Skip to content

feat(simulator): streamable-http MCP servers and workspace-file reachability for container agents - #977

Merged
chughtapan merged 1 commit into
mainfrom
feat/mcp-url-transport-v2
Aug 6, 2026
Merged

feat(simulator): streamable-http MCP servers and workspace-file reachability for container agents#977
chughtapan merged 1 commit into
mainfrom
feat/mcp-url-transport-v2

Conversation

@chughtapan

Copy link
Copy Markdown
Owner

Summary

  • An MCP server on either container runtime may now be a remote {name, url} endpoint alongside the stdio shape: OpenClaw renders its native streamable-http transport; NanoClaw passes it through its application config.
  • Remote URLs may embed per-agent capability tokens: the shared sanitized configuration digests them by origin only, records the URL as redacted, and refuses unparseable URLs at definition time (same decode-at-definition idiom as workspace paths).
  • OpenClaw definitions refuse workspace files that provably can never reach the model (outside the context-injection set while the deny list is the wildcard) via the existing AgentRuntimeDefinitionError — no new failure types — and warn at acquisition when such files are merely tool-reachable.
  • The injection set is pinned behind a drift canary that reads the installed OpenClaw's bootstrap loader chunks, so a version bump that changes the set breaks loudly.

Tests

  • workspace.test.ts: union snapshot round-trip, url redaction, origin-only digests, unparseable-url refusal.
  • openclaw/configuration.test.ts: stdio/streamable-http/omitted render.
  • openclaw/context-files.test.ts: guard refuse/warn/accept + the drift canary.
  • nanoclaw/runtime.test.ts: url passthrough into the application config; projection never carries the URL.

/simplify applied (4-lens review): digest↔redaction collapsed into one producer, nanoclaw re-copy branch deleted, guard split into pure query + explicit assert, canary unions across all matching dist chunks.

🤖 Generated with Claude Code

…ability for container agents

An MCP server may be a remote {name, url} endpoint on both container
runtimes: OpenClaw renders its native streamable-http transport and
NanoClaw passes the definition through its application config. Remote
URLs can carry per-agent capability tokens, so the shared sanitized
configuration digests them by origin only, records the URL as redacted,
and refuses unparseable URLs at definition time.

OpenClaw definitions now also refuse workspace files that provably can
never reach the model (outside the context-injection set while the deny
list is the wildcard), warn at acquisition when such files are merely
tool-reachable, and pin the injection set behind a drift canary that
reads the installed package so a version bump that changes the set
breaks loudly.
@chughtapan
chughtapan merged commit 2123bcd into main Aug 6, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant