[FEATURE]: Empty worker mcp_filter grants access to all MCP tools #378

Summary

Worker MCP access currently has two opposite meanings depending on whether mcp_filter contains any entries:

A non-empty mcp_filter acts as an allowlist. The worker receives only matching MCP tools.
An empty or omitted mcp_filter grants the worker access to every available MCP tool.

This creates a dangerous authorization boundary where removing the final allowlist entry (or failing to generate one) expands a worker’s permissions from limited access to unrestricted access.

This is especially risky for onboarding and MCP installation workflows. Connecting a new MCP server at the global level may unintentionally expose it to workers whose filters were omitted or left empty.

Example

# Limited to matching tools
[orchestration.worker.log-analyst]
mcp_filter = ["logs_*"]

# Receives every MCP tool
[orchestration.worker.writer]
mcp_filter = []

# Also receives every MCP tool
[orchestration.worker.researcher]
# mcp_filter omitted

The transition from ["logs_*"] to [] widens access rather than removing it.

###Security impact

A configuration omission or apparently restrictive edit can increase a worker’s privileges without an explicit allow-all declaration. This violates least-privilege expectations and makes accidental MCP tool exposure likely as configurations and available integrations change.

Additional Context

No response

Upload screenshots

No response

Searched Issues

• No similar issues found

Code of Conduct

• I agree to follow this project's Code of Conduct