fix(mcp): expand builtin allowlist for benign env vars

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
This commit is contained in:
YeonGyu-Kim
2026-04-03 17:09:15 +09:00
parent 83acafce48
commit 4766891557
@@ -1,4 +1,23 @@
const BUILTIN_ALLOWED_MCP_ENV_VARS = ["PATH", "HOME", "USER", "SHELL", "TERM"]
const BUILTIN_ALLOWED_MCP_ENV_VARS = [
"PATH",
"HOME",
"USER",
"SHELL",
"TERM",
"TMPDIR",
"PWD",
"OLDPWD",
"LANG",
"LC_ALL",
"LC_CTYPE",
"EDITOR",
"VISUAL",
"XDG_CONFIG_HOME",
"XDG_DATA_HOME",
"XDG_CACHE_HOME",
"HOSTNAME",
"LOGNAME",
]
const SENSITIVE_MCP_ENV_VAR_PATTERN = /KEY|TOKEN|SECRET|PASSWORD|AUTH|CREDENTIAL/i
let additionalAllowedMcpEnvVars = new Set<string>()