{"record":{"id":"c85675e0dab2a3e8","repo":"FlowiseAI/Flowise","slug":"argument-arg-is-not-allowed-for-command-co","errorCode":null,"errorMessage":"Argument '${arg}' is not allowed for command '${command}'.","messagePattern":"Argument '(.+?)' is not allowed for command '(.+?)'\\.","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/nodes/tools/MCP/core.ts","lineNumber":386,"sourceCode":"            '--env-file' // Read env vars from a local host file (local file access)\n        ]\n    }\n\n    const dangerousFlags = dangerousFlagsByCommand[command] || []\n\n    // Collect single-char dangerous flags (e.g. '-c' -> 'c') for combined flag detection\n    const dangerousShortChars = new Set(dangerousFlags.filter((f) => /^-[a-zA-Z]$/.test(f)).map((f) => f[1].toLowerCase()))\n\n    for (const arg of args) {\n        if (typeof arg !== 'string') continue\n\n        const normalizedArg = arg.toLowerCase().trim()\n\n        // Check for dangerous flags in various forms (exact, =value, space-separated value)\n        for (const flag of dangerousFlags) {\n            const lowerCaseFlag = flag.toLowerCase()\n            if (normalizedArg === lowerCaseFlag) {\n                throw new Error(`Argument '${arg}' is not allowed for command '${command}'.`)\n            }\n            if (normalizedArg.startsWith(lowerCaseFlag + '=')) {\n                throw new Error(`Argument '${arg}' contains flag '${flag}' that is not allowed for command '${command}'.`)\n            }\n            if (flag.startsWith('-') && normalizedArg.startsWith(lowerCaseFlag + ' ')) {\n                throw new Error(`Argument '${arg}' contains flag '${flag}' that is not allowed for command '${command}'.`)\n            }\n        }\n\n        // Check for combined short flags (e.g. \"-yc\" = \"-y\" + \"-c\")\n        // A combined flag starts with a single '-', is not a long flag '--', and has multiple characters after '-'\n        if (/^-[a-zA-Z]{2,}/.test(normalizedArg)) {\n            const flagChars = normalizedArg.slice(1) // strip leading '-'\n            for (const ch of flagChars) {\n                if (dangerousShortChars.has(ch)) {\n                    throw new Error(`Argument '${arg}' contains dangerous flag '-${ch}' for command '${command}'.`)\n                }\n            }","sourceCodeStart":368,"sourceCodeEnd":404,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/nodes/tools/MCP/core.ts#L368-L404","documentation":"Thrown by validateCommandFlags when an arg, after lowercasing and trimming, exactly equals one of the dangerousFlags for that command (e.g. 'node' -> '-e', '--eval', '-r', '--require'; 'npx' -> '-c', '--call', '-y', '--yes', '--node-options'; 'python' -> '-c', '-m'; 'docker' -> 'run', 'exec', '-v', '--privileged', etc.). It blocks code-execution flags on otherwise allow-listed commands.","triggerScenarios":"validateCommandFlags(command, args) called from validateMCPServerConfig when serverParams.command is one of npx/node/python/python3/docker and an element of args case-insensitively matches a dangerous flag for that command.","commonSituations":"Custom MCP node using 'node -e ...' or 'npx -y pkg'; 'docker run ...' or 'docker -v ...' as the MCP server command; flags supplied by users in an arguments input.","solutions":["Remove the dangerous flag from the args (e.g. drop '-e'/'--eval' from node invocations).","Run the script as a file rather than via -e/-c/--call so no eval flag is needed.","Choose a command/invocation that does not require auto-confirm or eval flags."],"exampleFix":"// before\n{ command: 'node', args: ['-e', 'console.log(1)'] }\n\n// after\n{ command: 'node', args: ['/opt/mcp/server.js'] }","handlingStrategy":"validation","validationCode":"const dangerousFlagsByCommand = { npx: ['-c', '--call', '-y', '--yes', '--node-options'], node: ['-e', '--eval', '-p', '--print', '-r', '--require', '--loader', '--import', '--env-file'], python: ['-c', '-m'], python3: ['-c', '-m'], docker: ['run', 'exec', 'build', 'compose', '-v', '--volume', '--mount', '--privileged', '--cap-add', '--security-opt', '--device', '--entrypoint', '--network', '--pid', '--ipc', '--env-file'] }\nconst flags = dangerousFlagsByCommand[command] ?? []\nif (args.some(a => typeof a === 'string' && flags.includes(a.toLowerCase().trim()))) {\n  throw new Error(`Removing dangerous flag for ${command}`)\n}","typeGuard":"const argsHaveNoDangerousExactFlags = (command: string, args: string[]): boolean => {\n  const flags = new Set((dangerousFlagsByCommand[command] ?? []).map(f => f.toLowerCase()))\n  return !args.some(a => typeof a === 'string' && flags.has(a.toLowerCase().trim()))\n}","tryCatchPattern":"try {\n  validateCommandFlags(command, args)\n} catch (e) {\n  if (e.message.endsWith(`is not allowed for command '${command}'.`)) {\n    // strip the named flag from args and retry\n  }\n  throw e\n}","preventionTips":["Avoid eval/auto-confirm/eval-print flags for MCP server commands.","Prefer file-based invocations over -e/-c/--call.","Run validateCommandFlags during local development to catch issues before deploy."],"tags":["mcp","security","command-flags","injection"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}