Evidence record / openhands
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-24-openhands-children-inherit-exactly-the-parent-s-mcp-set-and-policy-rails-parse-shell-structure
Children inherit exactly the parent’s MCP set, and policy rails parse shell structure. Delegated children receive exactly the resolved parent MCP configuration; child-declared MCP entries and plugin merging cannot enlarge it. Tools retain their separate scope checks. Policy rails move from regexes to shell AST analysis for composed fetch-to-execute, raw-disk and catastrophic-delete patterns. A matched rail yields HIGH risk and unresolved relevant shell structure yields UNKNOWN. The confirmation policy decides whether to prompt; a LOW result is not a general authorization decision.
Channel: tagged-release. Half: both. Date: 2026-10-15.
Operator consequence: Recheck custom child configurations that relied on adding MCP servers, and test extra-tool, extra-MCP and nested delegation attempts against SDK 1.58.1. Keep task_tool_set an intentional opt-in. The durable improvement is carrying authority through delegation and examining composed commands; the human bottleneck moves to the parent grant and confirmation policy. Neither code change establishes universal isolation or repairs the separate session-key path.
Receipt
- https://github.com/OpenHands/software-agent-sdk/commit/0bd5cc2d322d61f785816a29ef1f2e4c86db2460
- https://github.com/OpenHands/software-agent-sdk/commit/d97eb76f60829a4250dd313f5a9d4d03e2951de8
- https://github.com/OpenHands/software-agent-sdk/blob/v1.58.1/openhands-sdk/openhands/sdk/security/defense_in_depth/policy_rails.py
- https://github.com/OpenHands/software-agent-sdk/blob/v1.58.1/openhands-sdk/openhands/sdk/tool/defaults.py
Finding metadata
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
Finding ID: 2026-10-24-openhands-children-inherit-exactly-the-parent-s-mcp-set-and-policy-rails-parse-shell-structure
Source links
Primary links, including exact changelog lines when available.
- commit2026-10-24-openhands-children-inherit-exactly-the-parent-s-mcp-set-and-policy-rails-parse-shell-structuregithub.com/OpenHands/software-agent-sdk/commit/0bd5cc2d322d61f785816a29ef1f2e4c86db2460commit2026-10-24-openhands-children-inherit-exactly-the-parent-s-mcp-set-and-policy-rails-parse-shell-structuregithub.com/OpenHands/software-agent-sdk/commit/d97eb76f60829a4250dd313f5a9d4d03e2951de8tagged commit file2026-10-24-openhands-children-inherit-exactly-the-parent-s-mcp-set-and-policy-rails-parse-shell-structureOpenHands/software-agent-sdk / openhands-sdk/openhands/sdk/security/defense_in_depth/policy_rails.pytagged commit file2026-10-24-openhands-children-inherit-exactly-the-parent-s-mcp-set-and-policy-rails-parse-shell-structureOpenHands/software-agent-sdk / openhands-sdk/openhands/sdk/tool/defaults.py
Versioned source: run artifact