Reject loopback HTTP MCP servers in network isolation mode by Copilot · Pull Request #44113 · github/gh-aw

Copilot · 2026-07-07T20:22:06Z

Daily Fact was compiling into a configuration that can never start: an imported HTTP MCP server used localhost, which triggers AWF host access, but the workflow also runs with network-isolation enabled by default. This changes the compiler to fail that combination up front and updates the shipped MemPalace import to use a compatible host address.

Compile-time guardrail
- Reject HTTP MCP server URLs that point at loopback (localhost, 127.0.0.1, ::1) when sandbox.agent.sudo: false / AWF network isolation is enabled.
- Emit an actionable validation error that tells authors to either switch to host.docker.internal or opt out of network isolation.
Shipped workflow fix
- Update the shared MemPalace MCP import to use http://host.docker.internal:8765/mcp.
- Recompile daily-fact.lock.yml so the checked-in workflow no longer carries the invalid runtime combination.
Regression coverage
- Add validation tests for the rejected loopback case and the allowed host.docker.internal case.
- Add a compile test that asserts the compiler fails on a loopback HTTP MCP server under network isolation.
- Add a workflow smoke test that checks the shared MemPalace import and compiled Daily Fact workflow both use host.docker.internal.

sandbox:
  agent:
    sudo: false

mcp-servers:
  mempalace:
    type: http
    url: http://host.docker.internal:8765/mcp

Generated by 👨‍🍳 PR Sous Chef · 7.79 AIC · ⌖ 6.55 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · 8.05 AIC · ⌖ 8.96 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Pull request overview

This PR adds compile-time validation intended to prevent workflows from combining AWF network isolation (sandbox.agent.sudo: false) with HTTP MCP servers configured via loopback URLs (e.g. localhost), and updates the repo’s shipped MemPalace MCP import and compiled Daily Fact workflow to use host.docker.internal.

Changes:

Add sandbox validation that rejects loopback HTTP MCP server URLs when network isolation is enabled.
Add/extend tests covering localhost/host.docker.internal MCP URL behavior and a Daily Fact workflow smoke check.
Update the shared MemPalace MCP import and regenerate the daily-fact.lock.yml output to reflect the new URL.

Show a summary per file

File	Description
pkg/workflow/sandbox_validation.go	Adds a new validation pass for loopback HTTP MCP server URLs under network isolation.
pkg/workflow/sandbox_validation_test.go	Adds a compile-path regression test expecting localhost MCP URLs to be rejected in network isolation mode.
pkg/workflow/sandbox_test.go	Extends unit tests for sandbox validation behavior with host.docker.internal vs localhost cases.
pkg/workflow/importable_tools_test.go	Updates test fixture MCP URL away from loopback.
pkg/workflow/daily_fact_workflow_test.go	Adds a smoke test to ensure shipped Daily Fact workflow/import avoids localhost MCP URLs.
.github/workflows/shared/mcp/mempalace.md	Updates MemPalace MCP URL to `host.docker.internal`.
.github/workflows/daily-fact.lock.yml	Regenerated compiled workflow output reflecting the MemPalace URL change and related domain list changes.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 7/7 changed files
Comments generated: 3
Review effort level: Low

Copilot · 2026-07-07T22:35:57Z

+func validateNetworkIsolationLoopbackMCPServers(workflowData *WorkflowData) error {
+	if workflowData == nil || !isAWFNetworkIsolationEnabled(workflowData) || len(workflowData.ResolvedMCPServers) == 0 {
+		return nil
+	}


Fixed in b90ae95. The validateNetworkIsolationLoopbackMCPServers validator was removed entirely — the compiler already rewrites localhost URLs to host.docker.internal and adds --add-host host.docker.internal:host-gateway to the gateway container (see rewriteLocalhostToDockerHost), so the new validator was fighting existing behavior and conflicting with TestMCPGatewayDockerCommandAddsHostGatewayForLocalhostHTTPMCPInBridgeMode.

Copilot · 2026-07-07T22:36:03Z

 mcp-servers:
  mempalace:
    type: http
-    url: http://localhost:8765/mcp
+    url: http://host.docker.internal:8765/mcp
    allowed:


Fixed in b90ae95. Changed --host 127.0.0.1 to --host 0.0.0.0 so the MemPalace server listens on all interfaces and is reachable from the MCP gateway container via host.docker.internal → host-gateway in network isolation mode.

Copilot · 2026-07-07T22:35:57Z

+			"localhost HTTP MCP servers are incompatible with sandbox.agent.sudo: false because AWF auto-enables host access for loopback URLs, and host access cannot be combined with network isolation",
+			"Replace localhost with host.docker.internal (for example, `http://host.docker.internal:8765/mcp`) or disable network isolation:\n\nsandbox:\n  agent:\n    sudo: true",


Fixed in b90ae95. The entire validateNetworkIsolationLoopbackMCPServers validator and its misleading error text were removed — the compiler's existing rewriteLocalhostToDockerHost path handles localhost in network isolation correctly without needing a rejection validator.

gh-aw-bot · 2026-07-07T21:18:08Z

@copilot please run the pr-finisher skill, make the PR merge-ready, and rerun checks once the branch is up to date.

