MCP External Tool Execution on Windows (Custom MCP Server)

[steveartur]

Hello,

I'm integrating a custom MCP server called Axon Executor with Odysseus on Windows.

Current environment:

• Windows 10
• LM Studio
• Gemma
• Odysseus latest dev branch
• Custom MCP server (Axon Executor)

Everything works correctly:

• LM Studio
• Agent
• Memory
• Database
• Internal Skills
• MCP server registration
• My account has "is_admin": true

The LLM can see my MCP tool and actually generates the Tool Call.

However, when the tool should execute an external Windows command such as:

ipconfig
ping google.com
dir

the execution never appears to leave the Odysseus environment.

Instead of receiving the Windows stdout, the tool returns HTML/internal Odysseus content (login page).

My questions are:

1. Is there any additional permission required to allow external MCP execution?

2. Does Odysseus sandbox external MCP tools?

3. Is there an approval mechanism for external tool execution?

4. Which source file is responsible for deciding whether an MCP tool is actually executed?

5. Are there any configuration flags that enable external tool execution?

Thank you.

[steveartur]

LM Studio
│
▼
Odysseus
│
▼
Custom MCP (Axon Executor)
│
▼
Windows CMD

[johnghruiko32-wq]

Thanks for the detailed report. I’m experiencing something similar and would like to understand whether external MCP execution requires additional permissions or configuration. Also, while testing with my setup using uk777 2026, I noticed the tool calls are generated correctly but the expected Windows command output never appears. Any information about sandboxing, approval mechanisms, or the source file responsible for tool execution would be very helpful. Thank you for your support.

[miksvell]

Is it possible to use NotebookLM tool in Odysseus ?

[KryptosAI]

A good first thing to separate here is "did Odysseus call my MCP tool?" from "did the MCP tool call Windows?" The HTML/login-page response strongly suggests the request is being routed back into an Odysseus HTTP surface, not into your Axon Executor process/stdout.

I would debug it in this order:

1. Run the Axon MCP server outside Odysseus and call the same tool directly with a tiny MCP inspector/client. If ipconfig does not return stdout there, the issue is in the server implementation or Windows command spawning.
2. In Odysseus, log the MCP tool call envelope before execution: server name, tool name, arguments, transport URL/command, and the raw response status/content-type. If you see text/html or a 30x/401/403, you are hitting a web route/login guard, not the MCP stdio/server response.
3. Check whether the custom MCP registration is configured as a local stdio command versus an HTTP endpoint. For external Windows commands, stdio/local process mode is usually what you want. If it is registered as HTTP and points at the Odysseus app URL, the login HTML result makes sense.
4. Confirm the MCP server process inherits the Windows environment you expect. On Windows, prefer cmd.exe /c ipconfig or powershell.exe -NoProfile -Command ... rather than assuming shell built-ins like dir work through a raw spawn call.
5. Add a harmless diagnostic MCP tool first, for example one that returns process.platform, process.cwd(), and whoami. If that works but ipconfig does not, the block is in command execution policy. If that also returns HTML, the block is routing/transport/auth.

I would not assume is_admin: true by itself allows shell execution. In most agent apps, admin controls app permissions, while MCP command execution is decided by the MCP transport/registration and any tool approval layer. The fastest source-file search is usually for where Odysseus dispatches MCP tool calls after the model emits them: search for strings like callTool, tools/call, mcp, and the exact "has no allowed tools" / execution log text if present.

So the short answer: this looks less like Windows sandboxing and more like Odysseus is not actually invoking the local Axon MCP process for that tool call. Prove the MCP server works standalone, then verify the registered transport target in Odysseus.