FlowiseAI/Flowise · error · Error

Security validation failed: ${error.message}

Error message

Security validation failed: ${error.message}

What it means

Thrown by the Supergateway MCP node when its inner call to validateMCPServerConfig rejects the constructed serverParams. The node hardcodes command to 'node' and builds args from getNodeModulesPackagePath('supergateway/dist/index.js') plus the user-supplied _args string, then passes that object through the operator-controlled allow-list validator. The wrapper merely prefixes 'Security validation failed:' onto the underlying validator's message, so the real reason is in error.message after the colon.

Source

Thrown at packages/components/nodes/tools/MCP/Supergateway/SupergatewayMCP.ts:113

            .split(/\s+/)
            .map((arg) => {
                // Remove surrounding double or single quotes if they exist
                if ((arg.startsWith('"') && arg.endsWith('"')) || (arg.startsWith("'") && arg.endsWith("'"))) {
                    return arg.slice(1, -1)
                }
                return arg
            })

        const serverParams = {
            command: 'node',
            args: [packagePath, ...processedArgs]
        }

        if (process.env.CUSTOM_MCP_SECURITY_CHECK !== 'false') {
            try {
                validateMCPServerConfig(serverParams)
            } catch (error) {
                throw new Error(`Security validation failed: ${error.message}`)
            }
        }

        const toolkit = new MCPToolkit(serverParams, 'stdio')
        await toolkit.initialize()

        const tools = toolkit.tools ?? []

        return tools as Tool[]
    }
}

module.exports = { nodeClass: Supergateway_MCP }

View on GitHub (pinned to abe4a8601a)

Solutions

1. Read the text after 'Security validation failed:' to identify which sub-validator rejected the config (command allow-list, arg injection, flag, env).
2. Add 'node' to CUSTOM_MCP_ALLOWED_COMMANDS in the worker env (e.g. CUSTOM_MCP_ALLOWED_COMMANDS=node) since the command is hardcoded to node.
3. Sanitize the node's _args input so it contains no shell metacharacters and no node-dangerous flags (-e, --eval, -r, --require, --loader, --inspect, --env-file, etc.).
4. To bypass entirely for a trusted operator-only deployment, set CUSTOM_MCP_SECURITY_CHECK=false (disables the check globally; only acceptable on isolated hosts).

Example fix

// before: operator env unset, node not allow-listed
// .env (worker)
// CUSTOM_MCP_ALLOWED_COMMANDS=

// after
CUSTOM_MCP_ALLOWED_COMMANDS=node
CUSTOM_MCP_PROTOCOL=stdio

// Before calling the node, confirm operator env is configured for the hardcoded 'node' command.
const allowed = (process.env.CUSTOM_MCP_ALLOWED_COMMANDS ?? '').split(',').map(s => s.trim()).filter(Boolean)
if (process.env.CUSTOM_MCP_SECURITY_CHECK !== 'false' && !allowed.includes('node')) {
  throw new Error('Set CUSTOM_MCP_ALLOWED_COMMANDS=node before using the Supergateway MCP node')
}

const isServerParams = (v: unknown): v is { command: string; args: string[] } =>
  typeof v === 'object' && v !== null && typeof (v as any).command === 'string' && Array.isArray((v as any).args)

try {
  const tools = await supergatewayNode.getTools(nodeData, options)
} catch (e) {
  if (e.message.startsWith('Security validation failed:')) {
    // surface the underlying validator reason, then fix env / args
  }
  throw e
}

When it happens

Trigger: Supergateway_MCP.getTools runs with CUSTOM_MCP_SECURITY_CHECK !== 'false' (the default), and validateMCPServerConfig throws for any of: 'node' not in CUSTOM_MCP_ALLOWED_COMMANDS, an arg failing validateArgsForLocalFileAccess/validateCommandInjection/validateCommandFlags, env vars not in CUSTOM_MCP_ALLOWED_ENV_VARS, or a cwd field being set.

Common situations: Fresh deploy where the operator has not set CUSTOM_MCP_ALLOWED_COMMANDS=node yet; a user passing flags like --inspect or -e in the arguments string (caught by validateCommandFlags for node); quoting the supergateway path with shell metacharacters; setting CUSTOM_MCP_PROTOCOL=stdio without also allow-listing 'node'.

Related errors

• Custom MCP script execution disabled. Configure CUSTOM_MCP_A
• Environment variable '${key}' is not allowed. Permitted: ${[
• Invalid server configuration
• cwd parameter is not allowed in MCP server configuration
• Command '${serverParams.command}' is not allowed. Permitted:

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/bd48c393225c8eda. Report an issue: GitHub.