create_agent MCP tool is ungated despite "admin-only" comment & description — any container can create agent groups

[jonazri]

Summary

create_agent is documented/described as admin-only, but it is exposed to every container and the host performs no role/admin check — so any agent container can create new agent groups.

Version

upstream main @ d144721 (≈ v2.0.64); present since e83ffbc.

Claim vs. reality

container/agent-runner/src/mcp-tools/agents.ts:

• L8-9 (comment): "create_agent is admin-only. Non-admin containers never see this tool (see mcp-tools/index.ts). The host re-checks permission on receive."
• L35 (tool description, shown to the agent): "…Admin-only. Fire-and-forget."

Neither holds:

1. Registered unconditionally. registerTools([createAgent]) runs at module scope (agents.ts:66); the barrel imports it for its side effect with no gating (mcp-tools/index.ts:11). Every container's MCP server exposes create_agent.
2. No host-side re-check. handleCreateAgent (src/modules/agent-to-agent/create-agent.ts, dispatched from src/delivery.ts handleSystemAction) validates only source-group-exists, name-collision, and path-traversal — no role/admin/permission check.

Impact

A container agent processes inbound messages (a prompt-injection surface). With create_agent ungated, an injected agent can spawn arbitrary agent groups with attacker-chosen name + instructions (the new group's CLAUDE.md) and wire destinations. Path traversal is guarded, but unauthorized agent-group creation enables namespace pollution / persistence / resource abuse — higher impact on shared/multi-user deployments.

Suggested fix

• Conditional registration: don't register create_agent for non-admin containers (gate in index.ts/agents.ts on role/cli_scope), matching the "non-admin never see this tool" claim; and/or
• Host re-check: in handleCreateAgent, verify the source group is authorized before creating, matching the "host re-checks permission on receive" claim.

Then align the agents.ts comment + description with whichever gating ships.

[sturdy4days]

Verified against current main while triaging: this is fixed there. create_agent is no longer trusted container-side — the delivery-action handler at src/modules/agent-to-agent/create-agent.ts enforces authorization host-side: groups with cli_scope: 'global' (trusted owner groups) create directly, everything else (the default group scope) goes through requestApproval to an admin, and an unknown/missing config fails closed to the approval path. The module doc explicitly covers the bypass this issue describes (writing the outbound system row directly — the gate is host-side precisely because the container-side tool gate is bypassable). If you're seeing ungated creates on an installed copy, it likely predates that module; current main looks closed. Probably safe to close after a maintainer confirms.