{"record":{"id":"fb3fefea262cba5e","repo":"HKUDS/Vibe-Trading","slug":"live-broker-mcp-server-server-key-may-not-use","errorCode":null,"errorMessage":"Live-broker MCP server '{server_key}' may not use a wildcard {detail}","messagePattern":"Live-broker MCP server '(.+?)' may not use a wildcard (.+?)","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"agent/src/config/schema.py","lineNumber":499,"sourceCode":"        Returns:\n            The validated agent config instance.\n\n        Raises:\n            ValueError: If a live-broker server entry uses ``[\"*\"]``.\n        \"\"\"\n        for server_key, server in self.mcp_servers.items():\n            if is_live_broker_entry(server_key, server) and \"*\" in server.enabled_tools:\n                if _allows_readonly_wildcard_probe(server_key, server):\n                    continue\n                broker = live_broker_key_for_entry(server_key, server)\n                if broker == \"robinhood\":\n                    detail = (\n                        f\"{LIVE_BROKER_WILDCARD_ALLOWLIST_ERROR}. \"\n                        f\"{format_robinhood_mcp_config_guidance(reason='wildcard')}\"\n                    )\n                else:\n                    detail = LIVE_BROKER_WILDCARD_ALLOWLIST_ERROR\n                raise ValueError(\n                    f\"Live-broker MCP server '{server_key}' may not use a wildcard {detail}\"\n                )\n        return self\n\n\nclass AgentConfigOverride(ConfigBase):\n    \"\"\"Partial top-level config override used for runtime layering.\"\"\"\n\n    model_config = ConfigDict(\n        alias_generator=_to_camel,\n        populate_by_name=True,\n        # Load-bearing: SessionService passes the entire session.config dict\n        # (which carries unrelated keys like include_shell_tools) through\n        # merge_agent_config_overrides.  Flipping this back to \"forbid\" makes\n        # any such payload raise ValidationError and silently drops the whole\n        # override, including any valid mcpServers.  Regression test:\n        # tests/test_agent_config.py::\n        #   test_runtime_load_preserves_mcp_servers_when_opted_in_with_unknown_keys","sourceCodeStart":481,"sourceCodeEnd":517,"githubUrl":"https://github.com/HKUDS/Vibe-Trading/blob/80ffdda44c5c4db0dd84d70e051cca591cea67df/agent/src/config/schema.py#L481-L517","documentation":"Raised by validate_live_broker_servers when a server keyed as a live broker (e.g. Robinhood) uses a wildcard where an explicit allowlist is required — for instance a wildcard tool allowlist/pattern. Live money-moving servers must be narrowly scoped, and when the server is Robinhood the message also embeds format_robinhood_mcp_config_guidance(reason='wildcard') with remediation steps.","triggerScenarios":"Declaring a live-broker MCP server (by its server_key) whose config contains a wildcard entry (tools/allowlist patterns) that policy forbids for brokers.","commonSituations":"Reusing a generic wildcard-enabled MCP template for a Robinhood/IBKR live server; disabling allowlists for convenience during integration testing and forgetting to restore them.","solutions":["Replace the wildcard with an explicit allowlist of the specific broker tools you need (read-only quotes/positions first).","If the error text includes Robinhood guidance, follow the embedded configuration guidance for the correct seed config.","Keep live-broker servers pinned to a reviewed, minimal tool set before enabling trading."],"exampleFix":"# before\nmcp_servers:\n  robinhood:\n    # wildcard tools config\n\n# after\nmcp_servers:\n  robinhood:\n    # explicit allowlist: quote, positions, orders_read","handlingStrategy":"validation","validationCode":"def broker_entry_explicit(entry: dict) -> bool:\n    # reject wildcard tool allowlist patterns for live-broker servers\n    tools = entry.get('tools') or entry.get('allowlist')\n    if tools is None:\n        return True\n    return not any('*' in str(t) or t == '*' for t in tools)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Start live-broker configs from the official seed config","Review broker tool allowlists in code review before enabling live trading"],"tags":["mcp","live-broker","security","allowlist","config"],"backgroundTag":"config-validation-failed","analyzedSha":"80ffdda44c5c4db0dd84d70e051cca591cea67df","analyzedAt":"2026-08-28T12:46:38.989Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}