Issue #1168 · live behavioral evidence · 17 July 2026

Claude child constrained MCP tools

Tegy upgrades Claude Agent SDK from 0.3.165 to 0.3.212 while keeping native unrestricted Bash disabled. The verification proves child access to Tegy’s existing constrained MCP boundary instead of trusting assistant claims.

Production-like E2E passed

Anti-fabrication gates

SDK inheritance probe

Random nonce: child-mcp-4c016390c8ad

Observed a real child-attributed MCP tool block and exactly one handler hit.

Hosted endpoint hit · usage +$0.014655742

Real StrategyOS workspace probe

Scoped child: strategyos:a-biz-b-operator

Read a mounted 312-byte random-sentinel input and wrote JSON containing the exact sentinel and byte count.

Physical output verified · usage +$0.156411617

Open the machine-readable evidence

Security result

No native unrestricted Bash was enabled.
The StrategyOS child used Tegy’s mounted upload/output paths inside the production-like container’s proot boundary.
Provider requests and unique provider-final usage events were reconciled for both probes.
The exact scoped agent identity and completed task ID were observed.

Adjacent finding

The child’s file existed with correct bytes, but the turn did not emit generated_output.created. This does not invalidate child filesystem access; it is a separate publication/telemetry gap tracked as issue #1180.