{"record":{"id":"6a11fdca49e61bf7","repo":"FlowiseAI/Flowise","slug":"invalid-server-configuration","errorCode":null,"errorMessage":"Invalid server configuration","messagePattern":"Invalid server configuration","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/nodes/tools/MCP/core.ts","lineNumber":421,"sourceCode":"                }\n            }\n        }\n    }\n}\n\n/**\n * Validates a user-supplied MCP server configuration against operator-controlled allow-lists.\n *\n * For stdio configs, the command must appear in the `CUSTOM_MCP_ALLOWED_COMMANDS` allow-list\n * (comma-separated, empty = none allowed). The list is empty by default, so no command can run\n * until an operator explicitly opts in. To enable local/custom stdio MCP servers, set\n * `CUSTOM_MCP_PROTOCOL=stdio` and `CUSTOM_MCP_ALLOWED_COMMANDS` in your env file\n * (see docker/.env.example, docker/worker/.env.example, packages/server/.env.example).\n */\nexport const validateMCPServerConfig = (serverParams: any): void => {\n    // Validate the entire server configuration\n    if (!serverParams || typeof serverParams !== 'object') {\n        throw new Error('Invalid server configuration')\n    }\n\n    if (serverParams.cwd != null) {\n        throw new Error('cwd parameter is not allowed in MCP server configuration')\n    }\n\n    // Command allowlist - operator-controlled via CUSTOM_MCP_ALLOWED_COMMANDS (empty = none allowed)\n    const allowedCommands = (process.env.CUSTOM_MCP_ALLOWED_COMMANDS ?? '')\n        .split(',')\n        .map((s) => s.trim())\n        .filter(Boolean)\n\n    if (serverParams.command && !allowedCommands.includes(serverParams.command)) {\n        throw new Error(`Command '${serverParams.command}' is not allowed. Permitted: ${allowedCommands.join(', ') || '(none)'}`)\n    }\n\n    // Validate arguments if present\n    if (serverParams.args && Array.isArray(serverParams.args)) {","sourceCodeStart":403,"sourceCodeEnd":439,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/nodes/tools/MCP/core.ts#L403-L439","documentation":"Thrown by validateMCPServerConfig as its first check: serverParams must be a non-null object. If it is null, undefined, a primitive, or any non-object, the validator refuses to continue because none of the subsequent property checks would be meaningful.","triggerScenarios":"validateMCPServerConfig called with null, undefined, a string, a number, or an array/other non-plain-object value. Reachable from any MCP node that builds serverParams from optional user input that resolved to nothing.","commonSituations":"Custom MCP node whose input was left blank so serverParams is undefined; a code path that passes the raw nodeData object instead of the constructed serverParams; refactor that accidentally drops the serverParams argument.","solutions":["Ensure the caller constructs and passes a plain object: { command, args, env?, url? }.","Guard the caller: if (!serverParams || typeof serverParams !== 'object') surface a clearer UI error before calling the validator.","Add a default empty object literal at the call site so undefined never reaches the validator."],"exampleFix":"// before\nvalidateMCPServerConfig(nodeData.inputs?.maybeParams)\n\n// after\nconst serverParams = nodeData.inputs?.maybeParams ?? {}\nvalidateMCPServerConfig(serverParams)","handlingStrategy":"type-guard","validationCode":"if (!serverParams || typeof serverParams !== 'object') {\n  throw new Error('serverParams must be a plain object')\n}","typeGuard":"const isPlainObject = (v: unknown): v is Record<string, any> =>\n  typeof v === 'object' && v !== null && !Array.isArray(v)","tryCatchPattern":"try {\n  validateMCPServerConfig(serverParams)\n} catch (e) {\n  if (e.message === 'Invalid server configuration') {\n    // default serverParams to {} or surface a UI error\n  }\n  throw e\n}","preventionTips":["Always construct serverParams as an object literal at the call site.","Default optional configs to {} rather than undefined.","Add a type guard at the boundary that constructs serverParams."],"tags":["mcp","security","validation","configuration"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}