Security: MCP stdio server inherits full process environment (env leakage)

[Correctover]

Summary

The start_mcp_stdio_server function in src-tauri/src/mcp.rs spawns MCP server subprocesses using Rust's std::process::Command without calling env_clear(). In Rust, Command inherits the parent process's entire environment by default. This leaks all of note-gen's environment variables (API keys, tokens, credentials) to every spawned MCP server subprocess.

Vulnerability Details

File: src-tauri/src/mcp.rs, function start_mcp_stdio_server() (line ~190)

Vulnerable code:

let mut cmd = Command::new(&command);
cmd.args(&args);

// ... stdin/stdout/stderr setup ...

// Only ADDS user-configured env on top of inherited env
for (key, value) in env {
    cmd.env(key, value);
}

In Rust's std::process::Command, the environment is inherited by default. The cmd.env(key, value) call only adds or updates individual variables — it does NOT replace the inherited environment. To prevent inheritance, cmd.env_clear() must be called explicitly before setting env vars.

This means all of note-gen's Tauri process environment is passed to the MCP server subprocess, including:

• API keys configured in the app or system environment
• Authentication tokens
• Any sensitive data in the user's environment

Impact

A malicious or compromised MCP server can read all inherited environment variables and exfiltrate credentials. This is especially concerning for a Tauri desktop app where the user's system environment may contain sensitive data.

Suggested Fix

let mut cmd = Command::new(&command);
cmd.args(&args);
cmd.env_clear();  // Clear inherited environment

// Only pass safe, necessary env vars
cmd.env("PATH", std::env::var("PATH").unwrap_or_default());
cmd.env("HOME", std::env::var("HOME").unwrap_or_default());

// Add user-configured env
for (key, value) in &env {
    cmd.env(key, value);
}

Environment

• note-gen version: latest (dev branch)
• Affects: all platforms with stdio-based MCP servers configured

Related

Same systemic pattern observed in CowAgent, AstrBot, NextChat, LobeChat, SiYuan. Environment variable inheritance from host to MCP subprocess is a widespread security concern in the MCP ecosystem.