openclaw - 💡(How to fix) Fix openclaw agent CLI spawn hardcodes --strict-mcp-config + --allowedTools mcp__openclaw__*, blocking user-scope MCPs (distinct from #39225 ACP path)

Summary

openclaw agent --agent claude sandboxes the spawned Claude CLI to only the loopback mcp__openclaw__* server, blocking user-scope MCPs (gbrain, Supabase, etc.) that the user has configured in ~/.claude.json and explicitly allowlisted in the project's .claude/settings.json. There is currently no user-config knob to relax this; the temp MCP config and the --allowedTools whitelist are generated unconditionally by OpenClaw.

This is a different code path from issue #39225 (which was about the ACP runtime and was correctly fixed by 5659d7f985). openclaw agent invokes claude -p directly, bypassing the ACPX runtime entirely.

Reproduction

OpenClaw 2026.5.19 on Linux 6.6.87 (WSL2 Ubuntu 24.04), Node 24.10.0.

1. Configure a user-scope MCP server in ~/.claude.json:

   { "mcpServers": { "gbrain": { "type": "stdio", "command": "/home/user/.local/bin/gbrain", "args": ["serve"], "env": {} } } }

2. Allowlist it in the project's .claude/settings.json permissions allow list (e.g. mcp__gbrain__search).
3. Optionally configure it in plugins.entries.acpx.config.mcpServers in ~/.openclaw/openclaw.json matching McpServerConfigSchema. openclaw config validate passes.
4. openclaw gateway restart. Verify new gateway PID.
5. openclaw agent --agent claude -m "Call mcp__gbrain__search with query=foo"
6. Reply: No such tool: mcp__gbrain__search

Evidence — exact argv

openclaw gateway run --cli-backend-logs reveals the spawn:

cli argv: claude -p --output-format stream-json --include-partial-messages --verbose \
  --setting-sources user \
  --allowedTools mcp__openclaw__* \
  --permission-mode bypassPermissions \
  --strict-mcp-config \
  --mcp-config /tmp/openclaw-cli-mcp-XXXXXX/mcp.json \
  --plugin-dir /tmp/openclaw/openclaw-claude-skills-YYY/openclaw-skills \
  --model opus \
  --append-system-prompt-file /tmp/openclaw/openclaw-cli-system-prompt-ZZZ/system-prompt.md \
  --session-id <uuid>

Two flags do the sealing:

• --allowedTools mcp__openclaw__* — whitelist matches only the loopback prefix.
• --strict-mcp-config --mcp-config /tmp/openclaw-cli-mcp-XXXXXX/mcp.json — Claude is told to ignore user/project MCP discovery and use only this temp file.

The temp file contains:

{
  "mcpServers": {
    "openclaw": {
      "type": "http",
      "url": "http://127.0.0.1:PORT/mcp",
      "headers": { "Authorization": "Bearer ${OPENCLAW_MCP_TOKEN}", ... }
    }
  }
}

User-scope MCPs and project .mcp.json are both invisible at this layer.

Why acpx.config.mcpServers doesn't help

Verified: that config is plumbed into AcpxRuntime (runtime-DNPwrILZ.js instantiated at service-D_3S1ZST.js:1196 for "embedded acpx runtime backend") via toAcpMcpServers(params.pluginConfig.mcpServers). That runtime is for openclaw acp-cli (ACP wrapper protocol), not openclaw agent direct CLI invocation. They are separate entry points.

Impact

Users with rich user-scope MCP setups (semantic search, vector DBs, docs servers) cannot use them from OpenClaw-spawned Claude sessions. Forces a fork in workflow:

• Interactive claude directly → full MCP surface.
• openclaw agent --agent claude → only mcp__openclaw__*.

Workaround: from the spawned session, invoke the MCP server's CLI via Bash (e.g., gbrain search). Works but loses tool-use telemetry, structured args, and the model's ability to reason about a typed tool surface.

Proposal

Add a user-config knob to relax the sandbox, with safe defaults preserved. Options sketch:

• agents.<id>.mcpAllowlist: ["mcp__gbrain__*", "mcp__supabase__*"] — additional patterns appended to --allowedTools.
• agents.<id>.userScopeMcp: true — opt in to merging ~/.claude.json mcpServers into the temp config.
• Per-agent project hint: read <cwd>/.mcp.json if it exists, append its entries (with mcp__<server>__* patterns auto-allowlisted).

Keep the loopback openclaw server in the temp config and mcp__openclaw__* in the allowlist either way, to preserve the session-key / agent-id / channel headers that the loopback depends on.

Environment

• OpenClaw 2026.5.19 (a185ca2)
• Node 24.10.0, Linux 6.6.87.2-microsoft-standard-WSL2 (Ubuntu 24.04)
• Claude CLI: claude-opus-4-7 (via anthropic provider fallback)
• gbrain 0.35.5.x (stdio MCP, declared in ~/.claude.json)

References

• Related but distinct: #39225 (ACP runtime mcpServers, CLOSED, fixed by 5659d7f985)
• runtime-DNPwrILZ.js — AcpxRuntime where ACP-side mcpServers flow correctly
• service-D_3S1ZST.js:225-260 — McpServerConfigSchema and AcpxPluginConfigSchema (works for ACP path, ignored for CLI path)