Skip to content

fix: enforce mcp/fetch domain allowlist to close web-fetch AWF bypass#23931

Draft
Copilot wants to merge 3 commits intomainfrom
copilot/fix-awf-allowlist-enforcement
Draft

fix: enforce mcp/fetch domain allowlist to close web-fetch AWF bypass#23931
Copilot wants to merge 3 commits intomainfrom
copilot/fix-awf-allowlist-enforcement

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Apr 1, 2026

The mcp/fetch container is launched by the MCP Gateway on the host — outside AWF's network namespace — so web-fetch requests bypass AWF's iptables enforcement entirely, allowing the tool to reach any URL regardless of network.allowed.

Fix

Pass --allowed-domains to mcp-server-fetch via entrypointArgs in the generated MCP Gateway config, mirroring the same domain policy AWF applies to the agent container.

computeWebFetchAllowedDomains computes the correct allowlist:

  • Active firewall + non-wildcard network.allowed → emit --allowed-domains with the expanded domain list
  • network.allowed: ["*"] or firewall disabled → no restriction (no entrypointArgs)

renderMCPFetchServerConfig gains an allowedDomains string parameter and renders entrypointArgs in both JSON (Claude/Copilot) and TOML (Codex) formats with proper json.Marshal escaping:

# JSON (Copilot/Claude) — firewall active with network.allowed: [defaults, github]
"web-fetch": {
  "container": "mcp/fetch",
  "entrypointArgs": [
    "--allowed-domains",
    "api.github.com",
    "github.com",
    "raw.githubusercontent.com",
    ...
  ]
}
# TOML (Codex)
[mcp_servers."web-fetch"]
container = "mcp/fetch"
entrypointArgs = ["--allowed-domains", "api.github.com", "github.com", ...]

