FlowiseAI/Flowise · error · Error

Argument ' ' contains flag ' ' that is not allowed for…

Error message

Argument '${arg}' contains flag '${flag}' that is not allowed for command '${command}'.

What it means

Thrown by validateCommandFlags when an arg starts with '<lowerCaseFlag>=' — the =-value form of a dangerous flag (e.g. '--node-options=...', '--env-file=...', '--volume=...', '--require=./evil'). The message names both the offending arg and the matched flag so the operator can see which entry in dangerousFlagsByCommand matched.

Solutions

1. Drop the dangerous flag entirely (do not pass --env-file/--volume/--require).
2. Pass the data through allow-listed env vars instead of file-loading flags.
3. If a mount is genuinely needed, run the MCP server outside the validated command path.

Example fix

// before
{ command: 'docker', args: ['run', '--volume=/host:/c', 'img'] }

// after
{ command: 'docker', args: ['run', 'img'] } // no host mount

const flags = (dangerousFlagsByCommand[command] ?? []).map(f => f.toLowerCase())
if (args.some(a => typeof a === 'string' && flags.some(f => a.toLowerCase().trim().startsWith(f + '=')))) {
  throw new Error(`Arg uses =value form of a dangerous flag for ${command}`)
}

const argsHaveNoDangerousEqValueFlags = (command: string, args: string[]): boolean => {
  const flags = (dangerousFlagsByCommand[command] ?? []).map(f => f.toLowerCase())
  return !args.some(a => typeof a === 'string' && flags.some(f => a.toLowerCase().trim().startsWith(f + '=')))
}

try {
  validateCommandFlags(command, args)
} catch (e) {
  if (e.message.includes("contains flag '") && e.message.includes("that is not allowed")) {
    // drop the offending flag=value token
  }
  throw e
}

When it happens

Trigger: validateCommandFlags processes an arg like '--env-file=/etc/passwd' for node, or '--volume=/:/x' for docker, and lowerCaseFlag + '=' matches a dangerous flag prefix.

Common situations: Operator tries to pass configuration via flag=value syntax to avoid the exact-match guard; docker --mount/--volume/--env-file; node --require/--loader with =.

Related errors

• Argument ' ' contains dangerous flag '- ' for command ' '.
• Argument ' ' is not allowed for command ' '.
• Argument contains potentially dangerous characters
• Environment variable
• Command ' ' is not allowed. Permitted

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/58947c945a4005a4. Report an issue: GitHub.

Appendix: source

Thrown at packages/components/nodes/tools/MCP/core.ts:389

    const dangerousFlags = dangerousFlagsByCommand[command] || []

    // Collect single-char dangerous flags (e.g. '-c' -> 'c') for combined flag detection
    const dangerousShortChars = new Set(dangerousFlags.filter((f) => /^-[a-zA-Z]$/.test(f)).map((f) => f[1].toLowerCase()))

    for (const arg of args) {
        if (typeof arg !== 'string') continue

        const normalizedArg = arg.toLowerCase().trim()

        // Check for dangerous flags in various forms (exact, =value, space-separated value)
        for (const flag of dangerousFlags) {
            const lowerCaseFlag = flag.toLowerCase()
            if (normalizedArg === lowerCaseFlag) {
                throw new Error(`Argument '${arg}' is not allowed for command '${command}'.`)
            }
            if (normalizedArg.startsWith(lowerCaseFlag + '=')) {
                throw new Error(`Argument '${arg}' contains flag '${flag}' that is not allowed for command '${command}'.`)
            }
            if (flag.startsWith('-') && normalizedArg.startsWith(lowerCaseFlag + ' ')) {
                throw new Error(`Argument '${arg}' contains flag '${flag}' that is not allowed for command '${command}'.`)
            }
        }

        // Check for combined short flags (e.g. "-yc" = "-y" + "-c")
        // A combined flag starts with a single '-', is not a long flag '--', and has multiple characters after '-'
        if (/^-[a-zA-Z]{2,}/.test(normalizedArg)) {
            const flagChars = normalizedArg.slice(1) // strip leading '-'
            for (const ch of flagChars) {
                if (dangerousShortChars.has(ch)) {
                    throw new Error(`Argument '${arg}' contains dangerous flag '-${ch}' for command '${command}'.`)
                }
            }
        }
    }
}

View on GitHub (pinned to abe4a8601a)