{"version":"2.1.219","anchor":"mcp-policy-allow-deny-entries-now-expand-var-environment-ref","canonical_anchor":"mcp-policy-allow-deny-entries-now-expand-var-environment-ref","heading":"MCP policy allow\/deny entries now expand ${VAR} environment references, and unsafe URL expansions fail closed","tier":"use","area":"MCP","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.219\/e\/mcp-policy-allow-deny-entries-now-expand-var-environment-ref","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.219","markdown":"### MCP policy allow\/deny entries now expand `${VAR}` environment references, and unsafe URL expansions fail closed\n\nMCP allow and deny policy entries now expand ${VAR} references, skipping allowlist entries whose expansion looks unsafe.\n\n**What**\n\n`allowedMcpServers` and `deniedMcpServers` predicates are no longer matched literally; stdio `serverCommand` entries and remote `serverUrl` patterns go through environment-variable expansion first, with a safety analysis that discards allowlist entries whose expansion changes what the pattern means.\n\n**Details**\n\n- Denylist expansion uses a merged env drawn from global config, user, flag and policy settings as fallbacks; the allowlist path uses the settings-derived env.\n- Substituted values are normalised through a placeholder that returns the constant `zzenvsubzz` (or a digit-zeroed form for numeric values, `::` for IPv6-looking ones) so the expanded URL can be re-parsed and compared against the original.\n- Flagged as unsafe: an injected value that adds wildcard semantics, changes the URL's structure or hostname, or introduces traversal or query\/fragment characters.\n- Allowlist URL entries with an unsafe expansion are skipped, so they fail closed; denylist entries still apply.\n- Missing variables emit a debug warning that the predicate references environment variables not present in the policy expansion env; unsafe expansions log that the expansion was unsafe.\n- Neither the placeholder nor the wildcardVars analysis exists in v2.1.218, and the settings schema descriptions were not updated to mention any of it.\n\n**Evidence**\n\n`zzenvsubzz`, `MCP policy URL predicate expansion was unsafe`\n\n- Area: MCP\n- Names: `allowedMcpServers`, `deniedMcpServers`, `serverCommand`, `serverUrl`\n- Tier: Use it now\n- Useful: 4\/5\n- Signal: 0\/5"}