feat(core): support glob patterns in mcp.allowed and mcp.excluded

packages/cli/src/acp-integration/acpAgent.ts

@@ -60,6 +60,7 @@ import {
   unregisterGoalHook,
   ToolNames,
   FORK_SUBAGENT_TYPE,
+  matchesAnyServerPattern,
 } from '@qwen-code/qwen-code-core';
 import { randomUUID } from 'node:crypto';
 import type {
@@ -5596,23 +5597,34 @@ class QwenAgent implements Agent {
 
         if (action === 'enable') {
           const settings = loadSettings(this.config.getTargetDir());
+          let settingsChanged = false;
           for (const scope of [SettingScope.User, SettingScope.Workspace]) {
             const scopeSettings = settings.forScope(scope).settings;
             const currentExcluded = scopeSettings.mcp?.excluded || [];
-            if (currentExcluded.includes(serverName)) {
-              settings.setValue(
-                scope,
-                'mcp.excluded',
-                currentExcluded.filter((name: string) => name !== serverName),
-              );
+            const filtered = currentExcluded.filter(
+              (pattern: string) => pattern !== serverName,
+            );
+            if (filtered.length !== currentExcluded.length) {
+              settings.setValue(scope, 'mcp.excluded', filtered);
+              settingsChanged = true;
             }
           }
           const currentExcluded = this.config.getExcludedMcpServers() || [];
-          this.config.setExcludedMcpServers(
-            currentExcluded.filter((name: string) => name !== serverName),
+          const runtimeFiltered = currentExcluded.filter(
+            (pattern: string) => pattern !== serverName,
           );
+          let runtimeChanged = false;
+          if (runtimeFiltered.length !== currentExcluded.length) {
+            this.config.setExcludedMcpServers(runtimeFiltered);
+            runtimeChanged = true;
+          }
           await toolRegistry.discoverToolsForServer(serverName);
-          return { serverName, action, ok: true, changed: true };
+          return {
+            serverName,
+            action,
+            ok: true,
+            changed: settingsChanged || runtimeChanged,
+          };
         }
 
         if (action === 'disable') {
@@ -5635,18 +5647,27 @@ class QwenAgent implements Agent {
           }
           const scopeSettings = settings.forScope(targetScope).settings;
           const currentExcluded = scopeSettings.mcp?.excluded || [];
-          if (!currentExcluded.includes(serverName)) {
+          let settingsChanged = false;
+          if (!matchesAnyServerPattern(serverName, currentExcluded)) {
             settings.setValue(targetScope, 'mcp.excluded', [
               ...currentExcluded,
               serverName,
             ]);
+            settingsChanged = true;
           }
           const runtimeExcluded = this.config.getExcludedMcpServers() || [];
-          if (!runtimeExcluded.includes(serverName)) {
+          let runtimeChanged = false;
+          if (!matchesAnyServerPattern(serverName, runtimeExcluded)) {
             this.config.setExcludedMcpServers([...runtimeExcluded, serverName]);
+            runtimeChanged = true;
           }
           await toolRegistry.disableMcpServer(serverName);
-          return { serverName, action, ok: true, changed: true };
+          return {
+            serverName,
+            action,
+            ok: true,
+            changed: settingsChanged || runtimeChanged,
+          };
         }
 
         if (action === 'clear-auth') {

packages/cli/src/config/settingsSchema.ts

@@ -2416,7 +2416,8 @@ const SETTINGS_SCHEMA = {
         // restart-required.
         requiresRestart: false,
         default: undefined as string[] | undefined,
-        description: 'A list of MCP servers to allow.',
+        description:
+          'A list of MCP servers to allow. Supports glob patterns (e.g. "*puppeteer*").',
         showInDialog: false,
         mergeStrategy: MergeStrategy.CONCAT,
       },
@@ -2429,7 +2430,8 @@ const SETTINGS_SCHEMA = {
         // restart-required.
         requiresRestart: false,
         default: undefined as string[] | undefined,
-        description: 'A list of MCP servers to exclude.',
+        description:
+          'A list of MCP servers to exclude. Supports glob patterns (e.g. "*puppeteer*"). Takes precedence over mcp.allowed.',
         showInDialog: false,
         mergeStrategy: MergeStrategy.CONCAT,
       },