Generated by 👨‍🍳 PR Sous Chef · 7.79 AIC · ⌖ 6.55 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

github-actions · 2026-07-07T21:29:31Z

Great work on this one 🎉 — catching the localhost + network-isolation mismatch at compile time rather than silently shipping an unrunnable Daily Fact workflow is exactly the right fix, and the regression tests covering both the rejected loopback case and the allowed host.docker.internal case make this solid. The PR looks ready for review.

Generated by ✅ Contribution Check · 219.1 AIC · ⌖ 17 AIC · ⊞ 6.2K · ◷

… 0.0.0.0 Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-07-07T21:48:52Z

@copilot please run the pr-finisher skill, make the PR merge-ready, and rerun checks once the branch is up to date.

...

Done. Addressed all three review threads and pushed the fixes:

Removed validateNetworkIsolationLoopbackMCPServers — the validation was wrong. The compiler already handles localhost URLs in network isolation by rewriting them to host.docker.internal and adding --add-host host.docker.internal:host-gateway to the gateway container command (see rewriteLocalhostToDockerHost + shouldRewriteLocalhostToDocker). The new validation conflicted with the existing TestMCPGatewayDockerCommandAddsHostGatewayForLocalhostHTTPMCPInBridgeMode integration test which expects localhost + network isolation to compile successfully. Removed the related unit test and the "rejects localhost" table case too.
Fixed mempalace server binding — changed --host 127.0.0.1 to --host 0.0.0.0. In network isolation mode the MCP gateway container uses host.docker.internal which resolves to the docker bridge IP via host-gateway, not loopback — so a server binding to 127.0.0.1 is unreachable. Binding to 0.0.0.0 fixes this in both modes.
Recompiled daily-fact.lock.yml — the lock file now carries --host 0.0.0.0 and url = "http://host.docker.internal:8765/mcp".

make test-unit and make recompile both pass locally. CI needs a human re-trigger after this push.

gh-aw-bot · 2026-07-07T22:27:38Z

@copilot please run the pr-finisher skill, make this PR merge-ready, address all unresolved review feedback, and rerun checks once the branch is up to date.

Unresolved review threads to address (newest first):

copilot-pull-request-reviewer: Reject loopback HTTP MCP servers in network isolation mode #44113 (comment)
copilot-pull-request-reviewer: Reject loopback HTTP MCP servers in network isolation mode #44113 (comment)
copilot-pull-request-reviewer: Reject loopback HTTP MCP servers in network isolation mode #44113 (comment)

Generated by 👨‍🍳 PR Sous Chef · 8.05 AIC · ⌖ 8.96 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

github-actions · 2026-07-08T01:08:05Z

🤖 PR Triage

Field	Value
Category	`bug`
Risk	🟡 Medium
Score	67/100 (impact:35 urgency:20 quality:12)
Action	🚀 `fast_track`

Rationale: Compiler now explicitly rejects localhost HTTP MCP server + network-isolation combination, preventing silent runtime failures. 68+/9−, 5 files. High value correctness fix. No CI yet — needs CI trigger before merge.

Run §28909358158

Generated by 🔧 PR Triage Agent · 112.1 AIC · ⌖ 6.5 AIC · ⊞ 5.4K · ◷

pelikhan · 2026-07-08T01:47:06Z

@lpcox could you strengthen the specification around this kind of scenarios?

gh-aw-bot · 2026-07-08T01:52:07Z

@copilot please run the pr-finisher skill, make this PR merge-ready, address unresolved review feedback, and rerun checks once the branch is up to date.

Generated by 👨‍🍳 PR Sous Chef · 9.99 AIC · ⌖ 9.17 AIC · ⊞ 4.7K · ◷
_{Comment /souschef to run again}

Copilot · 2026-07-08T02:00:57Z

@copilot please run the pr-finisher skill, make this PR merge-ready, address unresolved review feedback, and rerun checks once the branch is up to date.

...

All three review threads have been addressed in commit b90ae95 and replied to. Local validation passes (make fmt, make test-unit). The CI runs show action_required — this is the bot approval gate and needs a maintainer to approve the CI run, not a code fix. Review threads cannot be resolved via API in this environment; a maintainer can resolve them on the PR.

github-actions · 2026-07-08T05:42:46Z

🎉 This pull request is included in a new release.

