mcp-shell

Overview

mcp-shell is an MCP server that allows AI models to execute shell commands in a controlled environment. It offers multiple security modes including an allowlist approach that restricts execution to specific executables only, blocking shell interpretation to prevent injection attacks. The server provides audit logging, execution time limits, and output size controls for enhanced security. Built with Go using the mark3labs/mcp-go framework, it can be deployed via Docker or as a standalone binary.

Try asking AI

After installing, here are 6 things you can ask your AI assistant:

• run_shell_commandcommand: string, base64?: boolean

  Execute a shell command with optional base64 encoding of output

  Try:List files in the current directoryTry:Show the contents of config.jsonTry:Find all Python files in the project

Comparable tools

Installation

docker run -it --rm -v /tmp/mcp-workspace:/tmp/mcp-workspace sonirico/mcp-shell:latest

git clone https://github.com/sonirico/mcp-shell && cd mcp-shell
make install
mcp-shell

{
  "mcpServers": {
    "shell": {
      "command": "docker",
      "args": ["run", "--rm", "-i", "sonirico/mcp-shell:latest"],
      "env": { "MCP_SHELL_LOG_LEVEL": "info" }
    }
  }
}

{
  "command": "docker",
  "args": ["run", "--rm", "-i", "-v", "/path/to/security.yaml:/etc/mcp-shell/security.yaml", "-e", "MCP_SHELL_SEC_CONFIG_FILE=/etc/mcp-shell/security.yaml", "sonirico/mcp-shell:latest"]
}

FAQ

How secure is mcp-shell?

mcp-shell has multiple security modes. By default, it runs without restrictions. In secure mode, it uses an allowlist of executables and blocks shell interpretation to prevent injection attacks.

Can I restrict which commands can be executed?

Yes. In secure mode, you can specify allowed executables in the security config and optionally add blocked patterns to restrict arguments on allowed commands.

How does it handle command output?

The server returns command status, exit code, stdout, stderr, execution time, and optional security info. Output can be base64 encoded if needed.

Compare mcp-shell with