServer, {
+    interactiveAuth: false,
+    onStatus: () => {},
+    onToolsChanged: () => {},
+  });
+
+  expect(mockConnectMCPServer).toHaveBeenCalledTimes(1);
+  expect(mockConnectMCPServer.mock.calls[0]?.[0]).toEqual(globalHttpServer);
+  await toolset.dispose();
+});
+
+test("startup connectMCP still fail-closes untrusted local servers", async () => {
+  mockConnectMCPServer.mockClear();
+  const statuses: { name: string; state: string; error?: string }[] = [];
+  const toolset = await createAgentToolset({
+    cwd: "/fake",
+    permissionGate: fakePermissionGate,
+    onOperatorGate: async () => ({ kind: "cancel" }),
+    mcpServers: [localStdioServer],
+    mcpServersSource: "local",
+    projectTrust: { trustedPluginPaths: [], trustedMcpFingerprints: [] },
+  });
+
+  await toolset.connectMCP({
+    interactiveAuth: false,
+    onStatus: (status) => statuses.push(status),
+    onToolsChanged: () => {},
+  });
+
+  expect(mockConnectMCPServer).not.toHaveBeenCalled();
+  expect(statuses.some((s) => s.name === "evil" && s.state === "failed")).toBe(true);
+  await toolset.dispose();
+});
+
 test("dispose calls posixTools.dispose", async () => {
   mockDispose.mockClear();