Release: v0.82.4

Initial plan

200a657

Copilot AI assigned Copilot and pelikhan Jul 7, 2026

Copilot started work on behalf of pelikhan July 7, 2026 20:22 View session

Copilot AI linked an issue Jul 7, 2026 that may be closed by this pull request

[aw-failures] [aw-fix] Reject localhost/--enable-host-access at compile time when network-isolation is on — Daily Fact hard-reds pre-fli [Content truncated due to length] #44111

Closed

Reject loopback MCP URLs in network isolation mode

e725b58

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan marked this pull request as ready for review July 7, 2026 20:41

Copilot AI review requested due to automatic review settings July 7, 2026 20:41

Copilot started reviewing on behalf of pelikhan July 7, 2026 20:42 View session

Copilot AI changed the title ~~[WIP] Fix rejection of localhost at compile time with network isolation~~ Reject loopback HTTP MCP servers in network isolation mode Jul 7, 2026

Copilot AI requested a review from pelikhan July 7, 2026 20:43

Copilot finished work on behalf of pelikhan July 7, 2026 20:43

Copilot AI reviewed Jul 7, 2026

View reviewed changes

github-actions Bot mentioned this pull request Jul 7, 2026

[pr-sous-chef] Run report — 10 nudged, 0 skipped #44120

Closed

Copilot started work on behalf of gh-aw-bot July 7, 2026 21:29 View session

github-actions Bot mentioned this pull request Jul 7, 2026

[Contribution Check Report] Contribution Check — 2026-07-07 #43904

Closed

This comment has been minimized.

Sign in to view

Remove incorrect loopback validation; fix mempalace server binding to…

b90ae95

… 0.0.0.0 Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot July 7, 2026 21:49

Copilot AI requested a review from gh-aw-bot July 7, 2026 21:49

github-actions Bot mentioned this pull request Jul 7, 2026

[pr-sous-chef] Run report — 0 nudged, 10 skipped #44123

Closed

github-actions Bot mentioned this pull request Jul 7, 2026

[pr-sous-chef] Run report — 10 nudged, 0 skipped #44125

Closed

Copilot started work on behalf of gh-aw-bot July 7, 2026 22:28 View session

Copilot finished work on behalf of gh-aw-bot July 7, 2026 22:40

github-actions Bot mentioned this pull request Jul 7, 2026

[pr-sous-chef] Run report — 8 nudged, 2 skipped #44130

Closed

github-actions Bot mentioned this pull request Jul 7, 2026

[pr-sous-chef] Run report — 0 nudged, 10 processed #44132

Closed

github-actions Bot added pr-action:fast_track pr-agent:copilot pr-priority:high pr-risk:medium pr-type:bug labels Jul 8, 2026

github-actions Bot mentioned this pull request Jul 8, 2026

[PR Triage Report] 🤖 PR Triage Report — 2026-07-08 (Run §28909358158) #44147

Closed

6 tasks

github-actions Bot mentioned this pull request Jul 8, 2026

[pr-sous-chef] Run report — 7 nudged, 1 skipped #44150

Closed

Copilot started work on behalf of gh-aw-bot July 8, 2026 01:52 View session

lpcox mentioned this pull request Jul 8, 2026

Strengthen the MCP server configuration specification for stdin/stdio transport and localhost network isolation scenarios github/gh-aw-firewall#6004

Closed

Copilot finished work on behalf of gh-aw-bot July 8, 2026 02:01

pelikhan merged commit 96d2572 into main Jul 8, 2026
31 checks passed

pelikhan deleted the copilot/aw-failures-fix-localhost-access branch July 8, 2026 02:09

Copilot AI mentioned this pull request Jul 8, 2026

Clarify MCP localhost rewrite, transport semantics, and reachability under network isolation github/gh-aw-firewall#6005

Merged

		"localhost HTTP MCP servers are incompatible with sandbox.agent.sudo: false because AWF auto-enables host access for loopback URLs, and host access cannot be combined with network isolation",
		"Replace localhost with host.docker.internal (for example, `http://host.docker.internal:8765/mcp`) or disable network isolation:\n\nsandbox:\n agent:\n sudo: true",

Uh oh!

Conversation

Copilot AI commented Jul 7, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Copilot AI Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

gh-aw-bot commented Jul 7, 2026

Uh oh!

This comment has been minimized.

This comment has been minimized.

github-actions Bot commented Jul 7, 2026

Uh oh!

Copilot AI commented Jul 7, 2026

Uh oh!

gh-aw-bot commented Jul 7, 2026

Uh oh!

github-actions Bot commented Jul 8, 2026

🤖 PR Triage

Uh oh!

pelikhan commented Jul 8, 2026

Uh oh!

gh-aw-bot commented Jul 8, 2026

Uh oh!

Copilot AI commented Jul 8, 2026

Uh oh!

Uh oh!

github-actions Bot commented Jul 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Jul 7, 2026 •

edited by github-actions Bot

Loading