FlowiseAI/Flowise · error · Error

Command '${serverParams.command}' is not allowed. Permitted:

Error message

Command '${serverParams.command}' is not allowed. Permitted: ${allowedCommands.join(', ') || '(none)'}

What it means

Thrown by validateMCPServerConfig when serverParams.command is truthy but not present in CUSTOM_MCP_ALLOWED_COMMANDS. The allow-list is comma-split from that env var; default empty means no command is permitted. The message names the rejected command and lists the currently permitted set (or '(none)').

Source

Thrown at packages/components/nodes/tools/MCP/core.ts:435

 */
export const validateMCPServerConfig = (serverParams: any): void => {
    // Validate the entire server configuration
    if (!serverParams || typeof serverParams !== 'object') {
        throw new Error('Invalid server configuration')
    }

    if (serverParams.cwd != null) {
        throw new Error('cwd parameter is not allowed in MCP server configuration')
    }

    // Command allowlist - operator-controlled via CUSTOM_MCP_ALLOWED_COMMANDS (empty = none allowed)
    const allowedCommands = (process.env.CUSTOM_MCP_ALLOWED_COMMANDS ?? '')
        .split(',')
        .map((s) => s.trim())
        .filter(Boolean)

    if (serverParams.command && !allowedCommands.includes(serverParams.command)) {
        throw new Error(`Command '${serverParams.command}' is not allowed. Permitted: ${allowedCommands.join(', ') || '(none)'}`)
    }

    // Validate arguments if present
    if (serverParams.args && Array.isArray(serverParams.args)) {
        validateArgsForLocalFileAccess(serverParams.args)
        validateCommandInjection(serverParams.args)

        // Validate command-specific dangerous flags
        if (serverParams.command) {
            validateCommandFlags(serverParams.command, serverParams.args)
        }
    }

    // Validate environment variables
    if (serverParams.env) {
        validateEnvironmentVariables(serverParams.env)
    }
}

View on GitHub (pinned to abe4a8601a)

Solutions

Add the exact command string to CUSTOM_MCP_ALLOWED_COMMANDS (e.g. CUSTOM_MCP_ALLOWED_COMMANDS=node,npx).
Restart the worker so the env var is re-read.
If the command is user-controlled, restrict the input to the allow-list at the UI layer.

Example fix

# before
# CUSTOM_MCP_ALLOWED_COMMANDS=

# after
CUSTOM_MCP_ALLOWED_COMMANDS=node

Defensive patterns

Strategy: validation

Validate before calling

const allowed = (process.env.CUSTOM_MCP_ALLOWED_COMMANDS ?? '').split(',').map(s => s.trim()).filter(Boolean)
if (serverParams.command && !allowed.includes(serverParams.command)) {
  throw new Error(`Add '${serverParams.command}' to CUSTOM_MCP_ALLOWED_COMMANDS or pick an allowed command: ${allowed.join(', ') || '(none)'}`)
}

Type guard

const commandAllowed = (command: string): boolean => {
  const allowed = (process.env.CUSTOM_MCP_ALLOWED_COMMANDS ?? '').split(',').map(s => s.trim()).filter(Boolean)
  return allowed.includes(command)
}

Try / catch

try {
  validateMCPServerConfig(serverParams)
} catch (e) {
  if (e.message.startsWith('Command ') && e.message.includes('is not allowed')) {
    // add the command to CUSTOM_MCP_ALLOWED_COMMANDS, restart worker
  }
  throw e
}

Prevention

Configure CUSTOM_MCP_ALLOWED_COMMANDS at deploy time with every command the deployment uses.
Restart the worker after editing env so the new allow-list takes effect.
Restrict user-chosen command inputs to the allow-list in the UI.

When it happens

Trigger: validateMCPServerConfig receives a serverParams with command set (e.g. 'node', 'npx', 'python', 'docker') and CUSTOM_MCP_ALLOWED_COMMANDS does not contain it. Reachable from Supergateway (hardcoded 'node') and any custom stdio MCP node.

Common situations: Default deploy with no allow-list configured; operator allow-listed 'nodejs' instead of 'node'; command pulled from user input that the operator did not anticipate.

Related errors

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/16835fdeaf88996f. Report an issue: GitHub.