Fix extension MCP server env var loading by chrstnb · Pull Request #20374 · google-gemini/gemini-cli

chrstnb · 2026-02-26T00:38:44Z

Summary

Env vars provided by extension settings were not loading due to recent changes. This fixes that

Details

Related Issues

How to Validate

gemini extensions install https://github.com/chrstnb/testing-extension
set a random value for the setting (e.g., "1234")
run the CLI locally
ask the CLI to get the key, which should invoke the get_key tool, which should return "1234"

Pre-Merge Checklist

gemini-code-assist · 2026-02-26T00:38:58Z

Summary of Changes

Hello @chrstnb, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request resolves an issue where environment variables provided by extension settings were not being loaded correctly by the MCP server. The changes ensure that extension-defined environment variables are properly integrated into the server's execution environment and are available for resolution within other configuration settings, thereby restoring expected functionality for extensions.

Highlights

Extension Environment Variables: Extension settings are now correctly loaded and included as environment variables when communicating with the MCP server, addressing a recent regression.
Environment Variable Resolution: Environment variables defined within mcpServerConfig.env can now properly resolve values provided by extension settings.
Test Coverage: New test cases have been added to validate the correct inclusion and resolution of extension-provided environment variables.

Changelog

packages/core/src/tools/mcp-client.test.ts
- Added a test case to ensure extension settings with defined values are included in the environment.
- Added a test case to verify that environment variables in mcpServerConfig.env can be resolved using extension settings.
packages/core/src/tools/mcp-client.ts
- Imported GeminiCLIExtension type for better type safety.
- Introduced a new utility function getExtensionEnvironment to extract environment variables from extension settings.
- Modified createTransportRequestInit to incorporate extension environment variables when expanding headers.
- Updated createTransport to include extension environment variables in the final environment passed to the MCP server.
- Ensured that environment variables defined in mcpServerConfig.env are expanded using both process environment and extension environment variables.

Activity

No specific activity (comments, reviews, or progress updates) has been recorded for this pull request yet.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

github-actions · 2026-02-26T00:41:58Z

Size Change: +966 B (0%)

Total Size: 25.7 MB

ℹ️ View Unchanged

Filename	Size	Change
`./bundle/gemini.js`	25.2 MB	+966 B (0%)
`./bundle/node_modules/@google/gemini-cli-devtools/dist/client/main.js`	221 kB	0 B
`./bundle/node_modules/@google/gemini-cli-devtools/dist/src/_client-assets.js`	227 kB	0 B
`./bundle/node_modules/@google/gemini-cli-devtools/dist/src/index.js`	11.5 kB	0 B
`./bundle/node_modules/@google/gemini-cli-devtools/dist/src/types.js`	132 B	0 B
`./bundle/sandbox-macos-permissive-open.sb`	890 B	0 B
`./bundle/sandbox-macos-permissive-proxied.sb`	1.31 kB	0 B
`./bundle/sandbox-macos-restrictive-open.sb`	3.36 kB	0 B
`./bundle/sandbox-macos-restrictive-proxied.sb`	3.56 kB	0 B
`./bundle/sandbox-macos-strict-open.sb`	4.82 kB	0 B
`./bundle/sandbox-macos-strict-proxied.sb`	5.02 kB	0 B

_{compressed-size-action}

gemini-code-assist

Code Review

This pull request aims to include extension settings when creating transports for MCP servers. However, it introduces significant security risks by using unsanitized system environment variables for expansion in both HTTP headers and stdio-based MCP servers, potentially leading to information exposure. Additionally, there's a logic issue in createTransport where environment variables from process.env incorrectly override extension settings. The merging of environment variables should be refactored to ensure proper precedence and consistent use of merge operations.

chrstnb · 2026-02-27T16:07:55Z

/patch release

github-actions · 2026-02-27T16:08:16Z

✅ Patch workflow(s) dispatched successfully!

📋 Details:

Channels: stable,preview
Commit: 58df1c62375dada9be70421590d19d452d08583c
Workflows Created: 2

🔗 Track Progress:

# Conflicts: # packages/core/src/tools/mcp-client.test.ts # packages/core/src/tools/mcp-client.ts

github-actions · 2026-02-27T16:10:39Z

🚀 Patch PR Created!

📋 Patch Details:

Environment: prod
Channel: stable → will publish to npm tag latest
Commit: 58df1c62375dada9be70421590d19d452d08583c
Hotfix Branch: hotfix/v0.30.0/0.30.1/stable/cherry-pick-58df1c6/pr-20374
Hotfix PR: #20567
⚠️ Status: Cherry-pick conflicts detected - manual resolution required

📝 Next Steps:

⚠️ Resolve conflicts in the hotfix PR first: #20567
Test your changes after resolving conflicts
Once merged, the patch release will automatically trigger
You'll receive updates here when the release completes

🔗 Track Progress:

View hotfix PR #20567

github-actions · 2026-02-27T16:10:45Z

🚀 Patch PR Created!

