environment variable '%s' value exceeds maximum length

Error message

environment variable '%s' value exceeds maximum length

What it means

ValidateStdioEnvVars limits each environment-variable VALUE to 4096 characters. Values longer than this are rejected to prevent oversized environments that could exhaust process limits or hide injection payloads.

Source

Thrown at internal/utils/security.go:609

		return nil
	}

	for key, value := range envVars {
		// Check key against dangerous patterns
		for _, pattern := range DangerousEnvVarPatterns {
			if pattern.MatchString(key) {
				return fmt.Errorf("environment variable '%s' is not allowed for security reasons", key)
			}
		}

		// Check key length
		if len(key) > 256 {
			return fmt.Errorf("environment variable name '%s' exceeds maximum length", SanitizeForLog(key[:50]))
		}

		// Check value length
		if len(value) > 4096 {
			return fmt.Errorf("environment variable '%s' value exceeds maximum length", key)
		}

		// Check for null bytes in value
		if strings.Contains(value, "\x00") {
			return fmt.Errorf("environment variable '%s' value contains null bytes", key)
		}

		// Check value for shell injection patterns
		for _, pattern := range DangerousArgPatterns {
			if pattern.MatchString(value) {
				return fmt.Errorf("environment variable '%s' value contains potentially dangerous pattern", key)
			}
		}
	}

	return nil
}

View on GitHub (pinned to 988cbb0330)

Solutions

Move the large value to a file and pass the file path as the env value
Compress/encode only if that reduces size below 4096 chars, or split across multiple smaller variables if the server supports it
Use a secrets manager / mounted secret file rather than an inline env value
Trim the value to only what the server actually needs (e.g. a key id + secret instead of full JSON)

Example fix

// before
"env": {"GOOGLE_APPLICATION_CREDENTIALS_JSON": "<5000-char service account JSON>"}
// after
"env": {"GOOGLE_APPLICATION_CREDENTIALS": "/path/to/sa.json"}

Defensive patterns

Strategy: validation

Validate before calling

for k, v := range cfg.Env {
    if len(v) > 4096 {
        return fmt.Errorf("env %s value too long (%d > 4096); use a file path instead", k, len(v))
    }
}

Try / catch

if err := ValidateStdioConfig(cfg); err != nil {
    if strings.Contains(err.Error(), "value exceeds maximum length") {
        return fmt.Errorf("move large secret/config to a file and reference its path: %w", err)
    }
    return err
}

Prevention

Reference secrets by file path instead of inlining JSON/PEM blobs in env values
Use a secrets manager or mounted secret files for large credentials
Pre-check env value lengths before writing MCP configs

When it happens

Trigger: ValidateStdioConfig called with an env map where some value exceeds 4096 bytes — e.g. a giant token, embedded JSON blob, certificate, or concatenated secrets.

Common situations: Embedding service-account JSON or PEM certificates directly in env values; very long JWTs or connection strings; configs that concatenate multiple values into one variable.

Related errors

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/384c855ee35525a8. Report an issue: GitHub.