packages/cli/src/ui/components/extensions/tabs/InstalledTab.tsx

@@ -26,6 +26,7 @@ import {
   mcpServerRequiresOAuth,
   MCPOAuthTokenStorage,
   createDebugLogger,
+  matchesAnyServerPattern,
 } from '@qwen-code/qwen-code-core';
 import {
   loadSettings,
@@ -566,7 +567,7 @@ export const InstalledTab = ({
           // Disable: add to excluded + disconnect.
           const excluded =
             settings.forScope(targetScope).settings.mcp?.excluded ?? [];
-          if (!excluded.includes(item.name)) {
+          if (!matchesAnyServerPattern(item.name, excluded)) {
             settings.setValue(targetScope, 'mcp.excluded', [
               ...excluded,
               item.name,

packages/cli/src/ui/components/extensions/views/McpServerActionsView.tsx

@@ -19,6 +19,7 @@ import {
   DiscoveredMCPTool,
   MCPOAuthTokenStorage,
   createDebugLogger,
+  matchesAnyServerPattern,
 } from '@qwen-code/qwen-code-core';
 import { loadSettings, SettingScope } from '../../../../config/settings.js';
 import { getErrorMessage } from '../../../../utils/errors.js';
@@ -326,7 +327,7 @@ export const McpServerActionsView = ({
             : SettingScope.User;
         const settings = loadSettings();
         const excluded = settings.forScope(scope).settings.mcp?.excluded || [];
-        if (!excluded.includes(serverName)) {
+        if (!matchesAnyServerPattern(serverName, excluded)) {
           settings.setValue(scope, 'mcp.excluded', [...excluded, serverName]);
         }
         await toolRegistry?.disableMcpServer(serverName);

packages/cli/src/ui/components/mcp/MCPManagementDialog.tsx

@@ -39,6 +39,7 @@ import {
   type AnyDeclarativeTool,
   type DiscoveredMCPPrompt,
   createDebugLogger,
+  matchesAnyServerPattern,
 } from '@qwen-code/qwen-code-core';
 import { loadSettings, SettingScope } from '../../../config/settings.js';
 import { loadMcpApprovals } from '../../../config/mcpApprovals.js';
@@ -534,8 +535,8 @@ export const MCPManagementDialog: React.FC<MCPManagementDialogProps> = ({
         ).settings;
         const currentExcluded = scopeSettings.mcp?.excluded || [];
 
-        // If server is not in exclusion list, add it
-        if (!currentExcluded.includes(server.name)) {
+        // If server is not already covered by an exclusion pattern, add it
+        if (!matchesAnyServerPattern(server.name, currentExcluded)) {
           const newExcluded = [...currentExcluded, server.name];
           settings.setValue(
             targetScope === 'user' ? SettingScope.User : SettingScope.Workspace,
@@ -580,8 +581,8 @@ export const MCPManagementDialog: React.FC<MCPManagementDialogProps> = ({
         ).settings;
         const currentExcluded = scopeSettings.mcp?.excluded || [];
 
-        // If server is not in exclusion list, add it
-        if (!currentExcluded.includes(server.name)) {
+        // If server is not already covered by an exclusion pattern, add it
+        if (!matchesAnyServerPattern(server.name, currentExcluded)) {
           const newExcluded = [...currentExcluded, server.name];
           settings.setValue(
             scope === 'user' ? SettingScope.User : SettingScope.Workspace,

packages/core/src/config/config.test.ts

@@ -15,6 +15,8 @@ import {
   APPROVAL_MODE_INFO,
   MCPServerConfig,
   TrustGateError,
+  matchesServerPattern,
+  matchesAnyServerPattern,
 } from './config.js';
 import { Storage } from './storage.js';
 import * as fs from 'node:fs';
@@ -344,6 +346,92 @@ vi.mock('../core/toolHookTriggers.js', () => ({
   fireNotificationHook: vi.fn().mockResolvedValue({}),
 }));
 