📋 Patch Details:

Environment: prod
Channel: preview → will publish to npm tag preview
Commit: 58df1c62375dada9be70421590d19d452d08583c
Hotfix Branch: hotfix/v0.31.0-preview.0/0.31.0-preview.1/preview/cherry-pick-58df1c6/pr-20374
Hotfix PR: #20568

📝 Next Steps:

Review and approve the hotfix PR: #20568
Once merged, the patch release will automatically trigger
You'll receive updates here when the release completes

🔗 Track Progress:

View hotfix PR #20568

github-actions · 2026-02-27T18:00:35Z

🚀 Patch Release Started!

📋 Release Details:

Environment: prod
Channel: stable → publishing to npm tag latest
Version: v0.30.0
Hotfix PR: Merged ✅
Release Branch: release/v0.30.0-pr-20374

⏳ Status: The patch release is now running. You'll receive another update when it completes.

🔗 Track Progress:

View release workflow

github-actions · 2026-02-27T18:04:02Z

🚀 Patch Release Started!

📋 Release Details:

Environment: prod
Channel: preview → publishing to npm tag preview
Version: v0.31.0-preview.0
Hotfix PR: Merged ✅
Release Branch: release/v0.31.0-preview.0-pr-20374

⏳ Status: The patch release is now running. You'll receive another update when it completes.

🔗 Track Progress:

View release workflow

github-actions · 2026-02-27T18:33:35Z

✅ Patch Release Complete!

📦 Release Details:

Version: 0.30.1
NPM Tag: latest
Channel: stable
Dry Run: false

🎉 Status: Your patch has been successfully released and published to npm!

📝 What's Available:

GitHub Release: View release v0.30.1
NPM Package: npm install @google/gemini-cli@latest

🔗 Links:

github-actions · 2026-02-27T18:35:57Z

✅ Patch Release Complete!

📦 Release Details:

Version: 0.31.0-preview.1
NPM Tag: preview
Channel: preview
Dry Run: false

🎉 Status: Your patch has been successfully released and published to npm!

📝 What's Available:

GitHub Release: View release v0.31.0-preview.1
NPM Package: npm install @google/gemini-cli@preview

🔗 Links:

Fix extension MCP server env var loading

a35fa2d

chrstnb requested a review from a team as a code owner February 26, 2026 00:38

gemini-code-assist Bot reviewed Feb 26, 2026

View reviewed changes

Comment thread packages/core/src/tools/mcp-client.ts

Comment thread packages/core/src/tools/mcp-client.ts

gemini-cli Bot added the priority/p1 Important and should be addressed in the near term. label Feb 26, 2026

SandyTao520 force-pushed the main branch from 4a78a96 to 0bf3a01 Compare February 26, 2026 03:03

sanitize env var expansion

62edec8

chrstnb requested a review from galdawave February 26, 2026 15:34

NTaylorMullen approved these changes Feb 26, 2026

View reviewed changes

galdawave approved these changes Feb 27, 2026

View reviewed changes

chrstnb added this pull request to the merge queue Feb 27, 2026

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Feb 27, 2026

chrstnb added this pull request to the merge queue Feb 27, 2026

Merged via the queue into main with commit 58df1c6 Feb 27, 2026
27 checks passed

chrstnb deleted the cb/fixextmcp branch February 27, 2026 15:03

github-actions Bot pushed a commit that referenced this pull request Feb 27, 2026

Fix extension MCP server env var loading (#20374)

29fe12f

# Conflicts: # packages/core/src/tools/mcp-client.test.ts # packages/core/src/tools/mcp-client.ts

github-actions Bot pushed a commit that referenced this pull request Feb 27, 2026

Fix extension MCP server env var loading (#20374)

3e6309a

gemini-code-assist Bot mentioned this pull request Feb 27, 2026

Changelog for v0.32.0-preview.0 #20627

Merged

BryanBradfo pushed a commit to BryanBradfo/gemini-cli that referenced this pull request Mar 5, 2026

Fix extension MCP server env var loading (google-gemini#20374)

9dbbfa7

liamhelmer pushed a commit to badal-io/gemini-cli that referenced this pull request Mar 12, 2026

Fix extension MCP server env var loading (google-gemini#20374)

4206966

warrenzhu25 pushed a commit to warrenzhu25/gemini-cli that referenced this pull request Apr 9, 2026

Fix extension MCP server env var loading (google-gemini#20374)

2ae49de

cocosheng-g pushed a commit that referenced this pull request May 6, 2026

Fix extension MCP server env var loading (#20374)

f773a97

sripasg added the size/m A medium sized PR label Jun 2, 2026

Uh oh!

Conversation

chrstnb commented Feb 26, 2026

Summary

Details

Related Issues

How to Validate

Pre-Merge Checklist

Uh oh!

gemini-code-assist Bot commented Feb 26, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

github-actions Bot commented Feb 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chrstnb commented Feb 27, 2026

Uh oh!

github-actions Bot commented Feb 27, 2026

Uh oh!

github-actions Bot commented Feb 27, 2026

Uh oh!

github-actions Bot commented Feb 27, 2026

Uh oh!

github-actions Bot commented Feb 27, 2026

Uh oh!

github-actions Bot commented Feb 27, 2026

Uh oh!

github-actions Bot commented Feb 27, 2026

Uh oh!

github-actions Bot commented Feb 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions Bot commented Feb 26, 2026 •

edited

Loading