Hmbown/CodeWhale · error · anyhow::Error

MCP server '{name}' connection to '{host}' blocked by networ

Error message

MCP server '{name}' connection to '{host}' blocked by network policy

What it means

connect_with_policy consults the per-domain NetworkPolicyDecider for every HTTP/SSE MCP server before building the client; stdio subprocesses are not gated (crates/tui/src/mcp.rs:1485-1498). Decision::Deny - the host was explicitly denied via /network deny <host> or config policy - aborts the connection with this message before any network I/O happens.

Source

Thrown at crates/tui/src/mcp.rs:1495

        // return; a successful connection transfers the task into `Self`.
        let authority_watch = config.reviewed_plugin.clone().map(|source| {
            PendingAuthorityWatch::start(
                source,
                cancel_token.clone(),
                Arc::clone(&authority_revocation_reason),
            )
        });
        let transport: Box<dyn McpTransport> = if let Some(url) = &config.url {
            // Per-domain network policy gate (#135). Only the HTTP/SSE transport
            // is gated; STDIO MCP servers run as local subprocesses and never
            // touch the network from this code path.
            if let Some(decider) = network_policy
                && let Some(host) = host_from_url(url)
            {
                match decider.evaluate(&host, "mcp") {
                    Decision::Allow => {}
                    Decision::Deny => {
                        anyhow::bail!(
                            "MCP server '{name}' connection to '{host}' blocked by network policy"
                        );
                    }
                    Decision::Prompt => {
                        anyhow::bail!(
                            "MCP server '{name}' connection to '{host}' requires approval; \
                             re-run after `/network allow {host}` or set network.default = \"allow\" in config"
                        );
                    }
                }
            }
            // Honor the standard `HTTP_PROXY` / `HTTPS_PROXY` (and their
            // lowercase equivalents) plus `NO_PROXY` env vars when
            // reaching MCP HTTP servers (#1408). Reqwest 0.13 does not
            // auto-detect these by default, so users behind corporate
            // proxies, on China-mainland connections routing through a
            // local Clash / Shadowsocks tunnel, etc. previously had MCP
            // HTTP traffic bypass the proxy entirely while every other

View on GitHub (pinned to 8880682c63)

Solutions

1. If the host is actually trusted, remove the deny: /network remove <host> (or delete the deny rule in the network policy config).
2. Re-point the MCP server at an allowed host.
3. If the block is intentional, remove or disable this MCP server entry instead of the deny rule.

// Pre-flight the same gate connect_with_policy applies (mcp.rs:1489-1505).
use crate::network_policy::{host_from_url, Decision};

fn mcp_host_allowed(policy: &NetworkPolicyDecider, url: &str) -> bool {
    match host_from_url(url) {
        Some(host) => policy.evaluate(&host, "mcp") == Decision::Allow,
        None => false,
    }
}

When it happens

Trigger: The config.url host matches a deny entry created earlier by /network deny, or a deny rule in the network policy configuration; decider.evaluate(host, "mcp") returns Deny.

Common situations: Policy-hardened machines; a host denied for a different tool earlier (the policy is per-host and cross-tool); explicit exfiltration controls in enterprise setups.

Related errors

• MCP server '{name}' connection to '{host}' requires approval
• Refusing insecure base URL '{display_base_url}'. Loopback h
• MCP config path cannot contain '..' components
• reviewed plugin stage could not be opened for launch
• reviewed plugin stdio cwd escaped its staged root

AI-assisted analysis of Hmbown/CodeWhale@8880682c63 (2026-08-16). Data as JSON: /api/errors/37306c2fa5083ee2. Report an issue: GitHub.