[CRITICAL][SECURITY] armorcodex policy_update over MCP bypasses the actor allowlist the hook path enforces

[Aniketvish0]

Migrated from armoriq/conmap-auto#708.

Fix lands in: armoriq/armorcodex. Filed here because conmap-auto is this session's tracker for CLI/SDK work.

armorcodex @ origin/main (72d9e13).

VERIFIED: scripts/lib/engine.mjs:65 defines isPolicyUpdateAllowed(config, input), called only at engine.mjs:183 and :196 — the hook path.

The MCP tool handler in scripts/policy-mcp.mjs:96 registers policy_update (annotated destructiveHint: true) and its handler gates on only config.policyUpdateEnabled, which defaults to true (scripts/lib/config.mjs:149). The allowlist policyUpdateAllowList defaults to "*" (config.mjs:150). The handler passes actor: "mcp" to applyPolicyCommand, so the code knows the caller is the agent and still does not gate.

Impact

The agent is whitelisted to call policy_update, so a prompt-injected agent can delete every deny rule via MCP and PreToolUse will not block it. The equivalent action through the hook path IS gated — the two paths disagree on authority.

Ask

• Call isPolicyUpdateAllowed on the MCP path, or refuse actor:"mcp" policy mutation entirely.
• Default policyUpdateEnabled to false.
• Narrow the default allowlist.