CherryHQ/cherry-studio · error · Error

Invalid args: argument at index

Error message

Invalid args: argument at index ${index} must be a string

What it means

Thrown by validateArgs() during the per-element map when an argument at the given index is not of type string. The function iterates the args array and type-checks each element before checking for null bytes or path traversal. The error message includes the offending index for easy identification.

Solutions

1. Ensure every element in the manifest's args array is a string. Convert numbers or other types to strings if needed.
2. If using variable substitution, verify user_config values are strings.
3. Validate the manifest with a schema that enforces items: { type: 'string' } on the args array.

Example fix

// before (manifest fragment)
"args": ["--port", 3000]

// after
"args": ["--port", "3000"]

// Validate each arg is a string before calling validateArgs
if (!args.every(arg => typeof arg === 'string')) {
  const badIndex = args.findIndex(arg => typeof arg !== 'string')
  throw new Error(`Argument at index ${badIndex} is not a string`)
}

function isStringArray(value: unknown): value is string[] {
  return Array.isArray(value) && value.every(item => typeof item === 'string')
}

When it happens

Trigger: Called from resolveMcpConfig at line 359. Triggers when the args array contains non-string elements — e.g., [123], ['--port', null], ['--config', { key: 'value' }]. Variable substitution could also introduce a non-string if a user_config value is not a string.

Common situations: A manifest author mixed types in the args array (numbers, booleans, nulls); a JSON parsing edge case converted a value; variable substitution from user_config injected a non-string; a platform_override replaced the args with a mixed-type array.

Related errors

• Invalid args: must be an array
• Invalid args: path traversal detected in argument at index
• Invalid command: command cannot be empty
• Invalid command: command must be a non-empty string
• Invalid manifest: missing dxt_version

AI-assisted analysis of CherryHQ/cherry-studio@726446b54c (2026-08-12). Data as JSON: /api/errors/4671c3cb705d2e24. Report an issue: GitHub.

Appendix: source

Thrown at src/main/ai/mcp/McpPackageService.ts:179

  return trimmed
}

/**
 * Validate command arguments to prevent injection attacks.
 * Rejects arguments containing path traversal sequences.
 *
 * @param args - The arguments array to validate
 * @returns The validated arguments array
 * @throws Error if any argument contains path traversal
 */
export function validateArgs(args: string[]): string[] {
  if (!Array.isArray(args)) {
    throw new Error('Invalid args: must be an array')
  }

  return args.map((arg, index) => {
    if (typeof arg !== 'string') {
      throw new Error(`Invalid args: argument at index ${index} must be a string`)
    }

    // Check for null bytes
    if (arg.includes('\0')) {
      throw new Error(`Invalid args: null byte detected in argument at index ${index}`)
    }

    // Check for path traversal in arguments that look like paths
    // Only validate if the arg contains path separators (indicating it's meant to be a path)
    if ((arg.includes('/') || arg.includes('\\')) && /(?:^|[/\\])\.\.(?:[/\\]|$)/.test(arg)) {
      throw new Error(`Invalid args: path traversal detected in argument at index ${index}`)
    }

    return arg
  })
}

export function performVariableSubstitution(

View on GitHub (pinned to 726446b54c)