feat(mcp): strict MCP config mode (launcher allowlist)

When settings.strictMcpConfig (or STRICT_MCP_CONFIG env) is enabled, MCP
servers may only be started by allowlisted launcher commands (npx/node/
python/uvx/bun/deno/go/java/...). A disallowed command fails fast with a
clear status before anything is spawned, so an untrusted config cannot run
arbitrary executables. Wired through SessionManager.initMcpServers.

Extracted from the earlier closed PR #263 (kept as a focused change).

Author: raymondginger2018-sudo

packages/core/src/mcp/mcp-manager.ts

@@ -9,6 +9,25 @@ const MCP_CALL_TOOL_TIMEOUT_MS = 60_000;
 const API_TOOL_NAME_PATTERN = /^[a-zA-Z0-9_-]+$/;
 const API_TOOL_NAME_MAX_LENGTH = 64;
 
+/**
+ * Strict MCP config mode allowlist. When `strictMcpConfig` is enabled, only
+ * these well-known launcher commands may start an MCP server; any other
+ * command fails fast with a clear status instead of running arbitrary
+ * executables. Mirrors the upstream `--strict-mcp-config` behavior.
+ */
+const MCP_STRICT_ALLOWLIST_COMMANDS = new Set([
+  "npx",
+  "node",
+  "python3",
+  "python",
+  "uvx",
+  "uv",
+  "bun",
+  "deno",
+  "go",
+  "java",
+]);
+
 type McpToolEntry = {
   serverName: string;
   originalName: string;
@@ -78,6 +97,12 @@ export class McpManager {
   private onToolsListChanged: (() => void) | null = null;
   private onStatusChanged: (() => void) | null = null;
   private serverConfigs: Record<string, McpServerConfig> = {};
+  /** Strict mode: only allowlisted launcher commands may start MCP servers. */
+  private strictMode = false;
+
+  setStrictMode(enabled: boolean): void {
+    this.strictMode = enabled;
+  }
 
   prepare(servers?: Record<string, McpServerConfig>): void {
     if (!servers || Object.keys(servers).length === 0) return;
@@ -146,6 +171,31 @@ export class McpManager {
   private async connectServer(name: string, config: McpServerConfig): Promise<void> {
     if (this.disposed) return;
 
+    // Strict mode: validate the launcher command against the allowlist before
+    // spawning anything, so an unknown executable never runs.
+    if (this.strictMode) {
+      const commandName = config.command.split(/[\\/]/).pop() ?? config.command;
+      if (!MCP_STRICT_ALLOWLIST_COMMANDS.has(commandName)) {
+        const msg =
+          `Strict MCP config: command "${config.command}" is not in the allowlist. ` +
+          `Allowed commands: ${[...MCP_STRICT_ALLOWLIST_COMMANDS].join(", ")}. ` +
+          `Disable strictMcpConfig in settings.json to bypass.`;
+        this.setStatus({
+          name,
+          status: "failed",
+          connected: false,
+          error: msg,
+          toolCount: 0,
+          tools: [],
+          promptCount: 0,
+          prompts: [],
+          resourceCount: 0,
+          resources: [],
+        });
+        return;
+      }
+    }
+
     // Clean up stale entries from previous connection attempts
     this.clients = this.clients.filter((c) => c.isConnected());
     this.tools = this.tools.filter((t) => t.serverName !== name);

packages/core/src/session.ts

@@ -400,6 +400,7 @@ export class SessionManager {
     autoCompactWindow?: number;
     webSearchTool?: string;
     mcpServers?: Record<string, McpServerConfig>;
+    strictMcpConfig?: boolean;
     permissions?: Required<PermissionSettings>;
     enabledSkills?: Record<string, boolean>;
   };
@@ -451,6 +452,7 @@ export class SessionManager {
   }
 
   async initMcpServers(servers?: Record<string, McpServerConfig>): Promise<void> {
+    this.mcpManager.setStrictMode(this.getResolvedSettings().strictMcpConfig ?? false);
     this.mcpManager.setOnToolsListChanged(() => {
       this.mcpToolDefinitions = this.mcpManager.getMcpToolDefinitions();
     });

packages/core/src/settings.ts

@@ -101,6 +101,8 @@ export type DeepcodingSettings = {
   fileQuotaCleanupBatch?: number;
   maxRequestFilesBytes?: number;
   mcpServers?: Record<string, McpServerConfig>;
+  /** When true, MCP server launcher commands are restricted to an allowlist. */
+  strictMcpConfig?: boolean;
   permissions?: PermissionSettings;
   enabledSkills?: EnabledSkillsSettings;
   statusline?: StatusLineSettings;
@@ -128,6 +130,7 @@ export type ResolvedDeepcodingSettings = {
   fileQuotaCleanupBatch: number;
   maxRequestFilesBytes: number;
   mcpServers?: Record<string, McpServerConfig>;
+  strictMcpConfig: boolean;
   permissions: Required<PermissionSettings>;
   enabledSkills: EnabledSkillsSettings;
   statusline: ResolvedStatusLineSettings;
@@ -632,6 +635,11 @@ export function resolveSettingsSources(
     trimString(projectSettings?.webSearchTool) ||
     trimString(userSettings?.webSearchTool) ||
     "";
+  const strictMcpConfig =
+    parseBoolean(systemEnv.STRICT_MCP_CONFIG) ??
+    parseBoolean(projectSettings?.strictMcpConfig) ??
+    parseBoolean(userSettings?.strictMcpConfig) ??
+    false;
 
   const multimodal =
     resolveMultimodalMode(systemEnv.MULTIMODAL) ??
@@ -697,6 +705,7 @@ export function resolveSettingsSources(
     fileQuotaCleanupBatch,
     maxRequestFilesBytes,
     mcpServers: mergeMcpServers(userSettings, projectSettings, userEnv, projectEnv, systemEnv),
+    strictMcpConfig,
     permissions: mergePermissions(userSettings, projectSettings),
     enabledSkills: mergeEnabledSkills(userSettings, projectSettings),
     statusline: mergeStatusLine(userSettings, projectSettings),