anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 18:25:32 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Task should inherit current agent permissions/tools for MCP #2519

New Issue
Open
opened 2026-02-16 17:36:05 -05:00 by yindo · 1 comment
yindo commented 2026-02-16 17:36:05 -05:00
Owner
Copy Link
Copy Source

Originally created by @nikaro on GitHub (Nov 3, 2025).

Originally assigned to: @thdxr on GitHub.

Description

I've created an "offline" agent to limit the risk of leaking sensitive data via prompt inject when working on untrusted data.

  "agent": {
    "offline": {
      "permission": {
        "bash": {
          "*": "ask",
        },
        "edit": "ask",
        "webfetch": "deny",
      },
      "tools": {
        "context7_*": false,
        "gh_grep_*": false,
        "kagi_*": false,
        "webfetch": false,
      },
    },
  },

But the agent can easily circumvent the tools limitations by delegating the task to a sub-agent. And it does not even ask for permission to run the tool. This can be solved by disabling the task tool. But it would be better if by default tasks were using the same agent with the same permissions/tools.

PS: it seems to work fine for native tools like webfetch (not sure about this, sometimes it hangs sometimes it rightfully fails).

OpenCode version

1.0.15

Steps to reproduce

  1. Create an agent "offline" with webfetch and mcp with online access disabled (ex: kagi)
  2. Using the "offline" ask it to search online for whatever information
  3. It will delegate a task and use mcp tool like kagi

Screenshot and/or share link

No response

Operating System

macOS 26.0.1

Terminal

Ghostty

Originally created by @nikaro on GitHub (Nov 3, 2025). Originally assigned to: @thdxr on GitHub. ### Description I've created an "offline" agent to limit the risk of leaking sensitive data via prompt inject when working on untrusted data. ```json "agent": { "offline": { "permission": { "bash": { "*": "ask", }, "edit": "ask", "webfetch": "deny", }, "tools": { "context7_*": false, "gh_grep_*": false, "kagi_*": false, "webfetch": false, }, }, }, ``` But the agent can easily circumvent the tools limitations by delegating the task to a sub-agent. And it does not even ask for permission to run the tool. This can be solved by disabling the `task` tool. But it would be better if by default tasks were using the same agent with the same permissions/tools. PS: it seems to work fine for native tools like `webfetch` (not sure about this, sometimes it hangs sometimes it rightfully fails). ### OpenCode version 1.0.15 ### Steps to reproduce 1. Create an agent "offline" with `webfetch` and mcp with online access disabled (ex: kagi) 2. Using the "offline" ask it to search online for whatever information 3. It will delegate a task and use mcp tool like kagi ### Screenshot and/or share link _No response_ ### Operating System macOS 26.0.1 ### Terminal Ghostty
yindo added the opentuibug labels 2026-02-16 17:36:05 -05:00
yindo commented 2026-02-16 17:36:05 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Nov 3, 2025):

This issue might be a duplicate of existing issues. Please check:

  • #3756: MCP tool blocking not working - agents can still see and access disabled tools - This issue describes the exact same problem where agents can circumvent tool restrictions, and MCP tools set to false are still visible and accessible to agents.
  • #2588: Feature request: let subagents inherit context - Related to subagent inheritance behavior
  • #3756 specifically mentions that "MCP tools are visible to the model even when disabled" which is the same core issue you're experiencing with task delegation bypassing restrictions.

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Nov 3, 2025): This issue might be a duplicate of existing issues. Please check: - #3756: MCP tool blocking not working - agents can still see and access disabled tools - This issue describes the exact same problem where agents can circumvent tool restrictions, and MCP tools set to `false` are still visible and accessible to agents. - #2588: Feature request: let subagents inherit context - Related to subagent inheritance behavior - #3756 specifically mentions that "MCP tools are visible to the model even when disabled" which is the same core issue you're experiencing with task delegation bypassing restrictions. Feel free to ignore if none of these address your specific case.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug opentui
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#2519
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?