CherryHQ/cherry-studio · error · Error

Invalid args: argument at index ${index} must be a string

Error message

Invalid args: argument at index ${index} must be a string

What it means

Thrown by validateArgs() during the per-element map when an argument at the given index is not of type string. The function iterates the args array and type-checks each element before checking for null bytes or path traversal. The error message includes the offending index for easy identification.

Source

Thrown at src/main/ai/mcp/McpPackageService.ts:179

  return trimmed
}

/**
 * Validate command arguments to prevent injection attacks.
 * Rejects arguments containing path traversal sequences.
 *
 * @param args - The arguments array to validate
 * @returns The validated arguments array
 * @throws Error if any argument contains path traversal
 */
export function validateArgs(args: string[]): string[] {
  if (!Array.isArray(args)) {
    throw new Error('Invalid args: must be an array')
  }

  return args.map((arg, index) => {
    if (typeof arg !== 'string') {
      throw new Error(`Invalid args: argument at index ${index} must be a string`)
    }

    // Check for null bytes
    if (arg.includes('\0')) {
      throw new Error(`Invalid args: null byte detected in argument at index ${index}`)
    }

    // Check for path traversal in arguments that look like paths
    // Only validate if the arg contains path separators (indicating it's meant to be a path)
    if ((arg.includes('/') || arg.includes('\\')) && /(?:^|[/\\])\.\.(?:[/\\]|$)/.test(arg)) {
      throw new Error(`Invalid args: path traversal detected in argument at index ${index}`)
    }

    return arg
  })
}

export function performVariableSubstitution(

View on GitHub (pinned to 726446b54c)

Solutions

1. Ensure every element in the manifest's args array is a string. Convert numbers or other types to strings if needed.
2. If using variable substitution, verify user_config values are strings.
3. Validate the manifest with a schema that enforces items: { type: 'string' } on the args array.

Example fix

// before (manifest fragment)
"args": ["--port", 3000]

// after
"args": ["--port", "3000"]

// Validate each arg is a string before calling validateArgs
if (!args.every(arg => typeof arg === 'string')) {
  const badIndex = args.findIndex(arg => typeof arg !== 'string')
  throw new Error(`Argument at index ${badIndex} is not a string`)
}

function isStringArray(value: unknown): value is string[] {
  return Array.isArray(value) && value.every(item => typeof item === 'string')
}

When it happens

Trigger: Called from resolveMcpConfig at line 359. Triggers when the args array contains non-string elements — e.g., [123], ['--port', null], ['--config', { key: 'value' }]. Variable substitution could also introduce a non-string if a user_config value is not a string.

Common situations: A manifest author mixed types in the args array (numbers, booleans, nulls); a JSON parsing edge case converted a value; variable substitution from user_config injected a non-string; a platform_override replaced the args with a mixed-type array.

Related errors

• Invalid args: must be an array
• Invalid command: command must be a non-empty string
• Invalid command: command cannot be empty
• Invalid args: path traversal detected in argument at index $
• Invalid MCP package env: null byte detected in environment v

AI-assisted analysis of CherryHQ/cherry-studio@726446b54c (2026-08-12). Data as JSON: /api/errors/4671c3cb705d2e24. Report an issue: GitHub.