fix(security): refresh MCP runtime audit locks

[jyaunches]

Summary

Updates the locked Model Context Protocol (MCP) tool-discovery runtime so sandbox image builds pass the unchanged production audit.
The reviewed dependency releases are outside the reported advisory ranges.
The final correction updates regression coverage and dependency-review text without changing production proxy behavior.
The proxy-test correction is included because the stale fixture prevented the CLI shard from validating the dependency update.

Related Issue

Fixes #8177

Changes

• Pin @hono/node-server@2.0.12, fast-uri@3.1.5, hono@4.12.34, and ip-address@10.3.1.
• Bind package versions, registry URLs, SHA-512 integrities, and review records in the committed lock and regression test.
• Preserve @modelcontextprotocol/sdk@1.30.0 and the existing npm audit --omit=dev --audit-level=low requirement.
• Record package licenses, registry signatures, provenance attestations, advisory ranges, and source-review evidence.
• Test Undici 8.10 plain HTTP proxy forwarding through the request method, host, and full target URL.
• For the plain HTTP fixture, return HTTP 502 on CONNECT so tunneling fails.
• Record that NemoClaw-managed image registry requests use HTTPS and continue to use CONNECT.
• Update tools/mcp-tool-discovery-runtime/dependency-review.md and docs/security/openclaw-2026.7.1-dependency-review.md.
• Leave production proxy source and configuration unchanged.

PR #8172 overlaps this dependency graph but also changes audit policy and remains a separate sequencing decision.
PR #8175 overlaps the advisory remediation but does not bind the reviewed graph and audit command in the image contract.
No work was transferred between these branches.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: No public API, CLI, configuration, workflow, default, or supported behavior changes. The existing security and runtime dependency reviews now record the dependency and transport evidence.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: The nine-category security review for commit 90b95be3af1856d0d59cc34581dd6cb94571ee61 returned PASS in every category. No security findings remain.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: Reviewed all seven changed files in commit 90b95be3af1856d0d59cc34581dd6cb94571ee61 against base 6a838ffc. Its tree 39e3f5f8c74cee608e56e4fea82677b6663e07a4 matches the previously reviewed tree. The security page accurately documents Undici 8.10 plain HTTP proxy forwarding and unchanged HTTPS CONNECT behavior. The runtime review records the four pinned dependencies, integrity values, licenses, provenance, advisory ranges, and unchanged audit commands. Tests bind those records and proxy behavior to observable assertions. No public API, CLI, configuration, or supported workflow changed. The changed documentation paths are docs/security/openclaw-2026.7.1-dependency-review.md and tools/mcp-tool-discovery-runtime/dependency-review.md.
• Agent: Codex Desktop, independent documentation-writer subagent

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: Not applicable
• Station profile/scenario: Not applicable
• Result: Not applicable
• Supporting evidence: Not applicable

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub — All 15 commits are verified, and the DCO check passed for commit 90b95be3af1856d0d59cc34581dd6cb94571ee61.
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable — All normal hooks passed for the final correction.
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — GitHub CI is authoritative for commit 90b95be3af1856d0d59cc34581dd6cb94571ee61. All eight CLI shards passed, including the proxy regression, and the reviewed production audit passed. No duplicate local test suite was run after the final correction.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: The required checks result and E2E gate passed on commit 90b95be3af1856d0d59cc34581dd6cb94571ee61. GitHub CI is authoritative; no duplicate local suite was run for the final correction.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only) — The GitHub Fern preview prepared and validated the documentation on commit 90b95be3af1856d0d59cc34581dd6cb94571ee61.
• Doc pages follow the style guide (doc changes only) — Independent writing review and the normal Markdown hook passed.
• New doc pages include SPDX header and frontmatter (new pages only) — Not applicable; no page was added.

Security Review

Commit 90b95be3af1856d0d59cc34581dd6cb94571ee61 has no security findings.

