From a40e6ad2f3e04e429fc80330c3436425294cbefb Mon Sep 17 00:00:00 2001
From: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
Date: Sun, 15 Mar 2026 14:34:02 -0400
Subject: [PATCH] Scope validation to shell-backed install paths only

---
 src/fastmcp/cli/install/claude_code.py | 4 +++-
 src/fastmcp/cli/install/gemini_cli.py  | 4 +++-
 src/fastmcp/cli/install/shared.py      | 2 --
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/src/fastmcp/cli/install/claude_code.py b/src/fastmcp/cli/install/claude_code.py
index a88413a32..5aa377568 100644
--- a/src/fastmcp/cli/install/claude_code.py
+++ b/src/fastmcp/cli/install/claude_code.py
@@ -12,7 +12,7 @@ from rich import print
 from fastmcp.utilities.logging import get_logger
 from fastmcp.utilities.mcp_server_config.v1.environments.uv import UVEnvironment
 
-from .shared import process_common_args
+from .shared import process_common_args, validate_server_name
 
 logger = get_logger(__name__)
 
@@ -124,6 +124,8 @@ def install_claude_code(
     # Build the full command
     full_command = env_config.build_command(["fastmcp", "run", server_spec])
 
+    validate_server_name(name)
+
     # Build claude mcp add command
     cmd_parts = [claude_cmd, "mcp", "add", name]
 
diff --git a/src/fastmcp/cli/install/gemini_cli.py b/src/fastmcp/cli/install/gemini_cli.py
index 42b6ec778..29cc39e15 100644
--- a/src/fastmcp/cli/install/gemini_cli.py
+++ b/src/fastmcp/cli/install/gemini_cli.py
@@ -12,7 +12,7 @@ from rich import print
 from fastmcp.utilities.logging import get_logger
 from fastmcp.utilities.mcp_server_config.v1.environments.uv import UVEnvironment
 
-from .shared import process_common_args
+from .shared import process_common_args, validate_server_name
 
 logger = get_logger(__name__)
 
@@ -129,6 +129,8 @@ def install_gemini_cli(
         for key, value in env_vars.items():
             cmd_parts.extend(["-e", f"{key}={value}"])
 
+    validate_server_name(name)
+
     # Add server name and command
     cmd_parts.extend([name, full_command[0], "--"])
     cmd_parts.extend(full_command[1:])
diff --git a/src/fastmcp/cli/install/shared.py b/src/fastmcp/cli/install/shared.py
index ce35bd886..df22f5bbf 100644
--- a/src/fastmcp/cli/install/shared.py
+++ b/src/fastmcp/cli/install/shared.py
@@ -144,8 +144,6 @@ async def process_common_args(
             )
             name = file.stem
 
-    validate_server_name(name)
-
     # Process environment variables if provided
     env_dict: dict[str, str] | None = None
     if env_file or env_vars: