{"record":{"id":"6d7e30e61adb8942","repo":"Hmbown/CodeWhale","slug":"mcp-server-name-connection-to-host-require","errorCode":null,"errorMessage":"MCP server '{name}' connection to '{host}' requires approval; re-run after `/network allow {host}` or set network.default = \"allow\" in config","messagePattern":"MCP server '(.+?)' connection to '(.+?)' requires approval; re-run after `/network allow (.+?)` or set network\\.default = \"allow\" in config","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tui/src/mcp.rs","lineNumber":1698,"sourceCode":"                Arc::clone(&authority_revocation_reason),\n            )\n        });\n        let transport: Box<dyn McpTransport> = if let Some(url) = &config.url {\n            // Per-domain network policy gate (#135). Only the HTTP/SSE transport\n            // is gated; STDIO MCP servers run as local subprocesses and never\n            // touch the network from this code path.\n            if let Some(decider) = network_policy\n                && let Some(host) = host_from_url(url)\n            {\n                match decider.evaluate(&host, \"mcp\") {\n                    Decision::Allow => {}\n                    Decision::Deny => {\n                        anyhow::bail!(\n                            \"MCP server '{name}' connection to '{host}' blocked by network policy\"\n                        );\n                    }\n                    Decision::Prompt => {\n                        anyhow::bail!(\n                            \"MCP server '{name}' connection to '{host}' requires approval; \\\n                             re-run after `/network allow {host}` or set network.default = \\\"allow\\\" in config\"\n                        );\n                    }\n                }\n            }\n            let client = http_client::McpHttpClient::new(\n                url,\n                config.runtime_added,\n                config.reviewed_plugin.is_some(),\n                config.allow_private_network,\n                network_policy,\n                Duration::from_secs(connect_timeout_secs),\n                Duration::from_secs(read_timeout_secs),\n            )?;\n            let oauth_runtime = if config.reviewed_plugin.is_some() {\n                None\n            } else {","sourceCodeStart":1680,"sourceCodeEnd":1716,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/73e0f67d83c59909b571efdfc88c4bc28c309cb1/crates/tui/src/mcp.rs#L1680-L1716","documentation":"When the network policy returns Decision::Prompt for an MCP server's host and no interactive approval can be granted (or the session cannot prompt), the client bails with instructions: allow the host via `/network allow {host}` or set network.default = \"allow\". Nothing was connected; the error is an approval gate.","triggerScenarios":"Connecting an MCP server whose host is not explicitly allowed while the policy default requires per-host approval (network.default is not \"allow\" and no standing rule covers the host).","commonSituations":"First connection to a brand-new MCP server under a default-deny/prompt policy; running non-interactively (CI, scripted sessions) where a prompt cannot be answered; config copied to a machine with stricter network defaults.","solutions":["Run `/network allow <host>` for the host named in the error, then retry","Set `network.default = \"allow\"` in config if you trust all hosts","Add an explicit allow rule for the host in the network config","Pre-approve hosts when running in CI so no interactive prompt is needed"],"exampleFix":"// before (config)\n[network]\ndefault = \"prompt\"\n// after\n[network]\ndefault = \"allow\"\n# or keep prompt and add: allow = [\"mcp.example.com\"]","handlingStrategy":"fallback","validationCode":"let host = url::Url::parse(&cfg.url)?.host_str().unwrap_or_default();\nlet approved = allowed_hosts.contains(host) || cfg.network.default == \"allow\";\nif !approved { /* pre-run `/network allow <host>` or adjust config */ }","typeGuard":null,"tryCatchPattern":"match err {\n    e if e.to_string().contains(\"requires approval\") => {\n        // surface host to user / retry after `/network allow <host>`\n    }\n    e => return Err(e),\n}","preventionTips":["Pre-approve MCP hosts in config for CI/non-interactive runs","Keep an allowlist of trusted MCP hosts","Set network.default explicitly rather than relying on defaults"],"tags":["mcp","network-policy","approval"],"backgroundTag":"permission-denied","analyzedSha":"73e0f67d83c59909b571efdfc88c4bc28c309cb1","analyzedAt":"2026-09-22T01:30:00.501Z","contentChangedAt":"2026-09-22T01:30:00.501Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}