🐛 Remove orphaned MCP capability policies #18713

Author: 88250

kernel/agent/capability.go

@@ -169,20 +169,31 @@ func capabilityAllowed(id string, context capabilityAccessContext) bool {
 	return currentCapabilityAuthorizer.Allows(id, context)
 }
 
+func capabilityOwnerAvailable(source, runtime, ownerID string) bool {
+	if source != "mcp" && runtime != "mcp" {
+		return true
+	}
+	if ownerID == "" {
+		return true
+	}
+	if kernelModel.Conf == nil || kernelModel.Conf.AI == nil || kernelModel.Conf.AI.MCP == nil {
+		return false
+	}
+	for _, server := range kernelModel.Conf.AI.MCP.Servers {
+		if server.ID == ownerID {
+			return server.Enabled
+		}
+	}
+	return false
+}
+
 func buildCapabilitySet(frontendCapabilities []FrontendCapability, accessContext capabilityAccessContext) (*capabilitySet, error) {
 	set := &capabilitySet{
 		registrations: map[string]*capabilityRegistration{},
 		ids:           map[string]*capabilityRegistration{},
 	}
 	for _, tool := range tools.GetAllTools() {
 		id := tools.CapabilityIDForTool(tool)
-		if id == "" || !capabilityAllowed(id, accessContext) {
-			continue
-		}
-		registered, validator := tools.LookupToolWithValidator(tool.Name)
-		if registered != tool || validator == nil {
-			continue
-		}
 		runtime := tool.Runtime
 		if runtime == "" {
 			runtime = "kernel"
@@ -191,6 +202,14 @@ func buildCapabilitySet(frontendCapabilities []FrontendCapability, accessContext
 		if source == "" {
 			source = "native"
 		}
+		if id == "" || !capabilityOwnerAvailable(source, runtime, tool.OwnerID) ||
+			!capabilityAllowed(id, accessContext) {
+			continue
+		}
+		registered, validator := tools.LookupToolWithValidator(tool.Name)
+		if registered != tool || validator == nil {
+			continue
+		}
 		registration := &capabilityRegistration{
 			ID:            id,
 			ModelName:     tool.Name,
@@ -335,7 +354,12 @@ func capabilityStillExecutable(registration *capabilityRegistration, args map[st
 	}
 	accessContext := registration.AccessContext
 	accessContext.Arguments = args
-	if !capabilityAllowed(registration.ID, accessContext) {
+	ownerID := registration.OwnerID
+	if ownerID == "" && registration.Tool != nil {
+		ownerID = registration.Tool.OwnerID
+	}
+	if !capabilityOwnerAvailable(registration.Source, registration.Runtime, ownerID) ||
+		!capabilityAllowed(registration.ID, accessContext) {
 		return false
 	}
 	if registration.isBrowser() {

kernel/agent/capability_test.go

@@ -108,6 +108,63 @@ func TestCapabilityPolicyControlsExposureAndExecution(t *testing.T) {
 	}
 }
 
+func TestMCPCapabilityRequiresEnabledConfiguredServer(t *testing.T) {
+	const toolName = "test_mcp_owner_availability"
+	const serverID = "test-mcp-server"
+
+	originalConf := kernelModel.Conf
+	kernelModel.Conf = kernelModel.NewAppConf()
+	kernelModel.Conf.AI = conf.NewAI()
+	t.Cleanup(func() { kernelModel.Conf = originalConf })
+
+	tool := &tools.Tool{
+		Name:         toolName,
+		CapabilityID: tools.BuildCapabilityID("mcp", "backend", serverID, "read"),
+		Description:  "Test MCP owner availability",
+		InputSchema:  tools.ToolSchema{Type: "object"},
+		Source:       "mcp",
+		OwnerID:      serverID,
+		Runtime:      "mcp",
+		Handler: func(args map[string]any) (tools.CallToolResult, error) {
+			return tools.CallToolResult{}, nil
+		},
+	}
+	if err := tools.SetTool(toolName, tool); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { tools.RemoveTool(toolName) })
+
+	set, err := buildCapabilitySet(nil, capabilityAccessContext{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if set.registration(toolName) != nil {
+		t.Fatal("MCP capability without a configured server was exposed")
+	}
+
+	kernelModel.Conf.AI.MCP.Servers = []conf.MCPServer{{ID: serverID, Enabled: true}}
+	set, err = buildCapabilitySet(nil, capabilityAccessContext{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	registration := set.registration(toolName)
+	if registration == nil || !capabilityStillExecutable(registration, nil) {
+		t.Fatal("MCP capability for an enabled configured server was unavailable")
+	}
+
+	kernelModel.Conf.AI.MCP.Servers[0].Enabled = false
+	if capabilityStillExecutable(registration, nil) {
+		t.Fatal("MCP capability remained executable after its server was disabled")
+	}
+	set, err = buildCapabilitySet(nil, capabilityAccessContext{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if set.registration(toolName) != nil {
+		t.Fatal("MCP capability for a disabled server was exposed")
+	}
+}
+
 func TestExplicitCapabilityConfirmationOverridesRiskAndSessionApproval(t *testing.T) {
 	originalConf := kernelModel.Conf
 	kernelModel.Conf = kernelModel.NewAppConf()

