fix: default deny piece mcp servers

[j5ik2o]

Summary

• make all piece-level MCP transports default-deny
• require explicit project/global opt-in for stdio, http, and sse
• keep the underlying MCP transport support intact for trusted configurations

Why this draft exists

This is the stricter and more consistent version of the piece-level MCP policy.

A piece can attach MCP servers directly into the AI execution context. For stdio, that means spawning a local process. For http and sse, that means connecting to a local or remote endpoint that can still inject arbitrary tool definitions into the agent session.

That makes all three transports part of the same untrusted-piece problem.

Why all transports default to false

http and sse are not safe by default just because they do not spawn a local process.

A malicious piece can point at an attacker-controlled remote endpoint and inject tools into the agent context, or it can target localhost services that the operator already has running. From the AI's perspective, the blast radius is still tool injection.

So this draft uses a consistent default:

• stdio: false
• http: false
• sse: false

What this draft changes

Piece YAML MCP servers are rejected by default for every transport.
Operators can explicitly allow transports in trusted project/global config, for example:

piece_mcp_servers:
  http: true
  sse: true

or:

piece_mcp_servers:
  stdio: true

What can go wrong without this fix

Without this change, an untrusted piece can inject MCP-backed tools into the AI runtime, either by spawning local stdio servers or by connecting to local/remote endpoints. That can expand the model's effective tool surface and lead to unintended command execution, data access, or integration abuse.

Alternatives

• Weaker option: keep http/sse enabled by default and only block stdio
• Middle ground rejected here: treat remote transports as safer even though they can still inject tools
• This PR: default-deny all transports, allow explicit opt-in through trusted config

Testing

• npm run build
• npm test -- --run src/__tests__/models.test.ts src/__tests__/projectConfig.test.ts src/__tests__/it-piece-loader.test.ts

Tag

• #14_Untrusted pieces can launch arbitrary MCP server commands.txt