+describe('matchesServerPattern', () => {
+  it('exact match when no glob characters', () => {
+    expect(matchesServerPattern('puppeteer', 'puppeteer')).toBe(true);
+    expect(matchesServerPattern('puppeteer', 'playwright')).toBe(false);
+  });
+
+  it('* matches any sequence including empty', () => {
+    expect(matchesServerPattern('puppeteer', '*puppeteer*')).toBe(true);
+    expect(matchesServerPattern('my-puppeteer-server', '*puppeteer*')).toBe(
+      true,
+    );
+    expect(matchesServerPattern('playwright', '*puppeteer*')).toBe(false);
+    expect(matchesServerPattern('anything', '*')).toBe(true);
+    expect(matchesServerPattern('prefix-suffix', 'prefix*')).toBe(true);
+    expect(matchesServerPattern('prefix-suffix', '*suffix')).toBe(true);
+  });
+
+  it('? matches exactly one character', () => {
+    expect(matchesServerPattern('abc', 'a?c')).toBe(true);
+    expect(matchesServerPattern('ac', 'a?c')).toBe(false);
+    expect(matchesServerPattern('axc', 'a?c')).toBe(true);
+  });
+
+  it('escapes regex special characters', () => {
+    expect(matchesServerPattern('my.server', 'my.server')).toBe(true);
+    expect(matchesServerPattern('myXserver', 'my.server')).toBe(false);
+    expect(matchesServerPattern('a+b', 'a+b')).toBe(true);
+    expect(matchesServerPattern('a^b', 'a^b')).toBe(true);
+    expect(matchesServerPattern('a$b', 'a$b')).toBe(true);
+    expect(matchesServerPattern('aXb', 'a$b')).toBe(false);
+  });
+
+  it('combines glob with exact segments', () => {
+    expect(matchesServerPattern('foo-bar-baz', 'foo-*-baz')).toBe(true);
+    expect(matchesServerPattern('foo-bar-qux', 'foo-*-baz')).toBe(false);
+  });
+
+  it('handles empty name', () => {
+    expect(matchesServerPattern('', '*')).toBe(true);
+    expect(matchesServerPattern('', '?')).toBe(false);
+    expect(matchesServerPattern('', '')).toBe(true);
+  });
+
+  it('handles consecutive * in pattern', () => {
+    expect(matchesServerPattern('puppeteer', '**puppeteer**')).toBe(true);
+    expect(matchesServerPattern('abc', 'a**c')).toBe(true);
+  });
+
+  it('handles ? at pattern boundaries', () => {
+    expect(matchesServerPattern('abc', '?bc')).toBe(true);
+    expect(matchesServerPattern('abc', 'ab?')).toBe(true);
+    expect(matchesServerPattern('abc', '???')).toBe(true);
+    expect(matchesServerPattern('ab', '???')).toBe(false);
+  });
+
+  it('rejects when pattern is longer than name', () => {
+    expect(matchesServerPattern('ab', 'a*b*c')).toBe(false);
+    expect(matchesServerPattern('abc', 'a*b*c')).toBe(true);
+  });
+});
+
+describe('matchesAnyServerPattern', () => {
+  it('returns false for undefined or empty list', () => {
+    expect(matchesAnyServerPattern('puppeteer', undefined)).toBe(false);
+    expect(matchesAnyServerPattern('puppeteer', [])).toBe(false);
+  });
+
+  it('matches if any pattern matches', () => {
+    expect(
+      matchesAnyServerPattern('puppeteer', ['playwright', '*puppeteer*']),
+    ).toBe(true);
+    expect(
+      matchesAnyServerPattern('chrome', ['playwright', '*puppeteer*']),
+    ).toBe(false);
+  });
+
+  it('works with mixed exact and glob patterns', () => {
+    expect(
+      matchesAnyServerPattern('playwright', ['playwright', '*puppeteer*']),
+    ).toBe(true);
+    expect(
+      matchesAnyServerPattern('my-puppeteer', ['playwright', '*puppeteer*']),
+    ).toBe(true);
+  });
+});
+
 describe('Server Config (config.ts)', () => {
   const MODEL = 'qwen3-coder-plus';
 
