google-gemini/gemini-cli · error · Error

Invalid domain in allowedDomains: ${domain}

Error message

Invalid domain in allowedDomains: ${domain}

What it means

Thrown while building chrome-devtools-mcp args in connectMcp(): a domain in customConfig.allowedDomains fails the regex /^(\*\.)?([a-zA-Z0-9-]+\.)*[a-zA-Z0-9-]+$/. The regex permits an optional *. prefix and dotted labels of alphanumerics/hyphens only — no scheme, port, path, or trailing slash.

Source

Thrown at packages/core/src/agents/browser/browserManager.ts:680

        Storage.getGlobalGeminiDir(),
        BROWSER_PROFILE_DIR,
      );
      mcpArgs.push('--userDataDir', defaultProfilePath);
    }

    // Respect the user's privacy.usageStatisticsEnabled setting
    if (!this.config.getUsageStatisticsEnabled()) {
      mcpArgs.push('--no-usage-statistics', '--no-performance-crux');
    }

    if (
      browserConfig.customConfig.allowedDomains &&
      browserConfig.customConfig.allowedDomains.length > 0
    ) {
      const exclusionRules = browserConfig.customConfig.allowedDomains
        .map((domain) => {
          if (!/^(\*\.)?([a-zA-Z0-9-]+\.)*[a-zA-Z0-9-]+$/.test(domain)) {
            throw new Error(`Invalid domain in allowedDomains: ${domain}`);
          }
          return `EXCLUDE ${domain}`;
        })
        .join(', ');
      mcpArgs.push(
        `--chromeArg="--host-rules=MAP * ~NOTFOUND, ${exclusionRules}"`,
      );
    }

    debugLogger.log(
      `Launching bundled chrome-devtools-mcp (${sessionMode} mode) with args: ${mcpArgs.join(' ')}`,
    );

    // Create stdio transport to the bundled chrome-devtools-mcp.
    // stderr is piped (not inherited) to prevent MCP server banners and
    // warnings from corrupting the UI in alternate buffer mode.
    let bundleMcpPath = path.resolve(
      __dirname,

View on GitHub (pinned to 5024443c72)

Solutions

1. Use bare hostnames only: 'example.com', '*.example.com'.
2. Strip any scheme (https://), port (:443), path, query, and trailing slash before adding to allowedDomains.
3. For IP addresses or unusual hostnames, note the regex requires at least one alphanumeric label; avoid raw IPs (not matched) or extend config if needed.
4. Ensure wildcards are prefix-only: '*.example.com' is allowed; 'example.*' is not.

Example fix

// before
allowedDomains: ['https://example.com', 'example.com:443', 'api.example.com/']

// after
allowedDomains: ['example.com', '*.example.com']

const DOMAIN_RE = /^(\*\.)?([a-zA-Z0-9-]+\.)*[a-zA-Z0-9-]+$/;
function validateAllowedDomains(domains) {
  for (const d of domains)
    if (!DOMAIN_RE.test(d))
      throw new Error(`Invalid domain in allowedDomains: ${d}`);
}

function isValidAllowedDomain(d) {
  return /^(\*\.)?([a-zA-Z0-9-]+\.)*[a-zA-Z0-9-]+$/.test(d);
}

When it happens

Trigger: connectMcp() iterating allowedDomains and calling .map; any entry containing '://', a port (:8080), a path (/path), a trailing slash, a wildcard not at the prefix, or characters outside [a-zA-Z0-9-.] causes the regex test to return false.

Common situations: Configuring allowedDomains with full URLs (https://example.com), host:port pairs, paths, trailing dots/slashes, or IP literals; uppercase scheme; a stray space; wildcard in the middle (foo.*.com).

Related errors

• Domain not allowed: The requested domain is not in the allow
• Invalid approval mode: ${rawApprovalMode}. Valid values are:
• Invalid telemetry configuration: ${err.message}.
• Invalid regex pattern in allowedExtensions setting: "${patte
• Invalid environment variable name: "${key}". Must contain on

AI-assisted analysis of google-gemini/gemini-cli@5024443c72 (2026-08-12). Data as JSON: /api/errors/c6e6a52fe1a5680d. Report an issue: GitHub.