Category	Verdict	Evidence
Secrets and Credentials	PASS	No credentials, credential-bearing values, or credential paths changed.
Input Validation and Data Sanitization	PASS	The image contract rejects drift in package identity, version, registry URL, integrity, review record, and audit commands.
Authentication and Authorization	PASS	No authentication or authorization behavior changed.
Dependencies and Third-Party Libraries	PASS	The reviewed pins are outside the reported advisory ranges. The SDK, @hono/node-server, hono, and ip-address use MIT licenses. fast-uri uses BSD-3-Clause.
Error Handling and Logging	PASS	Production error and logging behavior is unchanged. The test returns HTTP 502 for an unexpected CONNECT request.
Cryptography and Data Protection	PASS	The committed lock retains SHA-512 package integrity values. Registry verification reported 98 signatures and 12 provenance attestations.
Configuration and Security Headers	PASS	The low-severity production audit and proxy configuration remain unchanged. No ports, permissions, users, or headers changed.
Security Testing	PASS	The image contract binds the reviewed graph and audit commands. The proxy regression verifies Undici 8.10 plain HTTP forwarding.
System Security	PASS	The change does not alter image privileges, sandbox controls, or network policy.

---

Signed-off-by: Julie Yaunches jyaunches@nvidia.com
Signed-off-by: Prekshi Vyas prekshiv@nvidia.com
Signed-off-by: Carlos Villela cvillela@nvidia.com

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The MCP tool discovery runtime now pins reviewed dependency versions, documents the security refresh, and adds contract coverage for the fail-closed production audit. The managed image registry proxy test now validates a successful proxied response.

Changes

MCP runtime security refresh

Layer / File(s)	Summary
Runtime overrides and security review tools/mcp-tool-discovery-runtime/package.json, tools/mcp-tool-discovery-runtime/dependency-review.md	The runtime pins @hono/node-server@2.0.12, fast-uri@3.1.5, hono@4.12.34, and ip-address@10.3.1. The review records verification evidence and a clean production audit.
Dependency contract validation test/mcp-tool-discovery-image-contract.test.ts, ci/source-shape-test-budget.json	The contract test validates dependency metadata and the installer audit command. The test receives a security source-shape exception.

Managed image registry proxy test

Layer / File(s)	Summary
Proxy request assertions src/lib/onboard/managed-image-registry-fetch.test.ts	The proxy handler returns a successful 200 response with "proxied". The test verifies the response body and tunnel target.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ContractTest
  participant RuntimeArtifacts
  participant Installer
  participant npm
  ContractTest->>RuntimeArtifacts: Load manifest, lockfile, and security review
  ContractTest->>RuntimeArtifacts: Validate pinned dependency metadata
  ContractTest->>Installer: Verify production audit command
  Installer->>npm: Run low-severity production audit
  npm-->>ContractTest: Return audit result

Loading

Possibly related PRs

• NVIDIA/NemoClaw#8172: Updates overlapping MCP discovery dependency overrides and audit handling.
• NVIDIA/NemoClaw#8175: Shares MCP runtime dependency overrides and security review updates.

Suggested labels: dependencies

Suggested reviewers: apurvvkumaria, ericksoa

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	The proxy transport test change is unrelated to issue #8177's MCP runtime lock and audit objectives.	Move the proxy transport test update to a separate pull request unless the dependency refresh directly requires it.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The PR updates vulnerable runtime versions, preserves the fail-closed audit, and adds deterministic coverage for the reviewed graph and audit boundary.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: refreshing the MCP runtime security audit locks.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-mcp-runtime-audit

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 90b95be in the codex/fix-mcp-runtim... branch remains at 96%, unchanged from commit 6a838ff in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 90b95be in the codex/fix-mcp-runtim... branch remains at 81%, unchanged from commit a7237ea in the main branch.

Show a code coverage summary of the most impacted files.

