RFC: MCP exec-runner — the sandbox as an A3 runner target (#592)

[ryaneggz]

Summary

Companion RFC to #592 (Runtime support) proposing the openharness sandbox as a remotely-drivable MCP runner: vendor only the exec-server proxy from mifunedev/sandboxes/ubuntu — a ~100-line Node MCP server exposing a single exec_command tool over Streamable HTTP on :3005.

This is a decision artifact, not an implementation: no proxy is wired, no image or compose is touched.

Where it fits #592

The mechanism is unambiguously axis A3 (fan-out) — a runner endpoint that lets an external control plane drive N sandboxes over one uniform protocol (MCP). It makes concrete the "the harness becomes a runner target" option that rfc-runtime-support.md §6 raises and defers, adding provider: mcp-http beside the Crabbox be/embed/integrate choice.

It is the inverse of the existing DebugMCP wiring: there the sandbox is an MCP client dialing out to :3001; here it hosts an MCP endpoint an outside orchestrator drives.

Security floor (gates any future build)

exec_command is arbitrary RCE, and the sandbox bind-mounts /var/run/docker.sock → reach extends to the host. Non-negotiable posture, drawn from the third-party-MCP governance checklist:

• Off by default — opt-in single toggle (install.mcp_exec_runner); default installs ship nothing new (.oh/templates/full/ + init.test.ts stay green).
• Loopback-bound by default — external reach only via a deliberate cloudflared tunnel or explicit forwardPorts; never 0.0.0.0.
• API_KEY required when enabled (fail-closed) — do not inherit the upstream keyless default.
• Vendored + pinned @modelcontextprotocol/sdk; minimal reviewed config; no auto-granted permissions.
• Open fork: run as a low-priv executor user (recommended) vs. the sudo + docker-group sandbox user.

Contents

• .oh/docs/rfcs/rfc-mcp-exec-runner.md — the companion RFC (this PR).

Held out of this PR (available on request):

• A wiki entry (.oh/skills/wiki/corpus/mcp-exec-runner.md + raw snapshot) — kept as local scratch, since the wiki corpus is gitignored-by-default.
• A proposed additive merge into the in-flight rfc-runtime-support.md (a §4 fit-matrix row + a §6 provider: mcp-http option) — left for the RFC: Runtime support — A1/A2/A3 axes & the "supported runtime" contract #592 author to apply rather than editing their WIP draft in place.

Notes

• The RFC links rfc-runtime-support.md, which is the in-flight RFC: Runtime support — A1/A2/A3 axes & the "supported runtime" contract #592 draft (not yet on development); the relative link resolves once RFC: Runtime support — A1/A2/A3 axes & the "supported runtime" contract #592 lands.
• Scoped as an A3 candidate — it does not preempt RFC: Runtime support — A1/A2/A3 axes & the "supported runtime" contract #592's primary-driver ordering. File the child build issue only after that decision (pre-written gh body in the RFC §7).

Refs #592, #591.

🤖 Generated with Claude Code