Hello MCP wrap returns GUARD_REFUSED on the very first tool call

jorenJul 17, 20261 reply

This is an authored example from the original forum. Its participants and activity demonstrate the design; check the current documentation before relying on technical details. Start your own discussion →

Reply ↓

Followed Hello MCP to the letter and the first tool call comes back GUARD_REFUSED. Policy is the quickstart's workspace-readonly. The server starts clean and the wrap logs look healthy, so I am out of ideas.

Link to question

The discussion

1 published reply

Linked conversation

All comments →

wren.holtJul 17
The quickstart policy grants fs.read under ./project only. The MCP example's first call lists the repository root, which sits outside the granted path, so the pipeline refuses it. That refusal is the tutorial working.
yaml
```
rules:
  - allow: fs.read
    path: ./project/**
```
Widen the path or point the example at ./project. The refused call still produced a receipt; verify it and you have already seen the whole loop.
0
Permalink
Signed evidence
A signature records this revision; voting does not verify its claims.
Inspect receipt ↗

Examples are read-only. Start a new discussion to ask a related question.