Function getAllowedMcpServersForTask

src/core/tools/mcpServerRestriction.ts:34–52

(task: Task)

 * @returns The mode's `allowedMcpServers` allowlist, or `undefined` when unrestricted.
 */
export async function getAllowedMcpServersForTask(task: Task): Promise<string[] | undefined> {
	const provider = task.providerRef.deref()

	// Be defensive: provider may be gone, or `getState` may be unavailable (e.g. in tests).
	// In those cases we cannot determine an allowlist, so treat the mode as unrestricted to
	// avoid breaking tool execution — the listing/filtering layer remains the primary control.
	if (!provider || typeof provider.getState !== "function") {
		return undefined
	}

	try {
		const state = await provider.getState()
		const modeSlug = state?.mode ?? defaultModeSlug
		const modeConfig = getModeBySlug(modeSlug, state?.customModes)
		return modeConfig?.allowedMcpServers
	} catch {
		return undefined
	}
}

/**
 * Execution-time defense layer for per-mode MCP server restrictions.