mcp-shell
MCP server that runs shell commands. Your LLM gets a tool; you get control over what runs and how.
Built on mark3labs/mcp-go. Written in Go.
Run it
Docker (easiest):
docker run -it --rm -v /tmp/mcp-workspace:/tmp/mcp-workspace sonirico/mcp-shell:latestFrom source:
git clone https://github.com/sonirico/mcp-shell && cd mcp-shell
make install
mcp-shellConfigure it
Secure mode is the default. With no config file, mcp-shell boots in secure
mode restricted to a narrow allowlist of read-only utilities (ls, cat,
grep, find, head, tail, ...). You only need a config file to widen or
change that policy. To run fully unrestricted you must opt in explicitly:
MCP_SHELL_ALLOW_UNSAFE=true mcp-shell # disables all validation - do not use in productionTo customize the policy, point to a YAML config:
export MCP_SHELL_SEC_CONFIG_FILE=/path/to/security.yaml
mcp-shellSecure mode (recommended) — no shell interpretation, executable allowlist only:
security:
enabled: true
use_shell_execution: false
allowed_executables:
- ls
- cat
- grep
- find
- echo
# WARNING: never add shell/language interpreters (bash, sh, python, perl,
# ruby, node) or alias-capable tools (git) here - the interpreter executes
# whatever it is handed, bypassing secure mode entirely. mcp-shell warns at
# startup if it finds one.
blocked_patterns: # optional: restrict args on allowed commands
- '(^|\s)remote\s+(-v|--verbose)(\s|$)'
max_execution_time: 30s
max_output_size: 1048576
working_directory: /tmp/mcp-workspace
audit_log: true
