Disable web tools in the codex configs; document the cortex-code gap - #7
Open
sfc-gh-dhuang wants to merge 2 commits into
Open
Disable web tools in the codex configs; document the cortex-code gap#7sfc-gh-dhuang wants to merge 2 commits into
sfc-gh-dhuang wants to merge 2 commits into
Conversation
The tasks and their reference solutions are public, so an agent that can reach the web can look up the answer instead of doing the dbt work. The bundled claude-code configs already disable web tools, but the codex configs did not, and the README's "disable the equivalent browsing tools for other agents" is advice that cannot currently be followed for cortex-code. - codex configs: add `web_search: disabled`. Harbor's codex agent already supports this as a CLI flag (`-c web_search=disabled`), so it takes effect immediately. Verified with `harbor run --print-config` against Harbor 0.21.0. - cortex-code configs: Cortex Code keeps `web_search` and `web_fetch` available in EVERY agent mode, including code mode, and Harbor's cortex-code agent has no option to switch them off. The setting is included but commented out, pointing at harbor-framework/harbor#2787, which adds it. It is deliberately not left active: Harbor drops an unrecognised kwarg silently rather than rejecting it, so an active line would read as protection while changing nothing. - README: replace the per-agent advice with a table of what each bundled config actually does, state the cortex-code gap plainly, and promote the `--allow-agent-host` network allowlist as the stricter control that does not depend on agent support. Also warn that an unrecognised kwarg is dropped silently, so a new agent's setting should be checked rather than assumed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
![snowflake-security-bot[bot]](https://avatars.githubusercontent.com/u/140554735?s=60&v=4){kind=small}
The previous comment said Harbor had 'no way to switch them off yet', which is now stale: #2787 is merged. It is not in a release though -- v0.21.0 does not carry it -- and Harbor drops an unrecognised kwarg silently, so uncommenting before the next release would read as protection while changing nothing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The tasks and their reference solutions are public now, so an agent that can reach the web can look up the answer instead of doing the dbt work. The bundled
claude-codeconfigs already disable web tools — but thecodexconfigs did not, and the README's instruction to "disable the equivalent browsing tools for other agents" is advice that cannot currently be followed forcortex-code.What each bundled config does after this
claude-codedisallowed_tools: WebSearch,WebFetchcodexweb_search: disabledcortex-codeterminus-2(commented fallback)codex
Harbor's
codexagent already exposesweb_searchas a CLI flag with choicesdisabled/cached/live, rendering-c web_search=disabled. So this takes effect immediately, no Harbor change needed. Verified withharbor run --print-configagainst Harbor 0.21.0:cortex-code — included but deliberately commented out
Cortex Code keeps
web_searchandweb_fetchavailable in every agent mode, including code mode (I checked the mode allow-list — code mode drops the Snowflake data suite, teams, cron, and MCP, but keeps both web tools). Harbor'scortex-codeagent has no option to switch them off; harbor#2787 addsdisallowed_toolsfor exactly this.The line is present but commented, with a pointer to that PR. Leaving it active would be worse than leaving it out: Harbor drops an unrecognised kwarg silently rather than rejecting it, so an active
disallowed_tools:line would read as protection while changing nothing. Uncomment once #2787 ships.README
Replaces the per-agent advice with the table above, states the
cortex-codegap plainly, and promotes--allow-agent-hostas the stricter control — it's the only one that doesn't depend on agent support, and it's the recommended mitigation forcortex-codein the meantime.It also now warns that an unrecognised kwarg is dropped silently, so anyone adding a config for a new agent should verify the setting took effect rather than assume it.
Not in this PR
While testing I hit a few README commands that fail on Harbor 0.21.0 (
--task-nameno longer exists;--env DB_TYPE=duckdbis rejected because--envselects the environment type; the nativecortex-codeagent needs Harbor >= 0.21.0, not the 0.20.x the README cites). Those are usability rather than integrity, so I've kept them out to keep this focused — happy to send them separately.