Repository navigation
[BUG] MCP server subprocess receives full process.env (API keys leaked) #31778
Description
Description
packages/opencode/src/mcp/index.ts:429-433 passes the entire process.env to every local MCP server subprocess. This exposes all environment variables (including API keys, tokens, passwords) to the MCP server process.
Root Cause
env: {
...process.env, // <-- ALL env vars leaked
...mcp.environment,
},A compromised or malicious local MCP server can read sensitive credentials through process.env.
OpenCode version
1.17.3
Metadata
Metadata
Assignees
Labels
No labels
Activity
wgu9 commentedon Jun 15, 2026
Confirmed this still reproduces on current dev at
98d66e9(2026-06-15). The local MCP spawn path inpackages/opencode/src/mcp/index.tsstill builds the subprocess environment as:\n\nts\nenv: {\n ...process.env,\n NODE_NO_WARNINGS: "1",\n ...mcp.environment,\n}\n\n\nSo any configured local MCP server still receives the parent opencode process environment, including provider keys/tokens that are unrelated to that server. This is a high-impact boundary because local MCP servers are third-party executables and the configuredmcp.environmentallowlist is bypassed by the parent env merge.