fix(mcp): resolve server names by own-property, not the prototype chain

getMcpConfigByName and the mcp remove handler look names up in plain
object maps built from JSON config with a bare servers[name] truthiness
check. Reserved names ('constructor', '__proto__', 'toString', …) resolve
to inherited Object.prototype members, which are truthy, so:

- `mcp get constructor` skips the not-found guard, prints a fabricated
  record, and hands the Object constructor to the health check;
- `mcp remove constructor` reports the reserved name as present in
  multiple scopes and prompts to pick one instead of "No MCP server found".

The same leak reaches runAgent and the print handlers, which all route
through getMcpConfigByName. Gate every lookup on Object.hasOwn so only
real, own-property server names resolve.

Author: 0xfandom

src/cli/handlers/mcp.tsx

@@ -201,17 +201,22 @@ export async function mcpRemoveHandler(name: string, options: {
     const projectConfig = getCurrentProjectConfig();
     const globalConfig = getGlobalConfig();
 
-    // Check if server exists in project scope (.mcp.json)
+    // Check if server exists in project scope (.mcp.json). These maps are plain
+    // objects from JSON config, so a `!!servers[name]` / `?.[name]` check treats
+    // inherited Object.prototype members ('constructor', '__proto__', …) as
+    // present. `mcp remove constructor` would then report the reserved name as
+    // living in multiple scopes instead of "No MCP server found". Gate on
+    // own-property.
     const {
       servers: projectServers
     } = getMcpConfigsByScope('project');
-    const mcpJsonExists = !!projectServers[name];
+    const mcpJsonExists = Object.hasOwn(projectServers, name);
 
     // Count how many scopes contain this server
     const scopes: Array<Exclude<ConfigScope, 'dynamic'>> = [];
-    if (projectConfig.mcpServers?.[name]) scopes.push('local');
+    if (Object.hasOwn(projectConfig.mcpServers ?? {}, name)) scopes.push('local');
     if (mcpJsonExists) scopes.push('project');
-    if (globalConfig.mcpServers?.[name]) scopes.push('user');
+    if (Object.hasOwn(globalConfig.mcpServers ?? {}, name)) scopes.push('user');
     if (scopes.length === 0) {
       cliError(`No MCP server found with name: "${name}"`);
     } else if (scopes.length === 1) {

src/services/mcp/config.protoName.test.ts

@@ -0,0 +1,60 @@
+import { afterEach, beforeEach, expect, test } from 'bun:test'
+
+import {
+  getGlobalConfig,
+  saveCurrentProjectConfig,
+  saveGlobalConfig,
+} from '../../utils/config.js'
+import { getMcpConfigByName } from './config.js'
+
+// The MCP `servers` maps are plain objects built from JSON config, so a bare
+// `servers[name]` lookup exposes inherited Object.prototype members. A user
+// running `openclaude mcp get constructor` (or `__proto__`, `toString`, …) must
+// get "not found", not the Object constructor cast as a server config.
+const PROTO_NAMES = [
+  'constructor',
+  '__proto__',
+  'toString',
+  'hasOwnProperty',
+  'valueOf',
+  'isPrototypeOf',
+]
+
+let savedGlobalMcp: ReturnType<typeof getGlobalConfig>['mcpServers']
+
+beforeEach(() => {
+  process.env.NODE_ENV = 'test'
+  savedGlobalMcp = getGlobalConfig().mcpServers
+  saveGlobalConfig(config => ({
+    ...config,
+    mcpServers: { realserver: { command: 'echo', args: [] } },
+  }))
+  saveCurrentProjectConfig(config => ({
+    ...config,
+    mcpServers: { locallyreal: { command: 'echo', args: [] } },
+  }))
+})
+
+afterEach(() => {
+  saveGlobalConfig(config => ({ ...config, mcpServers: savedGlobalMcp }))
+  saveCurrentProjectConfig(config => ({ ...config, mcpServers: undefined }))
+})
+
+test('resolves a real server by name', () => {
+  const found = getMcpConfigByName('realserver')
+  expect(found).not.toBeNull()
+  expect(found?.scope).toBe('user')
+})
+
+test('returns null for a plainly missing name', () => {
+  expect(getMcpConfigByName('nope-not-here')).toBeNull()
+})
+
+test('returns null for Object.prototype member names', () => {
+  // Before the fix each of these resolved to an inherited function (truthy),
+  // so the lookup returned a bogus config and callers skipped their not-found
+  // guard.
+  for (const name of PROTO_NAMES) {
+    expect(getMcpConfigByName(name)).toBeNull()
+  }
+})

src/services/mcp/config.ts

@@ -1031,29 +1031,36 @@ export function getMcpConfigsByScope(
  * @returns The server configuration with scope, or undefined if not found
  */
 export function getMcpConfigByName(name: string): ScopedMcpServerConfig | null {
+  // The `servers` maps are plain object literals populated from JSON config, so
+  // a bare `servers[name]` lookup resolves inherited Object.prototype members
+  // (`constructor`, `toString`, `__proto__`, …) as truthy values. `mcp get
+  // constructor` would then skip the not-found guard and pass the Object
+  // constructor on as a server config. Gate every lookup on own-property.
   const { servers: enterpriseServers } = getMcpConfigsByScope('enterprise')
 
   // When MCP is locked to plugin-only, only enterprise servers are reachable
   // by name. User/project/local servers are blocked — same as getClaudeCodeMcpConfigs().
   if (isRestrictedToPluginOnly('mcp')) {
-    return enterpriseServers[name] ?? null
+    return Object.hasOwn(enterpriseServers, name)
+      ? enterpriseServers[name]!
+      : null
   }
 
   const { servers: userServers } = getMcpConfigsByScope('user')
   const { servers: projectServers } = getMcpConfigsByScope('project')
   const { servers: localServers } = getMcpConfigsByScope('local')
 
-  if (enterpriseServers[name]) {
-    return enterpriseServers[name]
+  if (Object.hasOwn(enterpriseServers, name)) {
+    return enterpriseServers[name]!
   }
-  if (localServers[name]) {
-    return localServers[name]
+  if (Object.hasOwn(localServers, name)) {
+    return localServers[name]!
   }
-  if (projectServers[name]) {
-    return projectServers[name]
+  if (Object.hasOwn(projectServers, name)) {
+    return projectServers[name]!
   }
-  if (userServers[name]) {
-    return userServers[name]
+  if (Object.hasOwn(userServers, name)) {
+    return userServers[name]!
   }
 
   return null