モデルコンテキストプロトコル(MCP)を実装した信頼できる実行サーバーです。許可リストのコマンドをargv配列として実行し、stdin入力、包含されたリダイレクト、最小限の子環境、実行制限、構造化監査ログを備えています。

このパッケージはサンドボックスではありません。 コマンドを許可し、サーバープロセスの既存のOS権限をプログラムします。設定する前にTrusted Execution contractを読みましょう。

特徴

• Argvベースのコマンド実行:シェル文字列解釈なしにサブプロセスARGV経由で実行可能なコマンド
• 標準入力サポート:コマンドへの入力をstdin経由で渡す
• 包括的な出力:標準、終了状況、実行時間の返却
• 安全なパイプラインサポート:パイプラインはシェルを呼び出しる代わりにargvセグメントを保存・検証します
• 実行制限:サーバー側のデフォルトタイムアウト、最大タイムアウト、出力バイトキャップが強制されます
• Contained Redirection: および[>>ターゲットは要求された作業ディレクトリ内に留まらなければなりません
• 最小子環境:子プロセスはすべてのサーバー秘密を継承する代わりに、小さな許可リスト付き環境を受け取ります

MCP Shell Server

A trusted execution server implementing the Model Context Protocol (MCP). It runs allowlisted commands as argv arrays, with stdin input, contained redirection, a minimal child environment, execution limits, and structured audit logging.

This package is not a sandbox. Allowing a command delegates that program the server process’s existing OS authority. Read Trusted execution contract before configuring it.

Features

• Argv-based Command Execution: Allowed commands run via subprocess argv without shell-string interpretation
• Standard Input Support: Pass input to commands via stdin
• Comprehensive Output: Returns stdout, stderr, exit status, and execution time
• Safe Pipeline Support: Pipelines preserve and validate argv segments instead of invoking a shell
• Execution Limits: Server-side default timeout, maximum timeout, and output byte caps are enforced
• Contained Redirection: ``, and >> targets must stay inside the requested working directory
• Minimal Child Environment: Child processes receive a small allowlisted environment instead of inheriting all server secrets
• Structured Audit Logging: Success, rejection, timeout, output-cap, and process-error outcomes are logged with redaction

Trusted execution contract

Read this before the configuration examples below. The server emits the same warning once at startup through its logger (stderr); MCP stdout framing is unchanged.

What the server controls

mcp-shell-server enforces a boundary around its own behavior:

• which executable names it launches directly (ALLOW_COMMANDS, ALLOW_PATTERNS),
• argv-based process creation without shell-string interpretation,
• server-managed ``, and >> redirection contained under the requested working directory,
• the child environment it builds,
• timeout and output-byte limits,
• structured audit records.

What the server does not control

Allowing a command is authority delegation: the allowed program runs with the server process’s existing OS identity, filesystem access, network access, and credentials. ALLOW_COMMANDS and ALLOW_PATTERNS restrict only the command names the server launches directly. They do not guarantee containment of:

• child processes an allowed program spawns,
• program-specific interpreters, expression languages, or plugins,