@@ -320,17 +320,26 @@ run_scenarios_in_runner_container() {
   scenario_list="$(scenario_list_for_args "$@")"
   if [ -z "${scenario_list}" ]; then
     echo "ERROR: no MCP conformance scenarios resolved." >&2
-    exit 2
+    return 2
   fi
 
+  bridge_port="$(e2e_pick_port)"
+  create_client_sandbox || return 1
+  start_host_bridge "${bridge_port}" || return 1
+  create_runner_container || return 1
+
+  bridge_host="$(host_bridge_hostname)"
+  echo "MCP conformance host bridge callback: http://${bridge_host}:${bridge_port}/run" >&2
+
   for scenario in ${scenario_list}; do
     echo "=== MCP conformance: ${scenario} ==="
-    if node "${CONFORMANCE_DIR}/dist/index.js" client \
-      --command "bash e2e/mcp-conformance/client-through-openshell.sh" \
-      --scenario "${scenario}" \
-      --spec-version "${SPEC_VERSION}" \
-      --expected-failures "${ROOT}/e2e/mcp-conformance/expected-failures.yml" \
-      --timeout "${TIMEOUT_MS}"; then
+    # shellcheck disable=SC2016
+    if docker exec \
+      --env "MCP_CONFORMANCE_HOST_BRIDGE_URL=http://${bridge_host}:${bridge_port}/run" \
+      "${RUNNER_CONTAINER}" \
+      sh -c 'cd /opt/mcp-conformance && exec node dist/index.js client --command "node /tmp/openshell-mcp-runner-shim.mjs" --scenario "$1" --spec-version "$2" --expected-failures "$3" --timeout "$4"' \
+      sh "${scenario}" "${SPEC_VERSION}" "/tmp/expected-failures.yml" "${TIMEOUT_MS}" \
+      </dev/null; then
       passed+=("${scenario}")
     else
       failed+=("${scenario}")
 
@@ -0,0 +1,87 @@
+#!/usr/bin/env python3
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+"""Host bridge for the MCP conformance runner.
+
+The conformance runner runs in an isolated container and posts the URL of its
+MCP test server to this bridge. The bridge runs the real MCP client inside an
+OpenShell sandbox (via client-through-openshell.sh) and returns its result, so
+the untrusted runner never needs gateway credentials.
+
+Usage: host-bridge.py <port> <repo-root> <log-path>
+"""
+
+import json
+import os
+import subprocess
+import sys
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+
+PORT = int(sys.argv[1])
+ROOT = Path(sys.argv[2])
+LOG_PATH = Path(sys.argv[3])
+TIMEOUT = int(os.environ.get("OPENSHELL_MCP_CONFORMANCE_CLIENT_TIMEOUT_SECONDS", "120")) + 30
+
+
+def log(message: str) -> None:
+    with LOG_PATH.open("a", encoding="utf-8") as fh:
+        fh.write(message + "\n")
+
+
+class Handler(BaseHTTPRequestHandler):
+    def do_POST(self) -> None:
+        if self.path != "/run":
+            self.send_response(404)
+            self.end_headers()
+            return
+        length = int(self.headers.get("content-length", "0"))
+        payload = json.loads(self.rfile.read(length))
+        server_url = payload["server_url"]
+        env = os.environ.copy()
+        env.update(payload.get("env", {}))
+        env.pop("MISE_GITHUB_TOKEN", None)
+        log(f"running client for {server_url}")
+        try:
+            result = subprocess.run(
+                ["bash", "e2e/mcp-conformance/client-through-openshell.sh", server_url],
+                cwd=ROOT,
+                env=env,
+                stdin=subprocess.DEVNULL,
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                text=True,
+                timeout=TIMEOUT,
+            )
+            log(f"client exited {result.returncode} for {server_url}")
+            body = {
+                "exit_code": result.returncode,
+                "stdout": result.stdout,
+                "stderr": result.stderr,
+            }
+        except subprocess.TimeoutExpired as err:
+            body = {
+                "exit_code": 124,
+                "stdout": err.stdout or "",
+                "stderr": (err.stderr or "") + f"\nhost bridge timed out after {TIMEOUT}s\n",
+            }
+        encoded = json.dumps(body).encode("utf-8")
+        self.send_response(200)
+        self.send_header("content-type", "application/json")
+        self.send_header("content-length", str(len(encoded)))
+        self.end_headers()
+        self.wfile.write(encoded)
+
+    def log_message(self, fmt: str, *args: object) -> None:
+        log(fmt % args)
+
+
+def main() -> None:
+    server = ThreadingHTTPServer(("0.0.0.0", PORT), Handler)
+    log(f"host bridge listening on {PORT}")
+    server.serve_forever()
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,47 @@
+#!/usr/bin/env python3
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+"""Render the OpenShell client policy for a conformance server URL.