kernel/conf/ai.go

@@ -19,6 +19,7 @@ package conf
 import (
 	"encoding/hex"
 	"encoding/json"
+	"net/url"
 	"os"
 	"strconv"
 	"strings"
@@ -516,6 +517,7 @@ func (ai *AI) Normalize() {
 			ai.Agent.MaxRetries = 10
 		}
 	}
+	ai.pruneOrphanedMCPCapabilityPolicies()
 	if ai.Editing == nil {
 		ai.Editing = defaultEditing()
 	} else {
@@ -626,6 +628,32 @@ func (ai *AI) Normalize() {
 	}
 }
 
+func (ai *AI) pruneOrphanedMCPCapabilityPolicies() {
+	configuredServerIDs := make(map[string]bool, len(ai.MCP.Servers))
+	for _, server := range ai.MCP.Servers {
+		configuredServerIDs[url.PathEscape(server.ID)] = true
+	}
+
+	isOrphaned := func(id string) bool {
+		const prefix = "mcp/backend/"
+		if !strings.HasPrefix(id, prefix) {
+			return false
+		}
+		serverID, _, ok := strings.Cut(strings.TrimPrefix(id, prefix), "/")
+		return ok && !configuredServerIDs[serverID]
+	}
+	for id := range ai.Agent.CapabilityPolicy.Overrides {
+		if isOrphaned(id) {
+			delete(ai.Agent.CapabilityPolicy.Overrides, id)
+		}
+	}
+	for id := range ai.Agent.ApprovalPolicy.Overrides {
+		if isOrphaned(id) {
+			delete(ai.Agent.ApprovalPolicy.Overrides, id)
+		}
+	}
+}
+
 func normalizeApprovalPolicy(policy *ApprovalPolicy) {
 	// 旧版中的 confirm 表示未自动批准，实际仍按操作风险判断，因此迁移为 risk。
 	if policy.Default == ApprovalDecisionConfirm ||

kernel/conf/ai_mcp_test.go

@@ -35,6 +35,51 @@ func TestNormalizeMCPServerIDs(t *testing.T) {
 	}
 }
 
+func TestNormalizePrunesOrphanedMCPCapabilityPolicies(t *testing.T) {
+	const retainedID = "mcp/backend/retained-server/read"
+	const similarID = "mcp/backend/retained-server-similar/read"
+	const orphanedID = "mcp/backend/removed-server/read"
+	const nativeID = "native/backend/search"
+
+	ai := NewAI()
+	ai.MCP.Servers = []MCPServer{{ID: "retained-server", Name: "retained", Enabled: false}}
+	ai.Agent.CapabilityPolicy.Overrides = map[string]string{
+		retainedID: "deny",
+		similarID:  "deny",
+		orphanedID: "deny",
+		nativeID:   "deny",
+	}
+	ai.Agent.ApprovalPolicy.Overrides = map[string]*CapabilityApproval{
+		retainedID: {Default: ApprovalDecisionAllow},
+		similarID:  {Default: ApprovalDecisionAllow},
+		orphanedID: {Actions: map[string]string{"read": ApprovalDecisionConfirm}},
+		nativeID:   {Default: ApprovalDecisionAllow},
+	}
+
+	ai.Normalize()
+
+	if _, exists := ai.Agent.CapabilityPolicy.Overrides[orphanedID]; exists {
+		t.Fatal("orphaned MCP capability policy was not pruned")
+	}
+	if _, exists := ai.Agent.ApprovalPolicy.Overrides[orphanedID]; exists {
+		t.Fatal("orphaned MCP approval policy was not pruned")
+	}
+	for _, id := range []string{retainedID, nativeID} {
+		if _, exists := ai.Agent.CapabilityPolicy.Overrides[id]; !exists {
+			t.Fatalf("configured capability policy was pruned: %s", id)
+		}
+		if _, exists := ai.Agent.ApprovalPolicy.Overrides[id]; !exists {
+			t.Fatalf("configured approval policy was pruned: %s", id)
+		}
+	}
+	if _, exists := ai.Agent.CapabilityPolicy.Overrides[similarID]; exists {
+		t.Fatal("capability policy for a similarly named orphaned server was not pruned")
+	}
+	if _, exists := ai.Agent.ApprovalPolicy.Overrides[similarID]; exists {
+		t.Fatal("approval policy for a similarly named orphaned server was not pruned")
+	}
+}
+
 func TestMigrateMCPEnvironment(t *testing.T) {
 	mcp := migrateMCP(map[string]any{
 		"servers": []any{