What causes "command cannot be empty" in Tencent/WeKnora?

Set a valid command in the MCP stdio config (e.g. "npx", "uvx", "node")

command cannot be empty

Error message

command cannot be empty

What it means

ValidateStdioCommand validates the command used for MCP stdio transport. It rejects an empty command string before any whitelist or pattern checks run. Stdio transport spawns a local process, so a concrete command is mandatory.

Source

Thrown at internal/utils/security.go:535

// DangerousEnvVarPatterns contains patterns for dangerous environment variable names or values
var DangerousEnvVarPatterns = []*regexp.Regexp{
	regexp.MustCompile(`(?i)^LD_PRELOAD$`),      // Library injection
	regexp.MustCompile(`(?i)^LD_LIBRARY_PATH$`), // Library path manipulation
	regexp.MustCompile(`(?i)^DYLD_`),            // macOS dynamic linker
	regexp.MustCompile(`(?i)^PATH$`),            // PATH manipulation
	regexp.MustCompile(`(?i)^PYTHONPATH$`),      // Python path manipulation
	regexp.MustCompile(`(?i)^NODE_OPTIONS$`),    // Node.js options injection
	regexp.MustCompile(`(?i)^BASH_ENV$`),        // Bash environment file
	regexp.MustCompile(`(?i)^ENV$`),             // Shell environment file
	regexp.MustCompile(`(?i)^SHELL$`),           // Shell override
}

// ValidateStdioCommand validates the command for MCP stdio transport
// Returns an error if the command is not in the whitelist or contains dangerous patterns
func ValidateStdioCommand(command string) error {
	if command == "" {
		return fmt.Errorf("command cannot be empty")
	}

	// Normalize command (extract base name if it's a path)
	baseCommand := command
	if strings.Contains(command, "/") {
		parts := strings.Split(command, "/")
		baseCommand = parts[len(parts)-1]
	}

	// Check against whitelist
	if !AllowedStdioCommands[baseCommand] {
		return fmt.Errorf("command '%s' is not in the allowed list. Allowed commands: uvx, npx, node, python, python3, deno, bun", baseCommand)
	}

	// Additional check: command should not contain path traversal
	if strings.Contains(command, "..") {
		return fmt.Errorf("command path contains invalid characters")
	}

View on GitHub (pinned to 988cbb0330)

Solutions

Set a valid command in the MCP stdio config (e.g. "npx", "uvx", "node")
Check that the config file/JSON actually populates the command field and the key name is correct
If the command comes from an env var, verify it is set and non-empty before building the config

Example fix

// before
{"mcpServers": {"fetch": {"command": "", "args": ["mcp-server-fetch"]}}}
// after
{"mcpServers": {"fetch": {"command": "uvx", "args": ["mcp-server-fetch"]}}}

Defensive patterns

Strategy: validation

Validate before calling

if strings.TrimSpace(cfg.Command) == "" {
    return fmt.Errorf("mcp stdio config requires a non-empty command")
}
err := ValidateStdioConfig(cfg)

Try / catch

if err := ValidateStdioConfig(cfg); err != nil {
    if strings.Contains(err.Error(), "command cannot be empty") {
        return fmt.Errorf("config error: mcpServers[%q].command is missing", name)
    }
    return err
}

Prevention

Validate required config fields (command) at config-load time
Give defaults in config schemas or fail fast with field-level messages
Check for key typos when a command field appears empty

When it happens

Trigger: Calling ValidateStdioCommand (via ValidateStdioConfig) with an empty string command, typically from an MCP server config where the "command" field is missing, blank, or only whitespace was trimmed elsewhere but not here.

Common situations: Config file with "command": ""; JSON/YAML key typo leaving the field unset; environment-driven config where a required env var was empty; programmatic config construction skipping the command field.

Related errors

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/d765a1fe123e03a9. Report an issue: GitHub.