You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
0Signal: worth watching, 1 to 5
MCPArea: what it touches
ImprovementsKind: in v2.1.219,
ImprovementsSection of the release
What
Matching a server against allowedMcpServers and deniedMcpServers now expands environment-variable references in the configured command and URL before comparing, so rules match what actually runs rather than the literal template.
Details
The deny path uses a fallback env when expansion needs one.
An allow-rule URL whose expansion is flagged unsafeExpansion is skipped rather than treated as a match.
A separate new validator flags untrimmed whitespace in MCP config command, url, args, and env/header names and values.
Evidence
unsafeExpansion
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
