Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

watch/loop/start tie the squad_state MCP config to --yolo

Open
  • Is something wrong?
#2,139 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
58/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
typescript
Domain
cli, security

Research direction

Start with packages/squad-cli/src/cli/core/copilot-invocation.ts and trace buildAdditionalMcpConfigArgs() and withAdditionalMcpConfig() into the watch, loop, start, and copilot-bridge entry points listed in the issue. Compare those paths with watch/index.ts handling of copilotFlags. Done means MCP configuration can be loaded without implicit --yolo, blanket access is explicit or caller flags take precedence, and the requested argument-splitting limitation has a defined resolution.

Written by the indexing model from the issue text.

Description

Summary

squad watch --execute, squad loop and squad start add --yolo to every Copilot they spawn whenever the repository has a .mcp.json, regardless of --copilot-flags. Because squad init writes .mcp.json, this applies to effectively every Squad repo. A host that deliberately runs a narrower tool policy (deny lists, no allow-all, a human approving tool calls) cannot keep it without bypassing Squad's spawn path entirely via --agent-cmd.

Where (v0.13.1, unchanged since at least v0.11.0)

  • packages/squad-cli/src/cli/core/copilot-invocation.ts → buildAdditionalMcpConfigArgs() returns ['--yolo', '--additional-mcp-config', '@<teamRoot>/.mcp.json']; withAdditionalMcpConfig() prepends it.
  • Called from commands/watch/agent-spawn.ts (buildCopilotCommand, used by the execute and wave-dispatch capabilities), commands/watch/index.ts (buildAgentCommand), commands/loop.ts, commands/start.ts, commands/copilot-bridge.ts.
  • Separately, watch/index.ts defaults copilotFlags to '--yolo' when --execute is set and no flags are given.

Why it matters

--yolo is --allow-all-tools --allow-all-paths --allow-all-urls. Loading the squad_state MCP server does not need any of them; --additional-mcp-config @.mcp.json works on its own. Coupling them means the only way to get Squad's state tools is to also grant blanket permission. That conflicts with the threat model in Squad's own features/security-hardening.md, and it is invisible to the caller: --copilot-flags looks like it controls the policy, but it doesn't.

We hit this in swigerb/squad-on-aca (swigerb/squad-on-aca#112), which runs squad watch in Azure Container Apps with a resolved deny list and documents that --yolo is never emitted. The watcher was getting it anyway.

Ask

  1. Pass --additional-mcp-config @<teamRoot>/.mcp.json without --yolo.
  2. Make blanket allow an explicit opt-in (keep today's behaviour behind a flag or watch.yolo: true in config if you want backward compatibility), or at least do not inject it when the caller passed --copilot-flags.
  3. Related: --copilot-flags and --agent-cmd are split with .trim().split(/\s+/), so a deny rule containing a space (--deny-tool "shell(git push)") cannot be expressed. A JSON-array form (for example --copilot-args-json '["--deny-tool","shell(git push)"]') would fix both.

Happy to send a PR if the direction sounds right.

Dominant language
TypeScript
Stars
3.3k
Forks
510
Avg merge
1d 10h
Merged PRs (30d)
113

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from bradygaster/squad

All issues in bradygaster/squad

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.