NousResearch/hermes-agent

MCP stdio command lookup mutates parent environment

Cluster 117214. Data as of 2026-10-24 13:18 UTC

Nothing open on GitHub. Fix merged in #117626 on 20 Sep 2026. Check it covers your case.

open issues

open PRs

items grouped

Known?: Yes. 4 related items grouped here, 1 issue already closed.
Fix event: A fix was merged to main in PR #117626. Check it covers your case. No release data is tracked.
Tracker: The maintainers' tracker marks this resolved, deciding PR #117626. That is separate from the fix event.
Still open: Nothing open on GitHub.

Next step: read #117626, then check it covers your case.

Read #117626 Pick up a Lab task

These issues and PRs address a bug where MCP stdio command resolution incorrectly reads from or mutates the parent process's PATH and PATHEXT environment variables. Multiple fix attempts focus on isolating command lookup to the child environment only.

Open issues0

No open issues.

Open PRs0

No open pull requests.

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

#117626 fix(mcp): stdio command lookup stops mutating PATHEXT and reading the parent PATH (#117214 #117213, salvage #117238)

merged to main

files: tests/tools/test_mcp_tool_issue_948.py, tools/mcp_tool_config.py

2 PRs closed without merging

From the close comments: done elsewhere 1 · merged via another change 1

#117219 fix(mcp): keep stdio command lookup inside the child env · done elsewhere → 9eca7f3, #117626
#117238 fix(mcp): resolve stdio commands without reading or mutating the parent env · merged via another change → 9eca7f3, #117626

Closed issues · 1

Closed#117214_which_with_config_pathext mutates the parent process's PATHEXT during MCP command lookup

How this cluster was grouped

Link evidence (structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
Pairwise link density 0.50: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Merged PRs: #117626
Closed issues: 1
Attempts: 2 PRs closed without merging
Fix link checked: 20 Sep 2026

For your agent

The same facts, typed.

cluster/117214.json
cluster/117214.md