In agent-governance-python/agent-os/src/agent_os/mcp_auth_enforcement.py, when check() is called with a server_name that has no entry in self._servers, evaluation falls through to the default allowlist path with no TLS check at all — require_tls semantics only exist for registered entries.
This holds on main and is unchanged by either of the open #3785 fixes (#3793, #3797), which correctly scope themselves to the registered-entry path. Depending on deployment posture, an unregistered (e.g. typo'd or newly added) server name silently gets weaker transport guarantees than a registered one.
Worth deciding explicitly: either apply a global TLS floor to the default-allowlist path, or document that unregistered servers are outside the TLS enforcement boundary.
Noticed while comparing #3793/#3797 (both verified to preserve the S10.12 empty-both-sources behavior).
In
agent-governance-python/agent-os/src/agent_os/mcp_auth_enforcement.py, whencheck()is called with aserver_namethat has no entry inself._servers, evaluation falls through to the default allowlist path with no TLS check at all —require_tlssemantics only exist for registered entries.This holds on
mainand is unchanged by either of the open #3785 fixes (#3793, #3797), which correctly scope themselves to the registered-entry path. Depending on deployment posture, an unregistered (e.g. typo'd or newly added) server name silently gets weaker transport guarantees than a registered one.Worth deciding explicitly: either apply a global TLS floor to the default-allowlist path, or document that unregistered servers are outside the TLS enforcement boundary.
Noticed while comparing #3793/#3797 (both verified to preserve the S10.12 empty-both-sources behavior).