File	main a7237ea	codex/fix-mcp-runtim... 90b95be	+/-
src/lib/domain/.../connect-env.ts	97%	89%	-8%
src/lib/shields/index.ts	69%	69%	0%
src/lib/cli/oclif-runner.ts	98%	98%	0%
src/lib/messagi...nnels/policy.ts	100%	100%	0%
src/lib/sandbox...rce-identity.ts	88%	88%	0%
src/lib/state/config-io.ts	93%	93%	0%
src/lib/tunnel/services.ts	76%	76%	0%
src/lib/platform.ts	84%	89%	+5%

---

_{Updated August 04, 2026 02:28 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized terminology decisions differ; normalized E2E selections differ; severity counts match.

6 terminology differences from the second opinion

Advisory only. These are normalized differences from the primary terminology receipt.

• proxyTunnel at docs/security/openclaw-2026.7.1-dependency-review.md:174: selected only by the second-opinion lane as established.
• managed image registry at docs/security/openclaw-2026.7.1-dependency-review.md:176: selected only by the second-opinion lane as established.
• fail-closed audit at tools/mcp-tool-discovery-runtime/dependency-review.md:45: selected only by the second-opinion lane as justified.
• bundle-input exclusion at tools/mcp-tool-discovery-runtime/dependency-review.md:43: selected only by the second-opinion lane as define.
• production audit at test/mcp-tool-discovery-image-contract.test.ts:17: selected only by the second-opinion lane as justified.
• MCP-AUDIT at tools/mcp-tool-discovery-runtime/dependency-review.md:42: selected only by the second-opinion lane as established.

2 additional E2E selections from the second opinion

Advisory only. The primary lane did not select these E2E jobs or targets.

• ubuntu-repo-cloud-langchain-deepagents-code: The completed second-opinion lane identified E2E coverage that the primary lane omitted.
• ubuntu-repo-cloud-openclaw: The completed second-opinion lane identified E2E coverage that the primary lane omitted.

Second-opinion terminology and E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate.

3 semantic terminology decisions

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

• justified — absolute-form request target at docs/security/openclaw-2026.7.1-dependency-review.md:174: Retain the term. The adjacent CONNECT contrast defines the modifier and explains the proxy behavior.
• established — installed production graph at tools/mcp-tool-discovery-runtime/dependency-review.md:23: Retain the established term and its contrast with the executable bundle.
• define — security refresh at tools/mcp-tool-discovery-runtime/dependency-review.md:25: Define the term at its first heading as the dated dependency-remediation event, then reuse it consistently in later evidence references.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

tools/mcp-tool-discovery-runtime/dependency-review.md (1)

16-24: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

Strengthen the image contract for the SDK pin and audit boundary.

The contract test does not bind the documented @modelcontextprotocol/sdk integrity. Its audit check also uses toContain, so npm audit ... || true could bypass the fail-closed boundary. Add the SDK metadata and assert the exact non-suppressed audit invocation.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tools/mcp-tool-discovery-runtime/dependency-review.md` around lines 16 - 24,
Strengthen the contract test for the documented `@modelcontextprotocol/sdk` pin by
adding and validating its exact integrity metadata alongside the existing
dependency overrides. Update the audit assertion to require the exact
fail-closed npm audit invocation, including its intended arguments, rather than
using toContain. Ensure the expected command cannot be satisfied when npm audit
is followed by || true or otherwise suppresses failures.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/lib/onboard/managed-image-registry-fetch.test.ts`:
- Around line 58-60: Update the fetch test around session.fetchImpl to assert
response.status is 200 alongside the existing response body assertion, while
preserving the tunnel expectation and avoiding implementation-specific
assertions.

---

Outside diff comments:
In `@tools/mcp-tool-discovery-runtime/dependency-review.md`:
- Around line 16-24: Strengthen the contract test for the documented
`@modelcontextprotocol/sdk` pin by adding and validating its exact integrity
metadata alongside the existing dependency overrides. Update the audit assertion
to require the exact fail-closed npm audit invocation, including its intended
arguments, rather than using toContain. Ensure the expected command cannot be
satisfied when npm audit is followed by || true or otherwise suppresses
failures.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 19bd8713-0325-4255-9f22-73e03c49fc3e

📥 Commits

Reviewing files that changed from the base of the PR and between 7d0c9dc and 0e4135d.

