{"record":{"id":"37306c2fa5083ee2","repo":"Hmbown/CodeWhale","slug":"mcp-server-name-connection-to-host-blocked","errorCode":null,"errorMessage":"MCP server '{name}' connection to '{host}' blocked by network policy","messagePattern":"MCP server '(.+?)' connection to '(.+?)' blocked by network policy","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tui/src/mcp.rs","lineNumber":1693,"sourceCode":"        // return; a successful connection transfers the task into `Self`.\n        let authority_watch = config.reviewed_plugin.clone().map(|source| {\n            PendingAuthorityWatch::start(\n                source,\n                cancel_token.clone(),\n                Arc::clone(&authority_revocation_reason),\n            )\n        });\n        let transport: Box<dyn McpTransport> = if let Some(url) = &config.url {\n            // Per-domain network policy gate (#135). Only the HTTP/SSE transport\n            // is gated; STDIO MCP servers run as local subprocesses and never\n            // touch the network from this code path.\n            if let Some(decider) = network_policy\n                && let Some(host) = host_from_url(url)\n            {\n                match decider.evaluate(&host, \"mcp\") {\n                    Decision::Allow => {}\n                    Decision::Deny => {\n                        anyhow::bail!(\n                            \"MCP server '{name}' connection to '{host}' blocked by network policy\"\n                        );\n                    }\n                    Decision::Prompt => {\n                        anyhow::bail!(\n                            \"MCP server '{name}' connection to '{host}' requires approval; \\\n                             re-run after `/network allow {host}` or set network.default = \\\"allow\\\" in config\"\n                        );\n                    }\n                }\n            }\n            let client = http_client::McpHttpClient::new(\n                url,\n                config.runtime_added,\n                config.reviewed_plugin.is_some(),\n                config.allow_private_network,\n                network_policy,\n                Duration::from_secs(connect_timeout_secs),","sourceCodeStart":1675,"sourceCodeEnd":1711,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/73e0f67d83c59909b571efdfc88c4bc28c309cb1/crates/tui/src/mcp.rs#L1675-L1711","documentation":"Before connecting to a remote MCP server, the configured network policy decider evaluates the target host for the 'mcp' purpose. A Decision::Deny causes an immediate bail naming the server and host. This is a hard, intentional block — no connection attempt is made.","triggerScenarios":"Starting or connecting an MCP server whose url host is explicitly denied by the network policy (network.allowlist/denylist or an interactive policy decider returning Deny).","commonSituations":"Corporate denylists blocking an internal host; a host matching a deny rule like *.internal.example.com; pointing an MCP server at an unexpected domain after a config edit.","solutions":["Check your network policy configuration and add the host to the allowlist if it is trusted","Use `/network allow <host>` in the TUI if the policy supports interactive grants","Remove or correct the MCP server config if the host should not be contacted"],"exampleFix":"// before (config)\n[network]\ndefault = \"deny\"\n// after (allow the host)\n[network]\ndefault = \"deny\"\nallow = [\"mcp.example.com\"]","handlingStrategy":"validation","validationCode":"let host = url::Url::parse(&cfg.url)?.host_str().ok_or(\"no host\")?.to_string();\nif network_policy_for(\"mcp\").evaluate(&host) == Decision::Deny {\n    // skip or fix config before attempting connection\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep network allow/deny lists in sync with the MCP servers you use","Check policy before adding a new remote server config","Document which hosts your MCP servers need"],"tags":["mcp","network-policy","blocked"],"backgroundTag":"permission-denied","analyzedSha":"73e0f67d83c59909b571efdfc88c4bc28c309cb1","analyzedAt":"2026-09-22T01:30:00.501Z","contentChangedAt":"2026-09-22T01:30:00.501Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}