From 4766891557068f1fddf0cf4f2b3f0a826472f346 Mon Sep 17 00:00:00 2001 From: YeonGyu-Kim Date: Fri, 3 Apr 2026 17:09:15 +0900 Subject: [PATCH] fix(mcp): expand builtin allowlist for benign env vars Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus --- .../configure-allowed-env-vars.ts | 21 ++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/src/features/claude-code-mcp-loader/configure-allowed-env-vars.ts b/src/features/claude-code-mcp-loader/configure-allowed-env-vars.ts index 1aa204a56..ed076f155 100644 --- a/src/features/claude-code-mcp-loader/configure-allowed-env-vars.ts +++ b/src/features/claude-code-mcp-loader/configure-allowed-env-vars.ts @@ -1,4 +1,23 @@ -const BUILTIN_ALLOWED_MCP_ENV_VARS = ["PATH", "HOME", "USER", "SHELL", "TERM"] +const BUILTIN_ALLOWED_MCP_ENV_VARS = [ + "PATH", + "HOME", + "USER", + "SHELL", + "TERM", + "TMPDIR", + "PWD", + "OLDPWD", + "LANG", + "LC_ALL", + "LC_CTYPE", + "EDITOR", + "VISUAL", + "XDG_CONFIG_HOME", + "XDG_DATA_HOME", + "XDG_CACHE_HOME", + "HOSTNAME", + "LOGNAME", +] const SENSITIVE_MCP_ENV_VAR_PATTERN = /KEY|TOKEN|SECRET|PASSWORD|AUTH|CREDENTIAL/i let additionalAllowedMcpEnvVars = new Set()