Tencent/WeKnora · error

command '%s' is not in the allowed list. Allowed commands: u

Error message

command '%s' is not in the allowed list. Allowed commands: uvx, npx, node, python, python3, deno, bun

What it means

ValidateStdioCommand enforces a whitelist of executables allowed for MCP stdio transport: uvx, npx, node, python, python3, deno, bun. Any command whose base name (after stripping path segments) is not in AllowedStdioCommands is rejected with the full allowed list in the message.

Source

Thrown at internal/utils/security.go:547

}

// ValidateStdioCommand validates the command for MCP stdio transport
// Returns an error if the command is not in the whitelist or contains dangerous patterns
func ValidateStdioCommand(command string) error {
	if command == "" {
		return fmt.Errorf("command cannot be empty")
	}

	// Normalize command (extract base name if it's a path)
	baseCommand := command
	if strings.Contains(command, "/") {
		parts := strings.Split(command, "/")
		baseCommand = parts[len(parts)-1]
	}

	// Check against whitelist
	if !AllowedStdioCommands[baseCommand] {
		return fmt.Errorf("command '%s' is not in the allowed list. Allowed commands: uvx, npx, node, python, python3, deno, bun", baseCommand)
	}

	// Additional check: command should not contain path traversal
	if strings.Contains(command, "..") {
		return fmt.Errorf("command path contains invalid characters")
	}

	return nil
}

// ValidateStdioArgs validates the arguments for MCP stdio transport
// Returns an error if any argument contains dangerous patterns
func ValidateStdioArgs(args []string) error {
	if len(args) == 0 {
		return nil
	}

	for i, arg := range args {

View on GitHub (pinned to 988cbb0330)

Solutions

1. Switch the command to a whitelisted launcher: use "npx" instead of "npm exec", "uvx" instead of "pipx run", "python" instead of a venv path
2. If a full path is required, keep the base name whitelisted, e.g. "/usr/local/bin/node" resolves to base "node" and passes
3. Wrap the server launch in an allowed launcher's -e/-c invocation (e.g. node -e, python -c) only if security policy permits
4. Extend AllowedStdioCommands in internal/utils/security.go if your organization genuinely needs another command (review security implications first)

Example fix

// before
{"command": "/opt/venv/bin/python3.11", "args": ["server.py"]}
// after
{"command": "python3", "args": ["server.py"]}

allowed := map[string]bool{"uvx":true,"npx":true,"node":true,"python":true,"python3":true,"deno":true,"bun":true}
base := filepath.Base(cfg.Command)
if !allowed[base] {
    return fmt.Errorf("command %q not allowed; use one of uvx, npx, node, python, python3, deno, bun", base)
}

if err := ValidateStdioConfig(cfg); err != nil {
    if strings.Contains(err.Error(), "is not in the allowed list") {
        return fmt.Errorf("unsupported stdio command %q; pick a whitelisted launcher", cfg.Command)
    }
    return err
}

When it happens

Trigger: ValidateStdioConfig called with a command like "bash", "sh", "/usr/bin/curl", "npm", "docker", or any executable not in the whitelist — even if the full path version of an allowed tool is used, only the base name is checked against the map.

Common situations: MCP server configs copied from tutorials that use arbitrary commands ("python3.11", "/opt/venv/bin/python", "./server.sh"); Windows-style paths; custom interpreters like pipx or poetry run; typos such as "npxx".

Related errors

• command cannot be empty
• command path contains invalid characters
• argument %d contains potentially dangerous pattern: %s
• argument %d contains null bytes
• environment variable '%s' is not allowed for security reason

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/3782902cfb34894d. Report an issue: GitHub.