+
+Parses the server URL into host/port/path, substitutes them into
+policy-template.yaml, writes the rendered policy, and prints the (possibly
+rewritten) URL the client should connect to. Used both to seed the reusable
+client sandbox with a placeholder policy and to install the per-scenario policy
+in client-through-openshell.sh.
+
+Usage: render-policy.py <server-url> <policy-file> <policy-template>
+"""
+
+import json
+import string
+import sys
+from pathlib import Path
+from urllib.parse import urlparse, urlunparse
+
+raw_url, policy_file, policy_template = sys.argv[1:4]
+parsed = urlparse(raw_url)
+
+if parsed.scheme not in ("http", "https"):
+    raise SystemExit(f"unsupported conformance server URL scheme: {parsed.scheme!r}")
+
+host = parsed.hostname
+if not host:
+    raise SystemExit(f"conformance server URL is missing a host: {raw_url}")
+
+target_host = "host.openshell.internal" if host in {"localhost", "127.0.0.1", "::1"} else host
+port = parsed.port or (443 if parsed.scheme == "https" else 80)
+path = parsed.path or "/"
+netloc_host = f"[{target_host}]" if ":" in target_host and not target_host.startswith("[") else target_host
+netloc = f"{netloc_host}:{port}"
+rewritten = urlunparse((parsed.scheme, netloc, path, parsed.params, parsed.query, parsed.fragment))
+
+template = string.Template(Path(policy_template).read_text(encoding="utf-8"))
+policy = template.substitute(
+    host_spec=f"host: {json.dumps(target_host)}",
+    port_spec=f"        port: {port}",
+    path=json.dumps(path),
+)
+Path(policy_file).write_text(policy, encoding="utf-8")
+
+print(rewritten)
@@ -0,0 +1,131 @@
+// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// Client command for the upstream MCP conformance runner, executed inside the
+// runner container.
+//
+// Why this indirection exists: the conformance runner runs untrusted upstream
+// node off the host, so it deliberately has no openshell binary and no gateway
+// credentials. But the MCP client under test must run inside an OpenShell
+// sandbox so its traffic crosses the policy-enforced proxy (the whole point of
+// the e2e). This script bridges that gap without widening the runner's
+// privileges: instead of running the MCP client itself, it posts the test
+// server URL to the host bridge, which holds the gateway credentials and runs
+// the real client in a sandbox, then returns its result. The runner can only
+// ask "run a client against this URL" — it cannot touch the gateway control
+// plane.
+
+import http from 'node:http';
+import os from 'node:os';
+import process from 'node:process';
+
+// Resolve the routable IPv4 address of the runner container on the e2e Docker
+// network. The conformance runner reports its test server URL as localhost; the
+// client sandbox connects from a different container, so localhost must be
+// rewritten to this container's network address.
