- Shipped
- 25 ஆகஸ்ட், 2026 அன்று 12:55 AM UTC
- Author
- Kamo
- Commit
- 2bd0c05
executeTool forwards operator-supplied arguments to an operator-typed URL and can spawn a stdio process, with no allowlist, no SSRF guard and no destination audit — so the set of processors it can reach is unbounded and unknowable. That is why MCP_GATEWAY is BLOCKED_NO_BAA rather than pending work, and it had no enforcement point until now. The guard sits in McpServerManager.executeTool rather than the controller, ahead of the tenancy check and before any transport is touched. Note: **************** was already failing before this change and is unrelated.