[security] declared-tool enforcement can fail open when catalog is absent #5690

Client or integration

Direct HTTP/API client

Area

Tools / MCP / web search

Summary

When declared-tool enforcement is explicitly enabled but the declared-tool catalog is absent, the bridge can lack the membership set needed to enforce the policy. Expected: if enforceDeclaredToolNames=true, absence of the declared catalog must fail closed rather than silently weakening enforcement. This is scoped only to paths where enforcement is explicitly active; it does not propose changing intentional chat/Anthropic scoping from PR #4799.

Reproduction

1. Enter a bridge path with declared-tool-name enforcement enabled.
2. Omit the declared tool catalog/set.
3. Present a client-tool call that requires membership validation.
4. Observe that the unpatched path lacks the authoritative catalog needed for the check.
5. A local patch rejects the condition fail-closed before a client tool can execute.

Version

2.63.0 / commit 96b1406

Operating system

Ubuntu Server Linux x86_64

Provider and model

Not provider-specific

Logs or error output

Invariant: enforceDeclaredToolNames=true requires an authoritative declared-tool catalog.

Screenshots and supporting files

Related but distinct from #5407 and PR #4799. #5407 concerns failover after an undeclared stale tool; this report concerns a missing catalog while enforcement is already active.

Redacted configuration

{"enforceDeclaredToolNames":true,"declaredToolNames":null}

Checks

• I searched existing issues and documentation.
• I removed secrets, tokens, account details, request credentials, and personal data.