Repository navigation
Conversation
…ions, audit log, kill switch Add a SafetyGate FastMCP middleware (src/windows_mcp/safety/) that runs before the desktop-control gate on every tool call. All protections are enabled by default and configured under [safety.*] in config.toml: - App/process allowlist for input tools (window under each point or foreground window), App launch/switch/resize and Process kill; unknown targets fail closed. - PowerShell disabled by default; "allowlist" mode accepts a single listed cmdlet and rejects chaining, substitution, redirection, quoting and encoded/nested commands. - Native MessageBoxTimeoutW confirmation (default No, timeout = deny) before process kill, closing/deleting shortcuts, FileSystem delete/move/overwrite, Registry set/delete, installer launches, UAC targets and risky cmdlets. - JSONL audit log of every call and decision, with redaction and optional screenshot. - Kill switch via flag file or latching global hotkey. - HTTP/SSE transports require a bearer token (server.require_auth) and refuse non-loopback binds unless server.allow_remote_bind is set. write_config now round-trips the [safety] section. Windows calls are isolated in safety/win32.py; unit tests use a fake platform and run on Linux. Docs: docs/safety.md.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
src/windows_mcp/safety/, a FastMCP middleware (SafetyGate) that runs before the desktop-control gate on every tool call, configured under[safety.*]inconfig.toml. Documented indocs/safety.md.allowlistmode accepts one listed cmdlet and rejects chaining, substitution, redirection and encoded commands.write_configround-trips[safety]; existing tests are adjusted to the new defaults.Motivation
The server drives the real desktop on behalf of an AI agent. Today nothing stops a prompt-injected agent from killing processes, deleting files or running arbitrary PowerShell. This PR adds guard rails that a user can relax, instead of none.
Note for reviewers
This changes defaults (PowerShell disabled, allowlist enforced, auth required on HTTP). If you prefer, the defaults can be flipped to opt-in in a follow-up without changing the code structure. Windows calls are isolated in
safety/win32.py, so the logic is unit-tested on Linux with a fake platform.First PR of a stacked safety series (1 -> 2 -> 3 -> 4); the follow-ups depend on this one.
Testing
Testing: Linux run with Windows-only modules stubbed (pytest, Python 3.14). New tests test_safety_config/gate/policy/powershell pass (+95 tests). No new failures or collection errors compared with upstream main 7fd39b4 (on main the Linux harness has 6 known failures and 75 modules that cannot be collected without Windows). Also tested on a real Windows 11 desktop (LegionVins) with the Windows-only test modules and manual end-to-end runs.