@@ -1060,6 +1148,125 @@ describe('Server Config (config.ts)', () => {
       });
       expect(config.getAllowedMcpServers()).toEqual(['y']);
     });
+
+    it('getMcpServers filters by glob pattern in allowedMcpServers', async () => {
+      const config = new Config({
+        ...baseParams,
+        mcpServers: {
+          puppeteer: srvA,
+          'my-puppeteer-server': srvB,
+          playwright: srvA,
+        },
+      });
+      config.setAllowedMcpServers(['*puppeteer*']);
+      const result = config.getMcpServers();
+      expect(Object.keys(result!)).toEqual([
+        'puppeteer',
+        'my-puppeteer-server',
+      ]);
+      expect(Object.keys(result!)).not.toContain('playwright');
+    });
+
+    it('isMcpServerDisabled supports glob patterns in excludedMcpServers', () => {
+      const config = new Config({
+        ...baseParams,
+        mcpServers: {
+          puppeteer: srvA,
+          'my-puppeteer': srvA,
+          playwright: srvB,
+        },
+      });
+      config.setExcludedMcpServers(['*puppeteer*']);
+      expect(config.isMcpServerDisabled('puppeteer')).toBe(true);
+      expect(config.isMcpServerDisabled('my-puppeteer')).toBe(true);
+      expect(config.isMcpServerDisabled('playwright')).toBe(false);
+      expect(config.getMcpServers()!['puppeteer']).toBeDefined();
+      expect(config.getMcpServers()!['my-puppeteer']).toBeDefined();
+    });
+
+    it('getMcpServerUnavailableReason classifies by glob match', async () => {
+      const config = new Config({
+        ...baseParams,
+        mcpServers: {
+          puppeteer: srvA,
+          playwright: srvB,
+          chrome: srvA,
+        },
+      });
+      await config.reinitializeMcpServers({
+        puppeteer: srvA,
+        playwright: srvB,
+        chrome: srvA,
+      });
+
+      config.setAllowedMcpServers(['play*']);
+      expect(config.getMcpServerUnavailableReason('puppeteer')).toBe(
+        'not_allowed',
+      );
+      expect(
+        config.getMcpServerUnavailableReason('playwright'),
+      ).toBeUndefined();
+
+      // Clear allow-list so the excluded check is reached.
+      config.setAllowedMcpServers(undefined);
+      config.setExcludedMcpServers(['*chrome*']);
+      expect(config.getMcpServerUnavailableReason('chrome')).toBe('excluded');
+    });
+
+    it('exclude takes precedence over allow with glob patterns', async () => {
+      const config = new Config({
+        ...baseParams,
+        mcpServers: { puppeteer: srvA, playwright: srvB },
+      });
+      await config.reinitializeMcpServers({
+        puppeteer: srvA,
+        playwright: srvB,
+      });
+
+      config.setAllowedMcpServers(['*']);
+      config.setExcludedMcpServers(['puppeteer']);
+      expect(config.getMcpServerUnavailableReason('puppeteer')).toBe(
+        'excluded',
+      );
+      expect(
+        config.getMcpServerUnavailableReason('playwright'),
+      ).toBeUndefined();
+    });
+
+    it('exclude takes precedence when both lists use globs', async () => {
+      const config = new Config({
+        ...baseParams,
+        mcpServers: { puppeteer: srvA, playwright: srvB },
+      });
+      await config.reinitializeMcpServers({
+        puppeteer: srvA,
+        playwright: srvB,
+      });
+
+      config.setAllowedMcpServers(['*puppeteer*']);
+      config.setExcludedMcpServers(['puppeteer']);
+      expect(config.getMcpServerUnavailableReason('puppeteer')).toBe(
+        'excluded',
+      );
+      expect(config.isMcpServerDisabled('puppeteer')).toBe(true);
+    });
+
+    it('getBlockedMcpServers returns servers not matching allowed glob', () => {
+      const config = new Config({
+        ...baseParams,
+        mcpServers: {
+          puppeteer: srvA,
+          'my-puppeteer': srvA,
+          playwright: srvB,
+        },
+      });
+      config.setAllowedMcpServers(['*puppeteer*']);
+      const blocked = config.getBlockedMcpServers();
+      const blockedNames = blocked.map((s) => s.name);
+      expect(blockedNames).toContain('playwright');
+      expect(blockedNames).not.toContain('puppeteer');
+      expect(blockedNames).not.toContain('my-puppeteer');
+    });
   });
 
   describe('MemoryPressureMonitor isolation', () => {