Investigate OpenClaw native tool paths that can bypass Windows Node MXC

[yikkuro]

Problem

Windows Node applies MXC containment only to commands routed through the node's system.run capability. OpenClaw also exposes native agent tools that may execute inside the Gateway process or another host path without passing through Windows Node. Examples may include file read/write/edit/patch operations, process tools, browser tools, and gateway-host execution.

For MicroClaw's proposed Windows Node + MXC security mode, we must identify every such route and prove that an agent cannot bypass MXC by choosing a different native tool.

Related security-framework investigation: #202.

Investigation scope

• Inventory the complete agent-facing tool surface in MicroClaw's pinned OpenClaw version.
• For each tool, identify its execution authority and process boundary:
  • Gateway process
  • Agent sandbox
  • Windows node
  • Browser/control service
  • Plugin or MCP process
• Trace native filesystem operations such as read, write, edit, patch, search, glob, attachments, and workspace manipulation.
• Trace shell/process routes including exec host selection, background processes, skills, plugins, hooks, MCP, and elevated execution.
• Determine which tool-policy configuration can disable each Gateway/native route.
• Verify whether an empty allowlist means "deny all" or "unrestricted" and document the required deny/sentinel policy.
• Check whether tool aliases, nested agents, sessions, slash commands, or configuration changes can restore a blocked tool.
• Determine whether Windows Companion itself exposes any capability that performs host filesystem access outside MXC.
• Test policy drift and Gateway restart/reload behavior.

Required security property

When Windows Node + MXC mode is active, every agent-controlled filesystem or process operation must either:

1. execute through an attested MXC-contained Windows Node capability, or
2. be denied before execution.

No operation may silently fall back to Gateway-host, Companion-host, local MCP, or uncontained Windows execution.

Acceptance criteria

• Versioned inventory of all relevant native OpenClaw tools and their execution boundaries.
• Automated policy test proving Gateway-native file and process tools are unavailable in MXC mode.
• Adversarial tests attempt read/write/execute outside approved roots through every identified tool family.
• Nested agents, skills, plugins, hooks, MCP, browser, attachments, and background execution are covered.
• Runtime attestation verifies the effective tool inventory after Gateway startup/restart.
• Configuration drift fails closed and blocks new chat/tool execution.
• No host fallback occurs when Windows Node, MXC, or policy attestation is unavailable.
• Findings and the selected production design are recorded in Decide production agent sandbox framework: AppContainer, OpenClaw Docker, or MXC #202.