environment variable '%s' is not allowed for security reason

Error message

environment variable '%s' is not allowed for security reasons

What it means

ValidateStdioEnvVars checks each environment-variable KEY against DangerousEnvVarPatterns regexes before an MCP stdio process is spawned. Keys matching dangerous patterns (typically sensitive or privileged variable names like LD_PRELOAD, IFS, shell/function overrides) are rejected for security reasons, regardless of value.

Source

Thrown at internal/utils/security.go:598

			return fmt.Errorf("argument %d contains null bytes", i)
		}
	}

	return nil
}

// ValidateStdioEnvVars validates environment variables for MCP stdio transport
// Returns an error if any env var name or value is dangerous
func ValidateStdioEnvVars(envVars map[string]string) error {
	if len(envVars) == 0 {
		return nil
	}

	for key, value := range envVars {
		// Check key against dangerous patterns
		for _, pattern := range DangerousEnvVarPatterns {
			if pattern.MatchString(key) {
				return fmt.Errorf("environment variable '%s' is not allowed for security reasons", key)
			}
		}

		// Check key length
		if len(key) > 256 {
			return fmt.Errorf("environment variable name '%s' exceeds maximum length", SanitizeForLog(key[:50]))
		}

		// Check value length
		if len(value) > 4096 {
			return fmt.Errorf("environment variable '%s' value exceeds maximum length", key)
		}

		// Check for null bytes in value
		if strings.Contains(value, "\x00") {
			return fmt.Errorf("environment variable '%s' value contains null bytes", key)
		}

View on GitHub (pinned to 988cbb0330)

Solutions

Remove the offending variable from the env map; most stdio servers need only a few app-specific vars
If a var is genuinely needed but blocked (e.g. LD_LIBRARY_PATH), consult DangerousEnvVarPatterns and find a supported alternative mechanism
Fix malformed keys (spaces, '=' inside the key, empty keys) that trip the dangerous patterns
Whitelist exactly the vars the server documents as required (e.g. API keys with safe names)

Example fix

// before
"env": {"LD_PRELOAD": "/tmp/hook.so", "API_KEY": "..."}
// after
"env": {"API_KEY": "..."}

Defensive patterns

Strategy: validation

Validate before calling

var dangerousEnv = regexp.MustCompile(`(?i)^(LD_PRELOAD|LD_LIBRARY_PATH|BASH_ENV|ENV|IFS|SHELL|PATH)$`)
for k := range cfg.Env {
    if dangerousEnv.MatchString(k) || strings.ContainsAny(k, " =\x00") {
        return fmt.Errorf("env key %q not allowed", k)
    }
}

Try / catch

if err := ValidateStdioConfig(cfg); err != nil {
    if strings.Contains(err.Error(), "is not allowed for security reasons") {
        return fmt.Errorf("remove blocked env var (loader/shell vars are forbidden): %w", err)
    }
    return err
}

Prevention

Only set environment variables the server explicitly documents
Never set dynamic-loader or shell variables (LD_PRELOAD, BASH_ENV, IFS) for child processes
Validate env keys against ^[A-Za-z_][A-Za-z0-9_]*$ at config load

When it happens

Trigger: ValidateStdioConfig called with an env map whose key matches a dangerous pattern, e.g. "LD_PRELOAD", "BASH_ENV", "PATH=..." style malformed keys, or keys containing shell metacharacters.

Common situations: Config copied from a dev machine exporting loader/shell hijack vars; dynamically generated env keys; attempting to tweak dynamic linking or shell behavior for the child process; keys with spaces or '=' accidentally included.

Related errors

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/90311f5b7da09e82. Report an issue: GitHub.