FlowiseAI/Flowise · error · Error

Environment variable

Error message

Environment variable '${key}' is not allowed. Permitted: ${[...allowedEnvVars].join(', ') || '(none)'}

What it means

Thrown by validateEnvironmentVariables when an env key passed to the MCP server is not in the operator-controlled CUSTOM_MCP_ALLOWED_ENV_VARS allow-list. The allow-list is built by splitting that env var on commas; default empty means no user env vars are forwarded. The message echoes both the offending key and the current permitted set (or '(none)').

Solutions

Add the exact env var name(s) to CUSTOM_MCP_ALLOWED_ENV_VARS (comma-separated).
Remove env keys from serverParams.env that the MCP server does not actually need.
Restart the worker after editing the env file so the new allow-list is loaded.

Example fix

# before
# CUSTOM_MCP_ALLOWED_ENV_VARS=

# after
CUSTOM_MCP_ALLOWED_ENV_VARS=API_KEY,HOME,DEBUG

Defensive patterns

Strategy: validation

Validate before calling

const allowed = new Set((process.env.CUSTOM_MCP_ALLOWED_ENV_VARS ?? '').split(',').map(s => s.trim()).filter(Boolean))
const offenders = Object.keys(env).filter(k => !allowed.has(k))
if (offenders.length) {
  throw new Error(`Env vars not allow-listed: ${offenders.join(', ')}. Add to CUSTOM_MCP_ALLOWED_ENV_VARS`)
}

Type guard

const envKeysAllowed = (env: Record<string, any>): boolean => {
  const allowed = new Set((process.env.CUSTOM_MCP_ALLOWED_ENV_VARS ?? '').split(',').map(s => s.trim()).filter(Boolean))
  return Object.keys(env).every(k => allowed.has(k))
}

Try / catch

try {
  validateEnvironmentVariables(env)
} catch (e) {
  if (e.message.includes('is not allowed')) {
    // add the named key to CUSTOM_MCP_ALLOWED_ENV_VARS or drop it from env
  }
  throw e
}

Prevention

Maintain the allow-list as part of deployment config and review it on each release.
Forward only the env vars the MCP server truly needs.
Add a CI check that diffs requested env names against the allow-list.

When it happens

Trigger: validateEnvironmentVariables(env) called from validateMCPServerConfig when serverParams.env is present, and env contains a key not in CUSTOM_MCP_ALLOWED_ENV_VARS.

Common situations: Custom MCP node forwards API keys or config via serverParams.env but the operator never allow-listed those names; env var name typo; new deployment without the allow-list configured.

Related errors

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/abbe41fbc8feb718. Report an issue: GitHub.

Appendix: source

Thrown at packages/components/nodes/tools/MCP/core.ts:301

        }
    }
}

/**
 * Validates user-supplied env vars against the operator-controlled allow-list in
 * `CUSTOM_MCP_ALLOWED_ENV_VARS` (comma-separated names). Empty = none allowed.
 */
export const validateEnvironmentVariables = (env: Record<string, any>): void => {
    const allowedEnvVars = new Set(
        (process.env.CUSTOM_MCP_ALLOWED_ENV_VARS ?? '')
            .split(',')
            .map((s) => s.trim())
            .filter(Boolean)
    )

    for (const [key, value] of Object.entries(env)) {
        if (!allowedEnvVars.has(key)) {
            throw new Error(`Environment variable '${key}' is not allowed. Permitted: ${[...allowedEnvVars].join(', ') || '(none)'}`)
        }

        if (typeof value === 'string' && value.includes('\0')) {
            throw new Error(`Environment variable '${key}' contains null byte`)
        }
    }
}

/**
 * Validates that command arguments don't contain flags that enable arbitrary code execution
 * This prevents attacks where whitelisted commands are used with dangerous flags
 * (e.g., "npx -c malicious-command" or "python -c malicious-code")
 * @param command The command to validate
 * @param args The arguments to validate
 */
export const validateCommandFlags = (command: string, args: string[]): void => {
    // Define dangerous flags for each command that enable code execution
    const dangerousFlagsByCommand: Record<string, string[]> = {

View on GitHub (pinned to abe4a8601a)