Problem
Per-request harness_config uses a 2-field blocklist and accepts any LocalAgentConfig field, including mcp_servers. That lets a client inject an MCP stdio command that the SDK spawns at agent start (pre-model, bypasses run_command policy) → arbitrary code execution. Default ax serve has no auth, so this is pre-auth from the network.
Follow-up to #301 / gap left in #194.
Proposed fix
Allowlist only safe per-request fields (model, system_instructions, response_schema, session_continuation_mode); reject the rest.
Branch: https://github.com/qerogram/ax/tree/fix/harness-config-overlay-allowlist
Diff: main...qerogram:ax:fix/harness-config-overlay-allowlist
make test + make test-python (56 passed) on that branch.
Auth/TLS and other harnesses are out of scope for this change.
Problem
Per-request
harness_configuses a 2-field blocklist and accepts anyLocalAgentConfigfield, includingmcp_servers. That lets a client inject an MCP stdiocommandthat the SDK spawns at agent start (pre-model, bypassesrun_commandpolicy) → arbitrary code execution. Defaultax servehas no auth, so this is pre-auth from the network.Follow-up to #301 / gap left in #194.
Proposed fix
Allowlist only safe per-request fields (
model,system_instructions,response_schema,session_continuation_mode); reject the rest.Branch: https://github.com/qerogram/ax/tree/fix/harness-config-overlay-allowlist
Diff: main...qerogram:ax:fix/harness-config-overlay-allowlist
make test+make test-python(56 passed) on that branch.Auth/TLS and other harnesses are out of scope for this change.