Scope

The plain-HTTP-to-numeric-IP bypass (e.g. curl 8.8.8.8) requires iptables changes in gh-aw-firewall and cannot be addressed here.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GO111MODULE 64/bin/go git rev-�� --show-toplevel ache/go/1.25.0/xGO111MODULE /usr/bin/git 8116026/b381/_pkgit GO111MODULE 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GO111MODULE 64/bin/go git rev-�� --show-toplevel go (http block)
  • https://api.github.com/orgs/test-owner/actions/secrets
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name unset GOROOT; export PATH="$(finremote.origin.url go /usr/bin/git -json GO111MODULE /opt/hostedtoolc/home/REDACTED/work/gh-aw/gh-aw/.github/workflows git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE /opt/hostedtoolc--noprofile git (http block)
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git atjTay5oJ .cfg 1896385/b387/vet--show-toplevel git rev-�� --show-toplevel bash /usr/bin/git -aw/git/ref/tagsgit stmain.go ache/go/1.25.0/x--show-toplevel git (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel git /usr/bin/git ub/workflows git me: String!) { --show-toplevel git rev-�� --show-toplevel git /usr/bin/gh ithub/workflows git x_amd64/link gh (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha /repos/actions/github-script/git/ref/tags/v8 --jq /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha --noprofile git /usr/bin/gh --show-toplevel go /usr/bin/git gh api /repos/test-owner/test-repo/actions/secrets --jq /usr/bin/git --show-toplevel go r: $owner, name:--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha /repos/actions/checkout/git/ref/tags/v5 --jq /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� licyMinIntegrityOnlyrepos_only_without_min-integrity4142535544/001 git /usr/bin/git --show-toplevel ache/go/1.25.0/xrev-parse 86_64/node git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha heck '**/*.cjs' GOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go m/_n�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha -json GO111MODULE /usr/bin/git GOINSECURE GOMOD GOMODCACHE git rev-�� --show-toplevel GOPROXY /usr/bin/git GOSUMDB GOWORK 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel 8116026/b366/impowner=github /usr/bin/git k/gh-aw/gh-aw/cmgit GOPROXY 64/bin/go git rev-�� --show-toplevel /opt/hostedtoolcache/go/1.25.0/xGO111MODULE 86_64/node /tmp/go-build202git -trimpath 64/bin/go git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel sh /usr/bin/git "prettier" --chegit GOPROXY 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha /tmp/shared-actions-test2267069189 rev-parse /usr/bin/git --show-toplevel infocmp /usr/bin/git git conf�� --get remote.origin.url /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel /...; \ else \ echo "golangci-lGO111MODULE /usr/bin/git "prettier" --chegit GOPROXY 64/bin/go git (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha xterm-color git /usr/bin/git --show-toplevel git /usr/bin/git git remo�� remove origin /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel head /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel e/git /usr/bin/git git (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha /repos/actions/github-script/git/ref/tags/v8 resolved$ /usr/bin/git --show-toplevel git /usr/bin/git git remo�� add origin /usr/bin/git ithub/workflows git /usr/bin/git git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel bash /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel /opt/hostedtoolcrev-parse (http block)
  • https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� ch go /usr/bin/git -json GO111MODULE ache/go/1.25.0/xinspect git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha --show-toplevel go /usr/bin/git -json GO111MODULE ache/go/1.25.0/x64/bin/go git rev-�� --show-toplevel go (http block)
  • https://api.github.com/repos/github/gh-aw
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility --show-toplevel go /usr/bin/git -json GO111MODULE ache/go/1.25.0/x/home/REDACTED/work/gh-aw/gh-aw/.github/workflows git rev-�� --show-toplevel go r: $owner, name: $name) { hasDiscussionsEnabled } } -json GO111MODULE /opt/hostedtoolcinspect git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility --show-toplevel go /usr/bin/git -json GO111MODULE /opt/hostedtoolc/home/REDACTED/work/gh-aw/gh-aw/.github/workflows git rev-�� --show-toplevel go r: $owner, name: $name) { hasDiscussionsEnabled } } -json GO111MODULE /opt/hostedtoolcinspect git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0 --jq .object.sha --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE ache/go/1.25.0/x/home/REDACTED/work/gh-aw/gh-aw/.github/workflows git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0 --jq .object.sha --show-toplevel go /usr/bin/git -json GO111MODULE ache/go/1.25.0/x64/bin/go git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE ache/go/1.25.0/x/home/REDACTED/work/gh-aw/gh-aw/.github/workflows git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha k/gh-aw/gh-aw/.github/workflows/auto-triage-issues.md git /usr/bin/git --show-toplevel git /usr/bin/git git -C /tmp/gh-aw-test-runs/20260401-170000-54035/test-140475012 status /usr/bin/git .github/workflowgit git /usr/bin/git git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha --show-toplevel xn7t1JUtg95X /usr/bin/git --show-toplevel bash 1bbf481cdd3f5d6d--show-toplevel git conf�� user.name Test User /usr/bin/git --show-toplevel /tmp/go-build329rev-parse inPathSetup_Goro--show-toplevel git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha 0000-54035/test-140475012 ghcr.io/github/serena-mcp-server:latest .cfg --show-toplevel go /usr/bin/git 1896385/b404/importcfg --no�� k/gh-aw/gh-aw/pkg/constants/constants.go k/gh-aw/gh-aw/pkg/constants/engine_constants.go 0/x64/bin/node --show-toplevel go r: $owner, name:--show-toplevel /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linu-buildtags (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha --show-toplevel git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha licyMinIntegrityOnlymin-integrity_with_explicit_repo901803503/00remote.origin.url config 1896385/b402/_pkg_.a l go /usr/bin/git git rev-�� --show-toplevel git 0/x64/bin/node --show-toplevel go /usr/bin/git /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linuREDACTED (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha CompiledOutput3172180601/001 git /usr/bin/git --show-toplevel 64/pkg/tool/linurev-parse /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 git /usr/bin/git --show-toplevel go /usr/bin/git git rev-�� ithub/workflows git /usr/bin/git l sh /usr/bin/git git (http block)
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 git x_amd64/compile --show-toplevel go /usr/bin/git x_amd64/compile rev-�� ithub/workflows git /usr/bin/git --show-toplevel sh DiscussionsEnabl--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 git /usr/bin/git --show-toplevel 64/pkg/tool/linurev-parse (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 git /usr/bin/git --show-toplevel go /usr/bin/git git rev-�� ty-test.md git /usr/bin/git l sh /usr/bin/git git (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 git /usr/bin/git --show-toplevel x_amd64/vet /usr/bin/git git rev-�� itattributes-test149784894/.github/workflows git /usr/bin/git l git /usr/bin/git git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 git me: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } --show-toplevel %H %ct %D ed } } git rev-�� ithub/workflows git /usr/bin/git --show-toplevel sh /usr/bin/git git (http block)
