Daily Edition Sources +4

Builder Work: A Safety Check Can’t Read a Blank Form

Qwen Code’s AUTO-mode repair turns an empty MCP permission prompt into a bounded, visibly incomplete policy view—a small interface with a serious security lesson.

Photocopied marker diagram of an MCP request passing a bounded, visibly truncated argument card through a classifier gate, beside a stamp that server annotations are unverified.
Diagram Punka safety check needs enough context, and an honest account of what was omitted.
repo QwenLM/qwen-code evidence
4 source signals 1 repo commit 9a99409
Evidence: commit 9a99409 / August 31, 2026 / Daily Edition
Open Edition Evidence below

A permission classifier cannot decide whether an MCP call is safe by studying its name and an empty set of arguments. Yet that was the public failure Qwen Code describes in its MCP classifier merge: each discovered MCP tool reached AUTO mode as an empty object, so the system often blocked the call on name alone. The resulting pressure was perverse. Users who needed a legitimate tool could write broad allow rules that skipped the classifier entirely.

The repair is not “send everything to the model.” Qwen Code now projects a server name, tool name, self-reported annotations, and a bounded copy of the proposed arguments. The public merged pull request links Claude Code sessions for the work; that is evidence of coding-agent participation in the documented change, not a way to assign every line to an agent. The engineering worth copying is in how the team turns a messy tool request into a smaller policy object without pretending the missing pieces were never there.

A blank form pushed users toward a master key

The AUTO-mode reference now says why arguments matter: an external-write or data-exfiltration rule cannot be applied to a tool name alone. But it also refuses a more comforting fiction. Server annotations such as read-only or idempotent hints are self-reported, and the classifier cannot see what a server will actually do. A benign-looking request can still conceal a harmful behavior on the other side of the MCP boundary.

The useful work is accounting for the loss

The inspected projection module limits strings, names, nesting, entries, and the total serialized form handed to the classifier. It marks cuts in place and raises truncation flags so a partial argument list cannot masquerade as a genuinely empty one. It also avoids a dangerous fallback: when an MCP server has disappeared from the registry or the projection fails, the code returns the conservative MCP form instead of forwarding raw historical arguments.

The matching projection tests are the real receipt of craft. They exercise adversarial object keys, budget accounting in the rendered form, malformed values, annotation filtering, and markers for omitted material. That is engineering depth a simple token cap would miss: the object that policy sees is itself an interface, so its bytes, labels, and failure modes need a contract.

The transferable skill: budget the review view

When a safety, approval, or review model must inspect a complicated request, build a projection rather than a dump. Set limits on the rendered representation, not only on source fields; reserve room for loss markers; distinguish absent data from clipped data; treat producer hints as untrusted; and fail closed when the source object cannot be resolved. Then test the weird keys, deep objects, stale history, and recovery paths that a happy-path schema will not reveal.

There is a fair cost to this design. The bounded view still does not prove server behavior, and forwarding arguments can be the wrong disclosure choice if a classifier runs at another provider. Qwen Code retains a name-only opt-out for that case, expecting more conservative blocks. The receipts are merged source and tests, not release or production evidence. The next useful signal is a public end-to-end evaluation showing how often the projection avoids needless blocks without widening the path for a malicious MCP server.

Evidence Trail

Receipts below the story

The article above is the public narrative. This section keeps the source trail and limits on the same page.

Edition
DateAugust 31, 2026
LaneDaily Edition
Confidence78%
Sources4
ReposQwenLM/qwen-code

Primary Evidence

Evidence Limits

  • The sources prove a merged implementation and its intended tested behavior, not a released build, a complete privacy audit, a production outcome, or a guarantee that a classifier can recognize malicious server behavior.
  • A public commit's linked coding-agent sessions prove participation in the recorded work, not the extent of the agent's contribution or a general claim about all Qwen Code development.
Letters & Corrections

Send a note to the desk

Corrections, missing context, or a follow-up lead.