vinzenz/hyperhive
0
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

tools: drop NotebookEdit from the agent whitelist

Browse source
This commit is contained in:
müde 2026-05-15 15:47:58 +02:00
parent 9716f20f81
commit edc1de3197
2 changed files with 5 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

9
CLAUDE.md
View file

@ -222,10 +222,11 @@ line (broker's `count_pending`). When adding new tools (manager surface,
notes/state, etc.), use `run_tool` and they pick up the envelope for free. notes/state, etc.), use `run_tool` and they pick up the envelope for free.
**Tool whitelist** (see `ALLOWED_BUILTIN_TOOLS` in `hive-ag3nt::mcp`): **Tool whitelist** (see `ALLOWED_BUILTIN_TOOLS` in `hive-ag3nt::mcp`):
- Allowed built-ins: `Bash`, `Edit`, `Glob`, `Grep`, `NotebookEdit`, `Read`, - Allowed built-ins: `Bash`, `Edit`, `Glob`, `Grep`, `Read`, `TodoWrite`,
`TodoWrite`, `Write`. `Write`.
- Denied by omission: `WebFetch`, `WebSearch`, `Task` — no external egress - Denied by omission: `WebFetch`, `WebSearch`, `Task`, `NotebookEdit` —
or nested-agent spawning until we have a real policy story. no external egress, nested-agent spawning, or Jupyter handling until we
have a real policy story.
- Allowed MCP tools: `mcp__hyperhive__send`, `mcp__hyperhive__recv`. - Allowed MCP tools: `mcp__hyperhive__send`, `mcp__hyperhive__recv`.
`Bash` is on the allow-list "for now" — pending a finer-grained allow-list `Bash` is on the allow-list "for now" — pending a finer-grained allow-list

1
hive-ag3nt/src/mcp.rs
View file

@ -355,7 +355,6 @@ pub const ALLOWED_BUILTIN_TOOLS: &[&str] = &[
"Edit", "Edit",
"Glob", "Glob",
"Grep", "Grep",
"NotebookEdit",
"Read", "Read",
"TodoWrite", "TodoWrite",
"Write", "Write",