vibehacker
Discuss
Kai
1 month ago

nightfall silently allowed my filesystem MCP after a policy rename

#mcp#agents#tooling
Nightfall MCP Gateway
Govern Cursor and Claude Code MCP tool calls

spent 40 minutes yesterday convinced Claude Code was ignoring the Nightfall MCP gateway. turns out the allowlist still had fs-tools while i'd renamed the server to local-fs in .mcp.json.

on Mac, Cursor and Claude Code both showed the tools as "connected". gateway dashboard was green. the deny path never fired because the old name wasn't in the deny list either — it just... matched nothing and fell through.

only caught it when the agent wrote to ~/Downloads/tmp-patch.sh and my audit log had a blank policy_id. if you're renaming MCP servers, grep the gateway config too. silent miss is worse than a loud 403.

6

6 comments

Join the discussion

Log in to comment.

Log in
  • Freja Lindqvistpro

    blank policy_id is the smell. we treat that as a pageable condition now — if the gateway cannot attach a rule, the call should fail closed, not "look connected".

    our scrape on the audit table alerts when policy_id IS NULL for more than ~2 minutes. renamed three MCP servers last month and hit the same fall-through. loud 403 would have saved your Downloads write.

    • Felix

      same class of bug on Cursor for me — renamed pnpm-mcp → pkg-mcp, gateway still green, agent happily ran pnpm add outside the allowlist for 12 minutes before i noticed the lockfile diff.

      fail-closed on missing policy_id is the right default. "connected" badge without a matched rule is theater.

      • Diego Fernández

        ugh same energy here. renamed calendar-mcp → cal-tools in Cursor last tuesday night (BA time, bad idea) and the badge stayed green while the agent booked two real Zoom rooms outside the allowlist.

        did the gateway ever surface a "no policy matched" event for you, or only the blank policy_id after the fact? i still only see it in the audit dump.

  • Noah Kim

    blank policy_id on an allow is worse than a deny miss. if the gateway can't bind a rule, that call should 403 and page someone — "connected" with no matched policy is just a silent bypass flag with a green badge.

    we started asserting policy_id IS NOT NULL in the audit exporter. caught two rename fall-throughs in a week. time-boxed override > permanent fail-open every time.

    • Cass

      wait — you assert that in the exporter or on the gateway itself? i only catch blank policy_id in a nightly dump, which is how i found a rename fall-through after the agent already wrote to ~/Downloads.

      curious if anyone pages on policy_id IS NULL in near-real-time or if we're all grepping after the fact

  • Joao Volkov

    Blank policy_id on an allow is a control-plane failure mode, not a UX quirk. If the gateway cannot bind a rule, the call should fail closed and emit a distinct event — not stay green.

    We assert policy_id IS NOT NULL in the audit exporter too. Renames that leave the old name only on the deny list are how you get silent write paths. Fail-open with a green badge is worse than a loud 403 mid-demo.

More like this

View all