OpenClaw Main Hardens Network Tool Results and MCP Failure Isolation

OpenClaw has merged another layer of defence around data it does not control: hostile content must remain externally sourced through provider adapters, plugin caches, Code Mode and model-visible errors; deferred MCP errors must remain failures; oversized MCP stdio frames must not kill the host; and untrusted filenames must remain safe across supported filesystems.

This is not one generic sanitizer. The changes repair distinct owner boundaries where provenance, privacy or failure state could previously be lost.

All changes covered here are on main; the supplied release records do not identify a containing package. Operators with web search, MCP, Feishu, browser automation or generated-media delivery should test a containing build before trusting the repaired contract.

Deferred MCP failure now fails all the way out

PR #118363 fixes Tool Search’s deferred invocation path. A selected MCP tool could return a fulfilled transport result containing isError: true; Tool Search preserved that failure inside a nested result, but the outer tool_call still looked successful.

The repair copies the selected tool’s canonical failure kind to the outer result and hidden transcript while keeping useful model-visible error content. That distinction matters for retries, completion claims and audit history: transport completion is not business success.

Acceptance should cover both kinds of failure:

• a transport-level rejection or cancellation; and
• a fulfilled MCP envelope whose selected tool explicitly reports failure.

Neither may become a successful outer call, and neither should erase the structured diagnostic needed for recovery.

Oversized MCP output now fails one transport, not the Gateway

PR #119379 closes an availability boundary in the MCP stdio transport. The pinned SDK’s read buffer throws synchronously when an accumulated frame exceeds 10 MiB. OpenClaw called that append operation from the child stdout event without a guard, so the exception could escape server-level isolation and terminate the host process—and every concurrent session with it.

The merged transport catches parsing and buffer errors at the stdout owner, reports the failure through the existing transport error path and closes that MCP connection. Correctly framed traffic is unchanged; the important difference is blast radius.

The payload does not need to be chosen by the operator who configured the server. A file read, fetched page or database result influenced by a lower-privileged sender can determine its size. Operators who expose stdio MCP tools to multiple trust levels should therefore prioritise a containing build and stage both a near-limit success and an oversized rejection using inert generated data.

Do not raise buffer limits as the primary mitigation. A larger unbounded failure threshold only moves the crash and memory-pressure boundary. Until updated, constrain tool-result sizes at the MCP server and supervise the Gateway, but treat those as compensating controls rather than proof of isolation.

One network sanitizer now owns more paths

PR #118984 establishes a shared owner-boundary sanitizer for web, search and provider results. The upstream scope names Firecrawl, Tavily, xAI, shared web search, Tool Search, MCP HTTP handlers and agent-core result handling.

The hardened boundary covers split streamed markers, model special tokens, source URLs, citations, summaries and cancellation without flattening trusted credential failures or caller aborts. That is the right shape: untrusted payload text should be fenced, while trusted control metadata must retain its actual type.

PR #118877 applies the same principle to Feishu collaboration tools. A document, chat, drive or wiki result is network content even when it arrives as a structured plugin response from an authenticated workspace.

Warm plugin caches retain provenance

PR #118874 fixes a cold-to-warm discrepancy. Registered plugin tools carried authoritative external-result provenance when first discovered, but the process-local descriptor cache and lazy reconstruction path could lose that marker. A warm invocation could then bypass Code Mode wrapping and sticky assistant-turn taint that a cold invocation received.

A cache is an optimization, not a trust reset. Stage both the first invocation and a cache-hit invocation with the same inert hostile marker; they must produce equivalent provenance, wrapping and downstream memory classification.

Generated text and browser media stay in their lanes

PR #118780 isolates provider-generated media text from delivery directives. Text produced by a model or media provider must not be interpreted as a trusted instruction to redirect or alter channel delivery.

PR #118775 protects private browser observation media and Canvas trust boundaries. Private observation artifacts should not leak through a more permissive hosted-media path, and page-controlled Canvas data remains external content rather than operator instruction.

Canonical filename sanitization replaces a weaker local fork

PR #119363 upgrades @openclaw/fs-safe to 0.5.2 and removes OpenClaw’s weaker local untrusted-filename sanitizer. The canonical implementation strips Windows-invalid characters and C1 controls, and suffixes reserved Windows basenames while preserving case and extensions. That affects attachment, Canvas, media-store and browser-download names, including paths later copied to Windows or SharePoint.

The dependency also tightens atomic-write, descriptor, lock-cleanup and symlink behavior. OpenClaw preserves selected operator-owned symlink contracts explicitly, while final symlink targets and escapes outside the permitted root remain rejected. This is a compatibility-sensitive security change: operators with workspace directory aliases, config includes, custom skill or hook roots should test their exact paths instead of globally weakening symlink checks.

Interpretation: a value does not become trusted because it is structured, cached, authenticated, generated by another model, converted into media or presented as a filename. Trust follows origin and owner policy through every representation.

Operator acceptance matrix

Use inert markers and disposable accounts:

Also verify trusted cancellation and credential failures retain their real classes; a security wrapper that turns every failure into model text can break recovery policy.

Evidence and limits

Official GitHub API records confirm the merged PRs and their focused adversarial test claims. The API extraction for #118363 returned a malformed control character in the mirrored payload, so its chronology and impact are additionally grounded in the official collector’s merged PR and commit records. OpenClaw Academy did not execute hostile content against a live Gateway.

Relevant collector IDs are 37538/37397, 38622/38550, 38522/38488/38512, 37041/36925/37004, 36628/36517, 36621/36511, 36860/36746, and 36642/36532.

Bottom line

Tool safety fails when provenance, failure state or isolation disappears at an adapter boundary. Adopt only a containing build that proves cold and warm calls, nested and oversized MCP failures, streamed output, generated media, private browser artifacts and untrusted filenames all preserve their intended trust, outcome and blast radius.