From 241776b2cf94b5cf223752a271a854fcb0c5f851 Mon Sep 17 00:00:00 2001
From: juhuan <46651841+juhuan@users.noreply.github.com>
Date: Wed, 8 Jul 2026 00:22:06 +0800
Subject: [PATCH] feat(sdk): add allowed_mcp_server_names option to both SDKs

Add `allowed_mcp_server_names` (Python) / `allowedMcpServerNames` (TS)
option that maps to CLI's `--allowed-mcp-server-names` flag, allowing
users to whitelist which MCP servers are available for a session.

Note: `strict_mcp_config` was not implemented as the CLI does not have
this flag.
---
 packages/sdk-python/src/qwen_code_sdk/transport.py    |  3 +++
 packages/sdk-python/src/qwen_code_sdk/types.py        |  5 +++++
 packages/sdk-typescript/src/query/createQuery.ts      |  1 +
 .../sdk-typescript/src/transport/ProcessTransport.ts  | 10 ++++++++++
 .../sdk-typescript/src/types/queryOptionsSchema.ts    |  1 +
 packages/sdk-typescript/src/types/types.ts            | 11 +++++++++++
 6 files changed, 31 insertions(+)

diff --git a/packages/sdk-python/src/qwen_code_sdk/transport.py b/packages/sdk-python/src/qwen_code_sdk/transport.py
index 8542364943f..655025f48aa 100644
--- a/packages/sdk-python/src/qwen_code_sdk/transport.py
+++ b/packages/sdk-python/src/qwen_code_sdk/transport.py
@@ -227,6 +227,9 @@ def build_cli_arguments(options: QueryOptions) -> list[str]:
     if options.allowed_tools:
         args.extend(["--allowed-tools", ",".join(options.allowed_tools)])
 
+    if options.allowed_mcp_server_names:
+        args.extend(["--allowed-mcp-server-names", ",".join(options.allowed_mcp_server_names)])
+
     if options.auth_type:
         args.extend(["--auth-type", options.auth_type])
 
diff --git a/packages/sdk-python/src/qwen_code_sdk/types.py b/packages/sdk-python/src/qwen_code_sdk/types.py
index 3d8ec72038e..25f124b46ce 100644
--- a/packages/sdk-python/src/qwen_code_sdk/types.py
+++ b/packages/sdk-python/src/qwen_code_sdk/types.py
@@ -114,6 +114,7 @@ class QueryOptionsDict(TypedDict, total=False):
     timeout: TimeoutOptionsDict
     mcp_servers: dict[str, dict[str, Any]]
     stderr: Callable[[str], None]
+    allowed_mcp_server_names: list[str]
 
 
 @dataclass
@@ -139,6 +140,7 @@ class QueryOptions:
     timeout: TimeoutOptions = TimeoutOptions()
     mcp_servers: dict[str, dict[str, Any]] | None = None
     stderr: Callable[[str], None] | None = None
+    allowed_mcp_server_names: list[str] | None = None
 
     @classmethod
     def from_mapping(cls, value: Mapping[str, Any] | None) -> QueryOptions:
@@ -183,6 +185,9 @@ def from_mapping(cls, value: Mapping[str, Any] | None) -> QueryOptions:
                 Callable[[str], None] | None,
                 _as_optional_callable(data, "stderr"),
             ),
+            allowed_mcp_server_names=_as_optional_str_list(
+                data, "allowed_mcp_server_names"
+            ),
         )
 
 
diff --git a/packages/sdk-typescript/src/query/createQuery.ts b/packages/sdk-typescript/src/query/createQuery.ts
index 42d332b15f1..1e61d82c646 100644
--- a/packages/sdk-typescript/src/query/createQuery.ts
+++ b/packages/sdk-typescript/src/query/createQuery.ts
@@ -66,6 +66,7 @@ export function query({
     coreTools: options.coreTools,
     excludeTools: options.excludeTools,
     allowedTools: options.allowedTools,
+    allowedMcpServerNames: options.allowedMcpServerNames,
     authType: options.authType,
     includePartialMessages: options.includePartialMessages,
     resume: options.resume,
diff --git a/packages/sdk-typescript/src/transport/ProcessTransport.ts b/packages/sdk-typescript/src/transport/ProcessTransport.ts
index 1a63e96d550..c6f85e7ed2f 100644
--- a/packages/sdk-typescript/src/transport/ProcessTransport.ts
+++ b/packages/sdk-typescript/src/transport/ProcessTransport.ts
@@ -317,6 +317,16 @@ export class ProcessTransport implements Transport {
       args.push('--allowed-tools', this.options.allowedTools.join(','));
     }
 
+    if (
+      this.options.allowedMcpServerNames &&
+      this.options.allowedMcpServerNames.length > 0
+    ) {
+      args.push(
+        '--allowed-mcp-server-names',
+        this.options.allowedMcpServerNames.join(','),
+      );
+    }
+
     if (this.options.authType) {
       args.push('--auth-type', this.options.authType);
     }
diff --git a/packages/sdk-typescript/src/types/queryOptionsSchema.ts b/packages/sdk-typescript/src/types/queryOptionsSchema.ts
index 702ea1c632d..a3a9798a8ab 100644
--- a/packages/sdk-typescript/src/types/queryOptionsSchema.ts
+++ b/packages/sdk-typescript/src/types/queryOptionsSchema.ts
@@ -182,5 +182,6 @@ export const QueryOptionsSchema = z
     resume: z.string().optional(),
     sessionId: z.string().optional(),
     timeout: TimeoutConfigSchema.optional(),
+    allowedMcpServerNames: z.array(z.string()).optional(),
   })
   .strict();
diff --git a/packages/sdk-typescript/src/types/types.ts b/packages/sdk-typescript/src/types/types.ts
index 3a7e26ee0aa..eb21b7391f0 100644
--- a/packages/sdk-typescript/src/types/types.ts
+++ b/packages/sdk-typescript/src/types/types.ts
@@ -46,6 +46,11 @@ export type TransportOptions = {
    * When resume is provided, this should match the resume ID.
    */
   sessionId?: string;
+  /**
+   * Allowed MCP server names. When provided, only these MCP servers
+   * will be available. Equivalent to CLI's `--allowed-mcp-server-names`.
+   */
+  allowedMcpServerNames?: string[];
 };
 
 export interface QuerySystemPromptPreset {
@@ -503,4 +508,10 @@ export interface QueryOptions {
      */
     streamClose?: number;
   };
+
+  /**
+   * Allowed MCP server names. When provided, only these MCP servers
+   * will be available. Equivalent to CLI's `--allowed-mcp-server-names`.
+   */
+  allowedMcpServerNames?: string[];
 }