FlowiseAI/Flowise · error · Error

Invalid server configuration

Error message

Invalid server configuration

What it means

Thrown by validateMCPServerConfig as its first check: serverParams must be a non-null object. If it is null, undefined, a primitive, or any non-object, the validator refuses to continue because none of the subsequent property checks would be meaningful.

Source

Thrown at packages/components/nodes/tools/MCP/core.ts:421

                }
            }
        }
    }
}

/**
 * Validates a user-supplied MCP server configuration against operator-controlled allow-lists.
 *
 * For stdio configs, the command must appear in the `CUSTOM_MCP_ALLOWED_COMMANDS` allow-list
 * (comma-separated, empty = none allowed). The list is empty by default, so no command can run
 * until an operator explicitly opts in. To enable local/custom stdio MCP servers, set
 * `CUSTOM_MCP_PROTOCOL=stdio` and `CUSTOM_MCP_ALLOWED_COMMANDS` in your env file
 * (see docker/.env.example, docker/worker/.env.example, packages/server/.env.example).
 */
export const validateMCPServerConfig = (serverParams: any): void => {
    // Validate the entire server configuration
    if (!serverParams || typeof serverParams !== 'object') {
        throw new Error('Invalid server configuration')
    }

    if (serverParams.cwd != null) {
        throw new Error('cwd parameter is not allowed in MCP server configuration')
    }

    // Command allowlist - operator-controlled via CUSTOM_MCP_ALLOWED_COMMANDS (empty = none allowed)
    const allowedCommands = (process.env.CUSTOM_MCP_ALLOWED_COMMANDS ?? '')
        .split(',')
        .map((s) => s.trim())
        .filter(Boolean)

    if (serverParams.command && !allowedCommands.includes(serverParams.command)) {
        throw new Error(`Command '${serverParams.command}' is not allowed. Permitted: ${allowedCommands.join(', ') || '(none)'}`)
    }

    // Validate arguments if present
    if (serverParams.args && Array.isArray(serverParams.args)) {

View on GitHub (pinned to abe4a8601a)

Solutions

1. Ensure the caller constructs and passes a plain object: { command, args, env?, url? }.
2. Guard the caller: if (!serverParams || typeof serverParams !== 'object') surface a clearer UI error before calling the validator.
3. Add a default empty object literal at the call site so undefined never reaches the validator.

Example fix

// before
validateMCPServerConfig(nodeData.inputs?.maybeParams)

// after
const serverParams = nodeData.inputs?.maybeParams ?? {}
validateMCPServerConfig(serverParams)

if (!serverParams || typeof serverParams !== 'object') {
  throw new Error('serverParams must be a plain object')
}

const isPlainObject = (v: unknown): v is Record<string, any> =>
  typeof v === 'object' && v !== null && !Array.isArray(v)

try {
  validateMCPServerConfig(serverParams)
} catch (e) {
  if (e.message === 'Invalid server configuration') {
    // default serverParams to {} or surface a UI error
  }
  throw e
}

When it happens

Trigger: validateMCPServerConfig called with null, undefined, a string, a number, or an array/other non-plain-object value. Reachable from any MCP node that builds serverParams from optional user input that resolved to nothing.

Common situations: Custom MCP node whose input was left blank so serverParams is undefined; a code path that passes the raw nodeData object instead of the constructed serverParams; refactor that accidentally drops the serverParams argument.

Related errors

• Security validation failed: ${error.message}
• Workspace context is required to load MCP server
• Pipedream app slug is required
• No tools available for the Pipedream app slug "${appSlug}".
• Security validation failed: ${error.message}

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/6a11fdca49e61bf7. Report an issue: GitHub.