{"record":{"id":"c7c69acecd0ae32f","repo":"openai/codex","slug":"mcp-http-headers-helper-containment-failed-error","errorCode":null,"errorMessage":"MCP HTTP headers helper containment failed: {error}","messagePattern":"MCP HTTP headers helper containment failed: (.+?)","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"codex-rs/rmcp-client/src/http_headers.rs","lineNumber":301,"sourceCode":"    }\n    #[cfg(not(windows))]\n    process.args([\"-c\", command]);\n    #[cfg(unix)]\n    process.process_group(0);\n    process\n        .stdin(Stdio::null())\n        .stdout(Stdio::piped())\n        .stderr(Stdio::null())\n        .current_dir(cwd)\n        // Match local MCP subprocess policy; arbitrary ambient variables are not inherited.\n        .env_clear()\n        .envs(create_env_for_mcp_server(/*extra_env*/ None, &[])?)\n        .kill_on_drop(true);\n\n    #[cfg(windows)]\n    let (child, job) = {\n        let job = codex_utils_pty::JobObject::create_without_breakaway()\n            .map_err(|error| anyhow!(\"MCP HTTP headers helper containment failed: {error}\"))?;\n        let child = job\n            .spawn_contained(&mut process)\n            .map_err(|error| anyhow!(\"MCP HTTP headers helper failed to start: {error}\"))?;\n        (child, job)\n    };\n    #[cfg(not(windows))]\n    let child = process\n        .spawn()\n        .map_err(|error| anyhow!(\"MCP HTTP headers helper failed to start: {error}\"))?;\n    let mut process = HelperProcess {\n        #[cfg(unix)]\n        process_group_id: child\n            .id()\n            .ok_or_else(|| anyhow!(\"MCP HTTP headers helper process id was unavailable\"))?,\n        child,\n        #[cfg(windows)]\n        job,\n    };","sourceCodeStart":283,"sourceCodeEnd":319,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/rmcp-client/src/http_headers.rs#L283-L319","documentation":"On Windows, the MCP HTTP headers helper (a shell command that prints auth headers as JSON) is spawned inside a Job Object created with create_without_breakaway so it cannot escape containment. If Windows refuses to create the Job Object, setup aborts before the command even runs, and this error wraps the underlying OS failure. It is an OS-level containment problem, not a problem with the configured helper command.","triggerScenarios":"Configuring an MCP HTTP server with a headers-helper command on Windows when CreateJobObject fails — kernel object/handle exhaustion, an existing job that denies child job creation without breakaway, or a hardened/sandboxed host restricting job objects.","commonSituations":"CI runners or restricted Windows hosts with job-object limits; processes already nested inside breakaway-denying jobs; handle leaks from long-running orchestrators exhausting the object table.","solutions":["Run the orchestrator outside the restricted job/sandbox that denies Job Object creation","Check and reduce process/handle counts (Task Manager, Sysinternals) if exhaustion is suspected","Reproduce with a minimal CreateJobObject call on the same host to confirm the OS restriction","If self-hosting in containers, use a Windows host configuration that permits job objects"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":"fn is_containment_failure(error: &anyhow::Error) -> bool {\n    error.to_string().contains(\"containment failed\")\n}","tryCatchPattern":"if let Err(error) = connect_mcp_with_headers_helper(&config).await {\n    if error.to_string().contains(\"containment failed\") {\n        // Windows job-object restriction on this host: rerun outside the\n        // restricted job/sandbox; not a config bug\n        return Err(error.context(\"host restricts Job Objects; use an unrestricted Windows host\"));\n    }\n    return Err(error);\n}","preventionTips":["Avoid running the orchestrator inside nested/breakaway-denying jobs on Windows","Monitor handle/process counts on long-lived Windows hosts","Include a Job Object smoke test in Windows CI for helper-based MCP configs"],"tags":["rust","mcp","windows","job-object","containment","headers-helper"],"backgroundTag":"job-object-creation-failed","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}