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 git /usr/bin/git --show-toplevel sole.test /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel infocmp /usr/bin/git git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 git (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 git /usr/bin/git --show-toplevel x_amd64/vet /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel /usr/bin/gh /usr/bin/git git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 git x_amd64/vet --show-toplevel %H %ct %D cbb208961da535a09ff9463a x_amd64/vet rev-�� --show-toplevel git me: String!) { repository(owne-importcfg --show-toplevel sh DiscussionsEnabl--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 git /usr/bin/git --show-toplevel x_amd64/compile /usr/bin/git git rev-�� /actions/secrets git /usr/bin/git --show-toplevel x_amd64/vet /usr/bin/git git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 cbb208961da535a09ff9463a:go.mod /usr/bin/git --show-toplevel go /usr/bin/git git rev-�� ithub/workflows git (http block)
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 git /usr/bin/git --show-toplevel 64/pkg/tool/linurev-parse /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel jeoBUj-riwfZXgvYrev-parse /usr/bin/git git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --show-toplevel go /usr/bin/git -json GO111MODULE /opt/hostedtoolc/home/REDACTED/work/gh-aw/gh-aw/.github/workflows git add initial.txt go /usr/bin/git -json GO111MODULE /opt/hostedtoolc--noprofile git (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GO111MODULE /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel GOPROXY /usr/bin/git git (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 go /usr/bin/git git estl�� ithub/workflows git /usr/bin/git --show-toplevel /bin/sh /usr/bin/git git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha --show-toplevel GOPROXY /usr/bin/git GOSUMDB GOWORK 64/bin/go git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha --show-toplevel git /usr/bin/git ty-test.md git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha --show-toplevel git /usr/bin/git repo2058310656/0git node /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel /opt/hostedtoolcshow-ref /usr/bin/git git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE go ache�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha --show-toplevel git me: String!) { repository(owne-importcfg --show-toplevel go ed } } git rev-�� md git /usr/bin/git --show-toplevel node /usr/bin/git git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git licyMinIntegritygit .cfg 1896385/b400/vet--show-toplevel git rev-�� --show-toplevel infocmp (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha GOMODCACHE go /usr/bin/git -json GO111MODULE /usr/bin/infocmp-bool git rev-�� --show-toplevel infocmp /usr/bin/git xterm-color GOPROXY /usr/bin/git git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha --show-toplevel git /usr/bin/git /home/REDACTED/worgit rev-parse /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel node /usr/bin/git /tmp/TestHashCongh git /usr/bin/git git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha --count ..feature-branch r: $owner, name: $name) { hasDiscussionsEnabled } } -json GO111MODULE /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel GOPROXY /usr/bin/git git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha GOMODCACHE go ndor/bin/bash -json GO111MODULE /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel GOPROXY /usr/bin/git git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -m Initial /usr/bin/git -json GO111MODULE /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel GOPROXY /usr/bin/git git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha /tmp/gh-aw/aw-feature-branch.patremote.origin.url go repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -json GO111MODULE /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel GOPROXY /usr/bin/git git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha --show-toplevel git /usr/bin/git ATH="$(find "/tmgit /home/REDACTED/worrev-parse ache/node/24.14.--show-toplevel git rev-�� --show-toplevel git /usr/bin/git k/gh-aw/gh-aw/.ggit git /usr/bin/git git (http block)
  • https://api.github.com/repos/githubnext/agentics/git/ref/tags/
    • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha --show-toplevel go $name) { hasDiscussionsEnabled } } -json GO111MODULE kflow.test ache/node/24.14.0/x64/bin/npm rev-�� nly kflow.test /usr/bin/git -json GO111MODULE ache/go/1.25.0/x/home/REDACTED/work/gh-aw/gh-aw/.github/workflows git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha --show-toplevel go $name) { hasDiscussionsEnabled } } -json GO111MODULE ache/go/1.25.0/xxterm-color git rev-�� 40\} ature-branch.patch /usr/bin/git -json GO111MODULE /opt/hostedtoolc/home/REDACTED/work/gh-aw/gh-aw/.github/workflows git (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE go ache�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha ithub/workflows git /usr/bin/git l go /usr/bin/git git rev-�� b/workflows erena-mcp-server:latest (http block)
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha --show-toplevel 4jF2cLix56wGv/MBh0HPykSe0jFe2KuAx7/Xs8Bnl5EgR0BrzO7W7LU/SvNegYn4jF2cLix56wGv /usr/bin/git ry=1 git 1896385/b405/_pk--show-toplevel git rev-�� --show-toplevel bash /usr/bin/git --noprofile git /opt/hostedtoolc--show-toplevel git (http block)
  • https://api.github.com/repos/nonexistent/repo/actions/runs/12345
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion --show-toplevel go /usr/bin/git git rev-�� ithub/workflows git /usr/bin/git l 8116026/b390/imprev-parse ed } } git (http block)
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion --show-toplevel /usr/bin/gh /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
  • https://api.github.com/repos/owner/repo/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo /usr/bin/git -json GO111MODULE /opt/hostedtoolc/home/REDACTED/work/gh-aw/gh-aw/.github/workflows git add initial.txt go /usr/bin/git -json GO111MODULE /opt/hostedtoolc--noprofile git (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -json GO111MODULE /opt/hostedtoolc/home/REDACTED/work/gh-aw/gh-aw/.github/workflows /usr/lib/git-corconfig main�� run --auto /usr/bin/git --detach GO111MODULE /opt/hostedtoolc--noprofile git (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo /usr/bin/git /home/REDACTED/worgit l 0/x64/bin/node git rev-�� --show-toplevel bash /usr/bin/git ithub/workflows/git git /usr/bin/git git (http block)
  • https://api.github.com/repos/owner/repo/contents/file.md
    • Triggering command: /tmp/go-build3291896385/b396/cli.test /tmp/go-build3291896385/b396/cli.test -test.testlogfile=/tmp/go-build3291896385/b396/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true -json GO111MODULE /opt/hostedtoolcgraphql git rev-�� --show-toplevel go /usr/bin/grep -json GO111MODULE /opt/hostedtoolc--noprofile grep (http block)
    • Triggering command: /tmp/go-build194510487/b370/cli.test /tmp/go-build194510487/b370/cli.test -test.testlogfile=/tmp/go-build194510487/b370/testlog.txt -test.paniconexit0 -test.timeout=10m0s rev-�� --show-toplevel /usr/bin/gh /usr/bin/git runs/20260401-17git -f 1896385/b001/vet--show-toplevel git rev-�� --show-toplevel git /usr/bin/git /home/REDACTED/worgit rev-parse /opt/hostedtoolc--show-toplevel git (http block)
  • https://api.github.com/repos/test-owner/test-repo/actions/secrets
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name --show-toplevel go r: $owner, name: $name) { hasDiscussionsEnabled } } -json GO111MODULE /opt/hostedtoolc/home/REDACTED/work/gh-aw/gh-aw/.github/workflows git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE /opt/hostedtoolc--noprofile git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name --show-toplevel git /usr/bin/git /home/REDACTED/worgit config o.git git rev-�� --show-toplevel bash (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Copilot AI and others added 2 commits April 1, 2026 17:04
The mcp/fetch container ran outside AWF's network namespace, allowing the
web-fetch MCP tool to reach any URL regardless of the workflow's
network.allowed restrictions.

