{"record":{"id":"67c946a381ce8627","repo":"FlowiseAI/Flowise","slug":"custom-mcp-script-execution-disabled-configure-cu","errorCode":null,"errorMessage":"Custom MCP script execution disabled. Configure CUSTOM_MCP_ALLOWED_ABSOLUTE_SCRIPT_PATHS environment variable.","messagePattern":"Custom MCP script execution disabled\\. Configure CUSTOM_MCP_ALLOWED_ABSOLUTE_SCRIPT_PATHS environment variable\\.","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/nodes/tools/MCP/core.ts","lineNumber":257,"sourceCode":"        },\n        {\n            name: name,\n            description: description,\n            schema: argsSchema\n        }\n    )\n}\n\nexport const validateArgsForLocalFileAccess = (args: string[]): void => {\n    const allowedScriptPaths = (process.env.CUSTOM_MCP_ALLOWED_ABSOLUTE_SCRIPT_PATHS ?? '')\n        .split(',')\n        .map((s) => s.trim())\n        .filter(Boolean)\n\n    const scriptArg = args[0]\n\n    if (allowedScriptPaths.length === 0)\n        throw new Error('Custom MCP script execution disabled. Configure CUSTOM_MCP_ALLOWED_ABSOLUTE_SCRIPT_PATHS environment variable.')\n\n    if (!allowedScriptPaths.includes(scriptArg)) throw new Error('Custom MCP script path not in allowed list.')\n}\n\nexport const validateCommandInjection = (args: string[]): void => {\n    const dangerousPatterns = [\n        // Shell metacharacters\n        /[;&|`$(){}[\\]<>]/,\n        // Command chaining\n        /&&|\\|\\||;;/,\n        // Redirections\n        />>|<<|>/,\n        // Backticks and command substitution\n        /`|\\$\\(/,\n        // Process substitution\n        /<\\(|>\\(/\n    ]\n","sourceCodeStart":239,"sourceCodeEnd":275,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/nodes/tools/MCP/core.ts#L239-L275","documentation":"Thrown by validateArgsForLocalFileAccess when CUSTOM_MCP_ALLOWED_ABSOLUTE_SCRIPT_PATHS is unset or empty. The function splits that env var on commas to build allowedScriptPaths; an empty list means script-style local MCP execution is fully disabled by default, so any call to a script-path-based MCP server is refused.","triggerScenarios":"validateArgsForLocalFileAccess is invoked with any args array while CUSTOM_MCP_ALLOWED_ABSOLUTE_SCRIPT_PATHS is unset or empty. Reached via validateMCPServerConfig when serverParams.args is a non-empty array.","commonSituations":"Default deployment where the operator has not opted into local script MCP servers; env var misspelled; a custom MCP node pointing at a local .js/.py script before the allow-list is configured.","solutions":["Set CUSTOM_MCP_ALLOWED_ABSOLUTE_SCRIPT_PATHS to a comma-separated list of absolute script paths you trust (e.g. /opt/mcp/server.js).","Confirm the script path passed as args[0] exactly matches an entry in that list (no trailing slash, absolute).","If script execution is not required, route the MCP server through an allowed command instead and leave the list empty."],"exampleFix":"# before\n# CUSTOM_MCP_ALLOWED_ABSOLUTE_SCRIPT_PATHS=\n\n# after\nCUSTOM_MCP_ALLOWED_ABSOLUTE_SCRIPT_PATHS=/opt/mcp/server.js,/opt/mcp/other.js","handlingStrategy":"validation","validationCode":"const allowed = (process.env.CUSTOM_MCP_ALLOWED_ABSOLUTE_SCRIPT_PATHS ?? '').split(',').map(s => s.trim()).filter(Boolean)\nif (allowed.length === 0) {\n  throw new Error('Configure CUSTOM_MCP_ALLOWED_ABSOLUTE_SCRIPT_PATHS before enabling script-based MCP servers')\n}","typeGuard":"const scriptExecutionEnabled = (): boolean => (process.env.CUSTOM_MCP_ALLOWED_ABSOLUTE_SCRIPT_PATHS ?? '').split(',').map(s => s.trim()).filter(Boolean).length > 0","tryCatchPattern":"try {\n  validateArgsForLocalFileAccess(args)\n} catch (e) {\n  if (e.message.includes('Custom MCP script execution disabled')) {\n    // operator must populate CUSTOM_MCP_ALLOWED_ABSOLUTE_SCRIPT_PATHS\n  }\n  throw e\n}","preventionTips":["Decide upfront whether script-based MCP servers are allowed and configure the env accordingly.","Document the exact absolute paths operators should allow-list.","Run a config check at worker boot that fails fast if a script MCP node is enabled but the allow-list is empty."],"tags":["mcp","security","configuration","allow-list"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}