모델 컨텍스트 프로토콜(MCP)을 구현한 신뢰할 수 있는 실행 서버입니다. 허용 명령어를 argv 배열로 실행하며, stdin 입력, 포함된 리디렉션, 최소한의 자식 환경, 실행 제한, 구조화된 감사 로깅을 지원합니다.

**이 패키지는 샌드박스가 아닙니다. ** 명령어를 허용하면 서버 프로세스의 기존 OS 권한을 위임합니다. 설정 전에 신뢰받는 실행 계약서를 읽으세요.

특징

• Argv 기반 명령 실행: 셸 문자열 해석 없이 하위 프로세스 argv를 통해 명령이 실행될 수 있습니다
• 표준 입력 지원: stdin을 통해 명령에 입력을 전달합니다
• 종합 출력: 최시, 최고, 종료 상태, 실행 시간 반환
• 안전한 파이프라인 지원: 파이프라인은 쉘을 호출하는 대신 argv 세그먼트를 보존하고 검증합니다
• 실행 제한: 서버 측 기본 타임아웃, 최대 타임아웃, 출력 바이트 캡이 적용됩니다
• 포함된 리디렉션: 와 [>> 대상은 요청된 작업 디렉터리 내에 있어야 합니다
• 최소 자식 환경: 자식 프로세스는 모든 서버 비밀을 상속받는 대신 작은 허용 조건 환경을 받습니다

MCP Shell Server

A trusted execution server implementing the Model Context Protocol (MCP). It runs allowlisted commands as argv arrays, with stdin input, contained redirection, a minimal child environment, execution limits, and structured audit logging.

This package is not a sandbox. Allowing a command delegates that program the server process’s existing OS authority. Read Trusted execution contract before configuring it.

Features

• Argv-based Command Execution: Allowed commands run via subprocess argv without shell-string interpretation
• Standard Input Support: Pass input to commands via stdin
• Comprehensive Output: Returns stdout, stderr, exit status, and execution time
• Safe Pipeline Support: Pipelines preserve and validate argv segments instead of invoking a shell
• Execution Limits: Server-side default timeout, maximum timeout, and output byte caps are enforced
• Contained Redirection: ``, and >> targets must stay inside the requested working directory
• Minimal Child Environment: Child processes receive a small allowlisted environment instead of inheriting all server secrets
• Structured Audit Logging: Success, rejection, timeout, output-cap, and process-error outcomes are logged with redaction

Trusted execution contract

Read this before the configuration examples below. The server emits the same warning once at startup through its logger (stderr); MCP stdout framing is unchanged.

What the server controls

mcp-shell-server enforces a boundary around its own behavior:

• which executable names it launches directly (ALLOW_COMMANDS, ALLOW_PATTERNS),
• argv-based process creation without shell-string interpretation,
• server-managed ``, and >> redirection contained under the requested working directory,
• the child environment it builds,
• timeout and output-byte limits,
• structured audit records.

What the server does not control

Allowing a command is authority delegation: the allowed program runs with the server process’s existing OS identity, filesystem access, network access, and credentials. ALLOW_COMMANDS and ALLOW_PATTERNS restrict only the command names the server launches directly. They do not guarantee containment of:

• child processes an allowed program spawns,
• program-specific interpreters, expression languages, or plugins,