fix(mcp): restrict env var expansion in MCP configs

Block sensitive env var interpolation in MCP config expansion so repo and plugin MCP definitions cannot exfiltrate secrets by default. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
2026-04-02 14:55:01 +09:00
parent a637cca702
commit e8c5727a22
9 changed files with 260 additions and 0 deletions
@@ -26,4 +26,51 @@ describe("transformMcpServer", () => {
      })
    })
  })
+
+  describe("#given a server config containing sensitive env references", () => {
+    it("#when transforming a local MCP server #then it strips sensitive env vars from the environment", () => {
+      // given
+      process.env.GITHUB_TOKEN = "ghp-secret"
+      process.env.HOME = "/Users/tester"
+
+      // when
+      const transformed = transformMcpServer("local-secure", {
+        command: "npx",
+        args: ["mcp-server", "${HOME}"],
+        env: {
+          HOME_DIR: "${HOME}",
+          AUTH_TOKEN: "${GITHUB_TOKEN}",
+        },
+      })
+
+      // then
+      expect(transformed).toEqual({
+        type: "local",
+        command: ["npx", "mcp-server", "/Users/tester"],
+        environment: {
+          HOME_DIR: "/Users/tester",
+          AUTH_TOKEN: "",
+        },
+        enabled: true,
+      })
+    })
+
+    it("#when transforming a remote MCP server #then it strips sensitive env vars from the url", () => {
+      // given
+      process.env.API_KEY = "secret-key"
+
+      // when
+      const transformed = transformMcpServer("remote-secure", {
+        type: "http",
+        url: "https://mcp.example.com/${API_KEY}",
+      })
+
+      // then
+      expect(transformed).toEqual({
+        type: "remote",
+        url: "https://mcp.example.com/",
+        enabled: true,
+      })
+    })
+  })
 })