[BUG] Co-Work plugin MCP servers blocked by VM network allowlist, causing session freeze

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When a locally-uploaded Co-Work plugin declares external MCP servers in its
.mcp.json, those servers' domains are not added to the VM's network
allowlist. The VM sandbox enforces a static list of 23 allowed domains
(written to /etc/srt-settings/<process-id>.json by coworkd), and this list
is never extended with the domains required by the plugin's MCP servers.

As a result, every MCP server the plugin declares fails immediately with:

``
Streamable HTTP error: Error POSTing to endpoint: Connection blocked by
network allowlist
``

The session appears to freeze in the UI because it enters the running state
but cannot proceed — all of its plugin-provided MCP tool servers are in a
failed state.

What Should Happen?

When a plugin declares MCP servers in its .mcp.json, the host-side session
manager (LocalAgentModeSessionManager) should extract the domains from those
server URLs and merge them into the allowedDomains list before passing the
spawn config to the VM. The srt-settings file written by coworkd should
then include those additional domains so the MITM proxy permits the
connections.

Alternatively, the session should gracefully degrade when MCP servers fail to
connect — rather than appearing frozen, it should either surface the
connection errors to the user or proceed without the failed servers.

Error Messages/Logs

**From `main.log` — all 8 plugin MCP servers fail identically:**

 
 2026-02-17 10:47:34 [info] [LocalAgentModeSessionManager] mcpServerStatus
 returned 11 servers: [
   {
     "name": "plugin:brand-voice-plugin:figma",
     "status": "failed",
     "error": "Streamable HTTP error: Error POSTing to endpoint: Connection
 blocked by network allowlist",
     "config": {
       "type": "http",
       "url": "https://mcp.figma.com/mcp"
     },
     "scope": "dynamic"
   },
   {
     "name": "plugin:brand-voice-plugin:linear",
     "status": "failed",
     "error": "Streamable HTTP error: Error POSTing to endpoint: Connection
 blocked by network allowlist",
     ...
   },
   // Same error for: canva, slack, notion, google-drive, granola, gamma
 ]
 

 **From `cowork_vm_node.log` — domain count is always static at 23:**

 
 2026-02-17 10:47:30 [info] [Spawn:config] Creating spawn function for
 process=dreamy-nice-cray,
   isResume=false, mounts=5 (outputs, .claude, .skills, .local-plugins,
 uploads), allowedDomains=23
 

 **From `coworkd.log` — srt-settings written with the same static 23 domains:**

 
 2026/02/17 17:47:31 [process:3792867b-...] wrote srt-settings with 23 allowed
 domains
   to /etc/srt-settings/3792867b-....json
 

 **The plugin's `.mcp.json` declares these servers (none of whose domains are
 in the 23-domain allowlist):**

 
 {
   "mcpServers": {
     "notion": { "type": "http", "url": "https://mcp.notion.com/mcp" },
     "atlassian": { "type": "http", "url": "https://mcp.atlassian.com/v1/mcp"
 },
     "box": { "type": "http", "url": "https://mcp.box.com" },
     "figma": { "type": "http", "url": "https://mcp.figma.com/mcp" },
     "gong": { "type": "http", "url": "https://mcp.gong.io/mcp" },
     "microsoft-365": { "type": "http", "url":
 "https://microsoft365.mcp.claude.com/mcp" },
     "granola": { "type": "http", "url": "https://mcp.granola.ai/mcp" }
   }
 }

Steps to Reproduce

1. Create a Co-Work plugin with a .mcp.json that declares one or more

external HTTP MCP servers (e.g., https://mcp.figma.com/mcp)

1. Upload the plugin as a local plugin via the Claude Desktop app
2. Enable the plugin in the Co-Work plugin settings
3. Start a new Co-Work session
4. The session will appear to freeze — the UI enters a loading/running state

but never produces output

1. Check main.log for mcpServerStatus — all plugin MCP servers will show

"status": "failed" with `"Connection blocked by network allowlist"

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

Claude Desktop v1.1.2998 / v1.1.3647 / v1.1.4010

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_