Claude Code MCP

Instructions

Implementation Reference

• src/server/tools.ts:19-51 (handler)

  The handler function for the bash tool. It checks for banned commands, calls executeCommand helper, formats response, and handles errors.

  async ({ command, timeout }) => {
    try {
      // Check for banned commands
      const bannedCommands = [
        'alias', 'curl', 'curlie', 'wget', 'axel', 'aria2c', 'nc', 'telnet',
        'lynx', 'w3m', 'links', 'httpie', 'xh', 'http-prompt', 'chrome', 'firefox', 'safari'
      ];
      
      const commandParts = command.split(' ');
      if (bannedCommands.includes(commandParts[0])) {
        return {
          content: [{ 
            type: "text", 
            text: `Error: The command '${commandParts[0]}' is not allowed for security reasons.`
          }],
          isError: true
        };
      }
      
      const result = await executeCommand(command, timeout);
      return {
        content: [{ type: "text", text: result }]
      };
    } catch (error) {
      return {
        content: [{ 
          type: "text", 
          text: error instanceof Error ? error.message : String(error)
        }],
        isError: true
      };
    }
  }

• src/server/tools.ts:15-18 (schema)

  Input schema for the bash tool using Zod: command (string) and optional timeout (number).

  {
    command: z.string().describe("The shell command to execute"),
    timeout: z.number().optional().describe("Optional timeout in milliseconds (max 600000)")
  },

• src/server/tools.ts:12-52 (registration)

  Registration of the bash tool on the MCP server using server.tool().

  server.tool(
    "bash",
    "Execute a shell command",
    {
      command: z.string().describe("The shell command to execute"),
      timeout: z.number().optional().describe("Optional timeout in milliseconds (max 600000)")
    },
    async ({ command, timeout }) => {
      try {
        // Check for banned commands
        const bannedCommands = [
          'alias', 'curl', 'curlie', 'wget', 'axel', 'aria2c', 'nc', 'telnet',
          'lynx', 'w3m', 'links', 'httpie', 'xh', 'http-prompt', 'chrome', 'firefox', 'safari'
        ];
        
        const commandParts = command.split(' ');
        if (bannedCommands.includes(commandParts[0])) {
          return {
            content: [{ 
              type: "text", 
              text: `Error: The command '${commandParts[0]}' is not allowed for security reasons.`
            }],
            isError: true
          };
        }
        
        const result = await executeCommand(command, timeout);
        return {
          content: [{ type: "text", text: result }]
        };
      } catch (error) {
        return {
          content: [{ 
            type: "text", 
            text: error instanceof Error ? error.message : String(error)
          }],
          isError: true
        };
      }
    }
  );

• src/utils/bash.ts:12-24 (helper)

  Helper function that executes the shell command using Node's child_process.exec.

  export async function executeCommand(command: string, timeout?: number): Promise<string> {
    try {
      const options = timeout ? { timeout } : {};
      const { stdout, stderr } = await execPromise(command, options);
      if (stderr) {
        console.error(`Command stderr: ${stderr}`);
      }
      return stdout;
    } catch (error) {
      console.error(`Error executing command: ${command}`, error);
      throw error;
    }
  }