FlowiseAI/Flowise · error · Error

Environment variable '${key}' is not allowed. Permitted: ${[

Error message

Environment variable '${key}' is not allowed. Permitted: ${[...allowedEnvVars].join(', ') || '(none)'}

What it means

Thrown by validateEnvironmentVariables when an env key passed to the MCP server is not in the operator-controlled CUSTOM_MCP_ALLOWED_ENV_VARS allow-list. The allow-list is built by splitting that env var on commas; default empty means no user env vars are forwarded. The message echoes both the offending key and the current permitted set (or '(none)').

Source

Thrown at packages/components/nodes/tools/MCP/core.ts:301

        }
    }
}

/**
 * Validates user-supplied env vars against the operator-controlled allow-list in
 * `CUSTOM_MCP_ALLOWED_ENV_VARS` (comma-separated names). Empty = none allowed.
 */
export const validateEnvironmentVariables = (env: Record<string, any>): void => {
    const allowedEnvVars = new Set(
        (process.env.CUSTOM_MCP_ALLOWED_ENV_VARS ?? '')
            .split(',')
            .map((s) => s.trim())
            .filter(Boolean)
    )

    for (const [key, value] of Object.entries(env)) {
        if (!allowedEnvVars.has(key)) {
            throw new Error(`Environment variable '${key}' is not allowed. Permitted: ${[...allowedEnvVars].join(', ') || '(none)'}`)
        }

        if (typeof value === 'string' && value.includes('\0')) {
            throw new Error(`Environment variable '${key}' contains null byte`)
        }
    }
}

/**
 * Validates that command arguments don't contain flags that enable arbitrary code execution
 * This prevents attacks where whitelisted commands are used with dangerous flags
 * (e.g., "npx -c malicious-command" or "python -c malicious-code")
 * @param command The command to validate
 * @param args The arguments to validate
 */
export const validateCommandFlags = (command: string, args: string[]): void => {
    // Define dangerous flags for each command that enable code execution
    const dangerousFlagsByCommand: Record<string, string[]> = {

View on GitHub (pinned to abe4a8601a)

Solutions

Add the exact env var name(s) to CUSTOM_MCP_ALLOWED_ENV_VARS (comma-separated).
Remove env keys from serverParams.env that the MCP server does not actually need.
Restart the worker after editing the env file so the new allow-list is loaded.

Example fix

# before
# CUSTOM_MCP_ALLOWED_ENV_VARS=

# after
CUSTOM_MCP_ALLOWED_ENV_VARS=API_KEY,HOME,DEBUG

Defensive patterns

Strategy: validation

Validate before calling

const allowed = new Set((process.env.CUSTOM_MCP_ALLOWED_ENV_VARS ?? '').split(',').map(s => s.trim()).filter(Boolean))
const offenders = Object.keys(env).filter(k => !allowed.has(k))
if (offenders.length) {
  throw new Error(`Env vars not allow-listed: ${offenders.join(', ')}. Add to CUSTOM_MCP_ALLOWED_ENV_VARS`)
}

Type guard

const envKeysAllowed = (env: Record<string, any>): boolean => {
  const allowed = new Set((process.env.CUSTOM_MCP_ALLOWED_ENV_VARS ?? '').split(',').map(s => s.trim()).filter(Boolean))
  return Object.keys(env).every(k => allowed.has(k))
}

Try / catch

try {
  validateEnvironmentVariables(env)
} catch (e) {
  if (e.message.includes('is not allowed')) {
    // add the named key to CUSTOM_MCP_ALLOWED_ENV_VARS or drop it from env
  }
  throw e
}

Prevention

Maintain the allow-list as part of deployment config and review it on each release.
Forward only the env vars the MCP server truly needs.
Add a CI check that diffs requested env names against the allow-list.

When it happens

Trigger: validateEnvironmentVariables(env) called from validateMCPServerConfig when serverParams.env is present, and env contains a key not in CUSTOM_MCP_ALLOWED_ENV_VARS.

Common situations: Custom MCP node forwards API keys or config via serverParams.env but the operator never allow-listed those names; env var name typo; new deployment without the allow-list configured.

Related errors

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/abbe41fbc8feb718. Report an issue: GitHub.