Fix: pass --allowed-domains to the mcp-server-fetch entrypoint when AWF
is active with a non-wildcard domain list.  This mirrors the same
allowlist AWF enforces for the agent container so both enforcement
layers agree on which destinations are reachable.

Changes:
- fetch.go: add computeWebFetchAllowedDomains() helper; expand
  renderMCPFetchServerConfig() with allowedDomains parameter that emits
  entrypointArgs in both JSON and TOML formats
- mcp_rendering.go, codex_mcp.go: pass computeWebFetchAllowedDomains()
  at all renderMCPFetchServerConfig call sites
- non_github_mcp_guard_policy_test.go: update call sites to match new
  signature
- fetch_test.go: add test cases for allowed-domains rendering and
  computeWebFetchAllowedDomains() logic
- Recompile affected lock files (smoke-codex, smoke-gemini, ci-doctor)

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/edf3938b-4467-4799-a3d8-6478edb5318e

Co-authored-by: szabta89 <1330202+szabta89@users.noreply.github.com>
…intArgs

Address code review feedback:
- Use json.Marshal for proper escaping of domain values in both JSON and
  TOML output formats, ensuring domain names with special characters
  (e.g., quotes, backslashes) don't break the generated config
- Use yaml.Write([]byte) instead of yaml.WriteString(string([]byte))
  to avoid an unnecessary allocation (mirror lint rule)
- Use strings.SplitSeq instead of strings.Split for iterator efficiency
  (modernize lint rule)

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/edf3938b-4467-4799-a3d8-6478edb5318e

Co-authored-by: szabta89 <1330202+szabta89@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix AWF allowlist enforcement for plain-HTTP connections fix: enforce mcp/fetch domain allowlist to close web-fetch AWF bypass Apr 1, 2026
Copilot AI requested a review from szabta89 April 1, 2026 17:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

AWF allowlist not enforced for plain-HTTP connections to numeric IPs; web-fetch may bypass proxy enforcement

2 participants