Add --allowed_mcp_server_names flag (#3464)

1 files changed, 19 insertions, 1 deletions

diff --git a/packages/cli/src/config/config.ts b/packages/cli/src/config/config.ts
index 7eed1db7..b32ae50c 100644
--- a/packages/cli/src/config/config.ts
+++ b/packages/cli/src/config/config.ts
@@ -48,6 +48,7 @@ interface CliArgs {
   telemetryTarget: string | undefined;
   telemetryOtlpEndpoint: string | undefined;
   telemetryLogPrompts: boolean | undefined;
+  allowed_mcp_server_names: string | undefined;
 }
 
 async function parseArguments(): Promise<CliArgs> {
@@ -123,6 +124,10 @@ async function parseArguments(): Promise<CliArgs> {
       description: 'Enables checkpointing of file edits',
       default: false,
     })
+    .option('allowed_mcp_server_names', {
+      type: 'string',
+      description: 'Allowed MCP server names',
+    })
     .version(await getCliVersion()) // This will enable the --version flag based on package.json
     .alias('v', 'version')
     .help()
@@ -186,9 +191,22 @@ export async function loadCliConfig(
     extensionContextFilePaths,
   );
 
-  const mcpServers = mergeMcpServers(settings, extensions);
+  let mcpServers = mergeMcpServers(settings, extensions);
   const excludeTools = mergeExcludeTools(settings, extensions);
 
+  if (argv.allowed_mcp_server_names) {
+    const allowedNames = new Set(
+      argv.allowed_mcp_server_names.split(',').filter(Boolean),
+    );
+    if (allowedNames.size > 0) {
+      mcpServers = Object.fromEntries(
+        Object.entries(mcpServers).filter(([key]) => allowedNames.has(key)),
+      );
+    } else {
+      mcpServers = {};
+    }
+  }
+
   const sandboxConfig = await loadSandboxConfig(settings, argv);
 
   return new Config({