📒 Files selected for processing (4)

• ci/source-shape-test-budget.json
• src/lib/onboard/managed-image-registry-fetch.test.ts
• test/mcp-tool-discovery-image-contract.test.ts
• tools/mcp-tool-discovery-runtime/dependency-review.md

🚧 Files skipped from review as they are similar to previous changes (2)

• test/mcp-tool-discovery-image-contract.test.ts
• ci/source-shape-test-budget.json

[apurvvkumaria]

Reviewed exact head 8397801. Approve: the four overrides advance the exact locked production graph beyond the reported advisory ranges without weakening the low-severity audit, signature, integrity, or bundle allowlist boundaries. The contract now binds the SDK and override metadata and requires the two exact unsuppressed audit commands. The focused image-contract and bounded-proxy suites passed 9 of 9 tests locally, including the restored CONNECT fixture and HTTP status assertion. Current required CI is still rerunning after superseded jobs; the normal merge gate should remain authoritative.

[jyaunches]

Current head 330b13d1c reproduces the managed-image proxy timeout locally:

npm exec -- vitest run src/lib/onboard/managed-image-registry-fetch.test.ts --project cli
Test Files  1 failed (1)
Tests       1 failed | 4 passed (5)
routes the default registry fetch through the bounded host proxy: timed out in 5000ms

For the locked runtime in this checkout, ProxyAgent sends CONNECT registry.invalid:80 even though the target URL is plain HTTP. A request-handler-only fixture never receives that request and deadlocks. The deterministic fixture must handle the server connect event, acknowledge the tunnel, then return the synthetic HTTP response over the socket. That version passes all 5 tests immediately.

Please preserve the CONNECT fixture while the current-head CI run completes; the ordinary forward-proxy handler has now reproduced the same timeout on 3359af23c, b2593b2f9, and 330b13d1c.

[apurvvkumaria]

Re-reviewed exact head 330b13d. The only new delta replaces the CONNECT fixture with the forward-proxy request shape used by the branch-locked Undici 8.10.0 while retaining the response-status, body, and exact destination assertions. With an exact npm ci for this revision, the focused transport suite passes 5 of 5 tests; the dependency, integrity, audit-command, and image-contract changes from the prior approved revision are unchanged. No blocking defect found; current CI remains the normal merge gate.

[apurvvkumaria]

Comment — reviewed exact head cb6f948. The production dependency remediation remains safe, but this latest test-only commit needs a narrow non-blocking correction: after an exact npm ci for this revision (Undici 8.10.0), the focused managed-image registry transport suite deterministically times out at the CONNECT fixture (1 failed, 4 passed). The immediately preceding forward-proxy fixture passed 5 of 5 with the same exact dependencies, showing that this EnvHttpProxyAgent path sends an ordinary absolute-form HTTP proxy request rather than CONNECT for the HTTP registry URL. Please restore that forward-request fixture and retain the status, body, and exact destination assertions. This is explicitly non-blocking review feedback because it does not change supported runtime behavior; the required CI merge gate should enforce the test correction before merge.

[apurvvkumaria]

Re-reviewed exact head 1058aa9. The prior non-blocking proxy-fixture failure is resolved: the fixture now handles both ordinary forward requests and CONNECT while still proving exactly one bounded proxy route, a 200 response, the expected body, and an exact allowed destination. With this revision’s exact Undici 8.10 dependency set, the focused transport suite passes 5 of 5 tests. The reviewed dependency, integrity, signature, audit, and image-contract boundaries are unchanged. Approve; no blocking defect found.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-8180.docs.buildwithfern.com/nemoclaw