DanielLavrushinMerlin XrayUI 作者与维护者

作者发言

GitHub·2026.10.19 18:09:25（UTC+8）

DanielLavrushin 指出 b4 的 MCP 权限提示未说明开关位于 b4 网页界面

DanielLavrushin 在 b4 #446 中指出，「Allow active probes」与「Allow configuration changes」属于路由器上的 b4 配置，默认关闭；现有提示只写 Settings → Integrations → MCP server，未注明 b4 自身网页界面，导致用户的 AI 应用把它误解为客户端或 IDE 设置。他建议在提示中明确位置，并说明修改后先在 b4 保存、再在 AI 应用重连 MCP；b4 无需重启，其无状态接口按当前配置提供工具，客户端需重连以刷新工具列表。该议题仍开放，所述提示修改为建议。

作者原文@DanielLavrushin

With "Allow active probes" and "Allow configuration changes" off, b4_status returns you_can_test_and_discover: false and you_can_change_settings: false, with a note that these features are "switched off for this connection" and that the setting is "under Settings -> Integrations -> MCP server" (mcp.go#L914-L927). The server instructions say the same (mcp.go#L910-L912). Neither says that this is b4's own web interface, and "for this connection" reads like a client-side setting.

A user's AI app (Hermes) read it that way. It told the user that active probes were off on the client side (Hermes or the IDE), not in b4, and to turn on "Allow active probes" in the IDE's Settings -> Integrations -> MCP server and restart the MCP session. Both switches are b4 configuration on the router, system.web_server.mcp.allow_active_probes and allow_writes, off by default, and the user had not turned them on.

Where the location is named

The phrase "under Settings -> Integrations -> MCP server" is in the note, the instructions and 13 refusal messages in src/http/handler (mcp_probe.go, mcp_write.go, mcp_discovery.go, mcp_sets.go, mcp_targets.go). None of them says b4's web interface.

Fix notes

• Name the place as b4's web interface and rule out the client, for example "in the b4 web interface (Settings -> Integrations -> MCP server), not in the AI app". One shared constant would keep the 15 sites in step.
• Say what to do after switching: save in b4, then reconnect the MCP server in the AI app. b4 needs no restart: /api/mcp is stateless and builds its tool set from the live config on every request (mcp.go#L124-L144). The client keeps the tool list it fetched when it connected, so the new tools appear only after a reconnect.
• TestInstructionsNameTheGatedCapabilities requires "Allow active probes" and "do not conclude the feature does not exist" in the instructions; keep both. The tool-list byte budget in mcp_test.go counts tool definitions only, so the note, instructions and refusal texts do not eat into it.