Task should inherit current agent permissions/tools for MCP

[nikaro]

Description

I've created an "offline" agent to limit the risk of leaking sensitive data via prompt inject when working on untrusted data.

  "agent": {
    "offline": {
      "permission": {
        "bash": {
          "*": "ask",
        },
        "edit": "ask",
        "webfetch": "deny",
      },
      "tools": {
        "context7_*": false,
        "gh_grep_*": false,
        "kagi_*": false,
        "webfetch": false,
      },
    },
  },

But the agent can easily circumvent the tools limitations by delegating the task to a sub-agent. And it does not even ask for permission to run the tool. This can be solved by disabling the task tool. But it would be better if by default tasks were using the same agent with the same permissions/tools.

PS: it seems to work fine for native tools like webfetch (not sure about this, sometimes it hangs sometimes it rightfully fails).

OpenCode version

1.0.15

Steps to reproduce

1. Create an agent "offline" with webfetch and mcp with online access disabled (ex: kagi)
2. Using the "offline" ask it to search online for whatever information
3. It will delegate a task and use mcp tool like kagi

Screenshot and/or share link

No response

Operating System

macOS 26.0.1

Terminal

Ghostty

[github-actions]

This issue might be a duplicate of existing issues. Please check:

• MCP tool blocking not working - agents can still see and access disabled tools #3756: MCP tool blocking not working - agents can still see and access disabled tools - This issue describes the exact same problem where agents can circumvent tool restrictions, and MCP tools set to false are still visible and accessible to agents.
• Feature request: let subagents inherit context #2588: Feature request: let subagents inherit context - Related to subagent inheritance behavior
• MCP tool blocking not working - agents can still see and access disabled tools #3756 specifically mentions that "MCP tools are visible to the model even when disabled" which is the same core issue you're experiencing with task delegation bypassing restrictions.

Feel free to ignore if none of these address your specific case.