{"record":{"id":"fad788aeee0854e8","repo":"FlowiseAI/Flowise","slug":"cwd-parameter-is-not-allowed-in-mcp-server-configu","errorCode":null,"errorMessage":"cwd parameter is not allowed in MCP server configuration","messagePattern":"cwd parameter is not allowed in MCP server configuration","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/nodes/tools/MCP/core.ts","lineNumber":425,"sourceCode":"}\n\n/**\n * Validates a user-supplied MCP server configuration against operator-controlled allow-lists.\n *\n * For stdio configs, the command must appear in the `CUSTOM_MCP_ALLOWED_COMMANDS` allow-list\n * (comma-separated, empty = none allowed). The list is empty by default, so no command can run\n * until an operator explicitly opts in. To enable local/custom stdio MCP servers, set\n * `CUSTOM_MCP_PROTOCOL=stdio` and `CUSTOM_MCP_ALLOWED_COMMANDS` in your env file\n * (see docker/.env.example, docker/worker/.env.example, packages/server/.env.example).\n */\nexport const validateMCPServerConfig = (serverParams: any): void => {\n    // Validate the entire server configuration\n    if (!serverParams || typeof serverParams !== 'object') {\n        throw new Error('Invalid server configuration')\n    }\n\n    if (serverParams.cwd != null) {\n        throw new Error('cwd parameter is not allowed in MCP server configuration')\n    }\n\n    // Command allowlist - operator-controlled via CUSTOM_MCP_ALLOWED_COMMANDS (empty = none allowed)\n    const allowedCommands = (process.env.CUSTOM_MCP_ALLOWED_COMMANDS ?? '')\n        .split(',')\n        .map((s) => s.trim())\n        .filter(Boolean)\n\n    if (serverParams.command && !allowedCommands.includes(serverParams.command)) {\n        throw new Error(`Command '${serverParams.command}' is not allowed. Permitted: ${allowedCommands.join(', ') || '(none)'}`)\n    }\n\n    // Validate arguments if present\n    if (serverParams.args && Array.isArray(serverParams.args)) {\n        validateArgsForLocalFileAccess(serverParams.args)\n        validateCommandInjection(serverParams.args)\n\n        // Validate command-specific dangerous flags","sourceCodeStart":407,"sourceCodeEnd":443,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/nodes/tools/MCP/core.ts#L407-L443","documentation":"Thrown by validateMCPServerConfig when serverParams.cwd != null. The cwd field would let a caller set the working directory of the spawned MCP process, which is treated as an escalation risk (relative-path hijacking, accessing sensitive dirs), so it is unconditionally rejected.","triggerScenarios":"A caller constructs serverParams with a cwd key, e.g. { command: 'node', args: [...], cwd: '/opt/app' }. StdioClientTransport would otherwise honor cwd, so the validator forbids it.","commonSituations":"Caller copies a full StdioServerParameters object including cwd; framework defaults cwd to process.cwd() and forwards it; operator tries to sandbox the MCP server to a directory.","solutions":["Remove the cwd key from serverParams before validation.","Set the working directory at the OS/process level for the worker instead of per-MCP-server.","If a specific working directory is required, wrap the command in a small launcher script and allow-list that script path."],"exampleFix":"// before\nconst serverParams = { command: 'node', args: ['s.js'], cwd: '/opt/app' }\n\n// after\nconst serverParams = { command: 'node', args: ['/opt/app/s.js'] } // absolute path, no cwd","handlingStrategy":"validation","validationCode":"if (serverParams && Object.prototype.hasOwnProperty.call(serverParams, 'cwd')) {\n  delete serverParams.cwd // or throw to forbid explicitly\n}","typeGuard":"const hasNoCwd = (p: any): boolean => p == null || typeof p !== 'object' || !('cwd' in p)","tryCatchPattern":"try {\n  validateMCPServerConfig(serverParams)\n} catch (e) {\n  if (e.message === 'cwd parameter is not allowed in MCP server configuration') {\n    // remove cwd from serverParams and retry\n  }\n  throw e\n}","preventionTips":["Do not copy cwd from process.env or the worker config into serverParams.","Use absolute script paths instead of cwd to locate files.","Audit StdioServerParameters construction to ensure cwd is omitted."],"tags":["mcp","security","configuration"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}