mcp: enforce URL policy after variable resolution - #336849
Merged
Merged
Conversation
Distinguish preliminary definition checks from authoritative resolved launch checks. Validate the local resolved connection before starting its transport, and re-evaluate active connections whenever policy changes. Add regression coverage for literal variable markers, resolved URL allow/deny rules, permitted unresolved definitions, and policy changes affecting running servers. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot started reviewing on behalf of
Dmitriy Vasyura (dmitrivMS)
September 18, 2026 21:30
View session
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Preliminary checks still defer literal markers, and reactive denial loses its blocked state after clearing unresolved connections.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
Open (2)
What changed in this PR
Enforces MCP URL policy against resolved runtime connections and reacts to policy changes.
Changes:
- Separates definition-time and resolved-runtime policy checks.
- Rechecks resolved connections before transport startup.
- Adds regression coverage for URL resolution and policy updates.
| File | Description |
|---|---|
allowedMcpServersService.ts |
Splits preliminary and authoritative checks. |
mcpManagement.ts |
Documents policy-check phases. |
mcpServer.ts |
Adds resolver-aware checks and reactive enforcement. |
allowedMcpServersService.test.ts |
Tests URL policy semantics. |
mcpService.test.ts |
Tests runtime resolution and policy updates. |
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
roblourens
previously approved these changes
Sep 18, 2026
Anthony Kim (anthonykim1)
previously approved these changes
Sep 18, 2026
Dmitriy Vasyura (dmitrivMS)
marked this pull request as draft
September 18, 2026 22:27
Keep resolved policy blocks effective after disposing a connection, including suppression of cached tools and prompts. Settle startup waits on explicit stop or disposal so policy restoration permits a retry without regressing normal transport restarts. Share configuration-variable parsing with preliminary MCP checks so literal incomplete markers do not defer allow/deny enforcement. Add regression coverage for retained blocks, definition changes, preliminary checks, and cancelled startup. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Dmitriy Vasyura (dmitrivMS)
dismissed stale reviews from Anthony Kim (anthonykim1) and roblourens
via
September 18, 2026 23:44
0052d68
Copilot started reviewing on behalf of
Dmitriy Vasyura (dmitrivMS)
September 19, 2026 00:55
View session
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Definition updates can revive stale identities, bypass renamed-server policies, and leave cached metadata exposed under access or name restrictions.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
Resolved since last review (2)
Discard the retained resolved launch identity on the first non-equivalent definition change, including while a connection is live. Returning from definition B to A must not revive A's stale policy result or prevent its variables from being resolved again. Reuse the existing policy-enforcement observer and preserve the equivalent-definition and resolved-launch checks. Add failing-first regressions for stopped and live connection histories. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Microsoft (microsoft)
deleted a comment from
Allen Bacabis Santiago (saitanallensantiago26-beep)
Allow interactive retries to resolve current inputs after a retained policy denial without clearing the block that hides cached metadata. Quiet starts remain blocked, and cancellation or repeated denial keeps the cache hidden until a resolved destination is permitted. Use one shared linear-time, constant-space balanced-variable detector for preliminary checks and workbench discovery instead of repeatedly parsing unmatched suffixes. Preserve the existing nested-variable syntax and avoid constructing resolver expressions just to detect variables. Add failing-first edit/reset, cancellation, repeated-denial and 64 KiB discovery regressions, plus differential grammar coverage. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot started reviewing on behalf of
Dmitriy Vasyura (dmitrivMS)
September 20, 2026 16:11
View session
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Interactive retries can perform variable-resolution side effects despite access or name-based policy denial.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
Resolved since last review (1)
Reject access and name restrictions before provider activation or variable resolution, including interactive retries that retain a previous URL denial. Expose the shared preliminary identity check and apply it at rest and before allowing re-resolution. Defer only rules for unresolved URL/command fields; keep the resolved runtime check authoritative. Update test doubles for the internal service contract. Add failing-first coverage for initial starts and retained-identity retries with input/command variables, plus command-policy deferral controls. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot started reviewing on behalf of
Dmitriy Vasyura (dmitrivMS)
September 20, 2026 18:15
View session
Contributor
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
The implementation addresses the prior findings and includes comprehensive focused coverage for policy resolution and connection lifecycle edge cases.
Review effort: Balanced
Findings: None
Resolved since last review (1)
Dmitriy Vasyura (dmitrivMS)
marked this pull request as ready for review
September 20, 2026 18:26
Dmitriy Vasyura (dmitrivMS)
enabled auto-merge (squash)
September 20, 2026 18:26
Sandeep Somavarapu (sandy081)
approved these changes
Sep 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
MCP URL rules must be enforced against the fully resolved launch, even if the resulting URL still contains text that resembles a configuration variable. Policy updates must also recheck existing connections and keep blocked servers from exposing cached tools or prompts.