From 4cf98ddec3cc16b3201a0d2fa49ebda15f770ac8 Mon Sep 17 00:00:00 2001
From: shum <github.shum@liber.li>
Date: Sat, 24 Oct 2026 14:56:58 +0000
Subject: [PATCH] mcp: reject inherited names as commands

---
 packages/simplex-chat-mcp/src/cli.ts           | 18 +++++++++---------
 .../simplex-chat-mcp/test/unit/cli.test.ts     |  2 +-
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/packages/simplex-chat-mcp/src/cli.ts b/packages/simplex-chat-mcp/src/cli.ts
index e2d4c5f5ad..dbc9030345 100644
--- a/packages/simplex-chat-mcp/src/cli.ts
+++ b/packages/simplex-chat-mcp/src/cli.ts
@@ -22,17 +22,17 @@ Environment:
 
 export type Command = "session" | "daemon" | "hook session-start" | "link" | "reset-owners" | "help"
 
-const commands: {[args: string]: Command} = {
-  "session": "session",
-  "daemon": "daemon",
-  "hook session-start": "hook session-start",
-  "link": "link",
-  "reset-owners": "reset-owners",
-  "--help": "help",
-}
+const commands = new Map<string, Command>([
+  ["session", "session"],
+  ["daemon", "daemon"],
+  ["hook session-start", "hook session-start"],
+  ["link", "link"],
+  ["reset-owners", "reset-owners"],
+  ["--help", "help"],
+])
 
 export function parseCommand(args: string[]): Command {
-  const command = commands[args.join(" ")]
+  const command = commands.get(args.join(" "))
   if (command === undefined) throw new ExitError("Unknown command. Run simplex-mcp --help.", 2)
   return command
 }
diff --git a/packages/simplex-chat-mcp/test/unit/cli.test.ts b/packages/simplex-chat-mcp/test/unit/cli.test.ts
index 85dbc00b1d..7b9a4e5bbe 100644
--- a/packages/simplex-chat-mcp/test/unit/cli.test.ts
+++ b/packages/simplex-chat-mcp/test/unit/cli.test.ts
@@ -13,7 +13,7 @@ describe("commands", () => {
 
   it("refuses other commands and extra arguments", () => {
     const unknown = new ExitError("Unknown command. Run simplex-mcp --help.", 2)
-    for (const args of [[], ["serve", "agent"], ["register", "agent"], ["hook"], ["link", "x"], ["session", "--port", "1"]]) expect(() => parseCommand(args)).toThrow(unknown)
+    for (const args of [[], ["serve", "agent"], ["register", "agent"], ["hook"], ["link", "x"], ["session", "--port", "1"], ["constructor"], ["__proto__"], ["toString"]]) expect(() => parseCommand(args)).toThrow(unknown)
   })
 
   it("documents the commands, the install and the data folder", () => {