+function runnerAddress() {
+  for (const addrs of Object.values(os.networkInterfaces())) {
+    for (const addr of addrs ?? []) {
+      if (addr.family === 'IPv4' && !addr.internal) {
+        return addr.address;
+      }
+    }
+  }
+  throw new Error('failed to resolve runner container IPv4 address');
+}
+
+function rewriteServerUrl(rawUrl) {
+  const url = new URL(rawUrl);
+  if (['localhost', '127.0.0.1', '[::1]', '::1'].includes(url.hostname)) {
+    url.hostname = runnerAddress();
+  }
+  return url.toString();
+}
+
+const bridgeUrl = process.env.MCP_CONFORMANCE_HOST_BRIDGE_URL;
+if (!bridgeUrl) {
+  throw new Error('MCP_CONFORMANCE_HOST_BRIDGE_URL is required');
+}
+const parsedBridgeUrl = new URL(bridgeUrl);
+if (parsedBridgeUrl.protocol !== 'http:') {
+  throw new Error(`bridge URL must use http:, got ${parsedBridgeUrl.protocol}`);
+}
+const serverUrl = process.argv[2];
+if (!serverUrl) {
+  throw new Error('usage: node runner-shim.mjs <server-url>');
+}
+
+// POST the rewritten server URL to the host bridge, which runs the real MCP
+// client inside an OpenShell sandbox and returns its result. The runner is a
+// plain container with ordinary egress, so this is a direct HTTP call.
+function postJson(url, payload) {
+  const body = Buffer.from(JSON.stringify(payload), 'utf8');
+  const timeoutMs = Number.parseInt(process.env.MCP_CONFORMANCE_HOST_BRIDGE_TIMEOUT_MS ?? '600000', 10);
+
+  function snippet(raw) {
+    return raw.length > 4096 ? `${raw.slice(0, 4096)}...` : raw;
+  }
+
+  return new Promise((resolve, reject) => {
+    const request = http.request({
+      hostname: url.hostname,
+      port: url.port || 80,
+      path: `${url.pathname}${url.search}`,
+      method: 'POST',
+      headers: {
+        'content-type': 'application/json',
+        'content-length': body.length,
+      },
+      agent: false,
+    }, (response) => {
+      const chunks = [];
+      response.on('data', (chunk) => chunks.push(chunk));
+      response.on('end', () => {
+        const raw = Buffer.concat(chunks).toString('utf8');
+        const statusCode = response.statusCode ?? 0;
+        try {
+          const parsed = JSON.parse(raw);
+          if (statusCode < 200 || statusCode >= 300) {
+            reject(new Error(`bridge callback failed (HTTP ${statusCode}): ${snippet(raw)}`));
+            return;
+          }
+          resolve(parsed);
+        } catch (error) {
+          reject(new Error(`bridge returned invalid JSON (HTTP ${statusCode}): ${snippet(raw) || error.message}`));
+        }
+      });
+    });
+    request.on('error', reject);
+    request.setTimeout(timeoutMs, () => {
+      request.destroy(new Error(`bridge callback timed out after ${timeoutMs}ms to ${url.toString()}`));
+    });
+    request.end(body);
+  });
+}
+
+const forwardedEnv = {};
+for (const name of [
+  'MCP_CONFORMANCE_SCENARIO',
+  'MCP_CONFORMANCE_CONTEXT',
+  'MCP_CONFORMANCE_PROTOCOL_VERSION',
+]) {
+  if (process.env[name] !== undefined) {
+    forwardedEnv[name] = process.env[name];
+  }
+}
+
+const body = await postJson(parsedBridgeUrl, {
+  server_url: rewriteServerUrl(serverUrl),
+  env: forwardedEnv,
+});
+if (typeof body.exit_code !== 'number') {
+  const raw = JSON.stringify(body);
+  throw new Error(`bridge returned JSON without numeric exit_code: ${raw.length > 4096 ? `${raw.slice(0, 4096)}...` : raw}`);
+}
+if (body.stdout) {
+  process.stdout.write(body.stdout);
+}
+if (body.stderr) {
+  process.stderr.write(body.stderr);
+}
+process.exit(body.exit_code);