Skip to main content
Glama
Sign In
deenesjakoruzh
eaangrino

mcp-shell-sudo

by eaangrino
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

mcp-shell-sudo

Servidor MCP para Linux escrito en Python que ejecuta comandos locales usando argv, soporta sudo no interactivo mediante PASSWORD_SUDO, proporciona una lista de comandos permitidos opcional mediante ALLOW_COMMANDS, y puede confinar las escrituras del sistema de archivos a WORK_DIR usando Bubblewrap.

Requisitos

  • Linux.

  • Python 3.11+.

  • uv recomendado.

  • MCP Python SDK 2.0.0.

  • sudo si se ejecutarán comandos elevados.

  • bubblewrap si WORK_DIR está configurado.

En Debian/Ubuntu:

sudo apt update
sudo apt install -y bubblewrap

Related MCP server: mcp-shell

Variables de Entorno

PASSWORD_SUDO

Contraseña del usuario que ejecuta el servidor MCP.

  • Vacía o sin configurar: el servidor nunca inventa ni solicita interactivamente una contraseña. Los comandos con prefijo sudo se ejecutan usando sudo -n y solo funcionarán si ya existe una credencial en caché válida o si está configurada una regla NOPASSWD.

  • Configurada: sudo se ejecuta con -S, y la contraseña se proporciona a través de stdin, nunca a través de argv o registros.

Ejemplo:

"PASSWORD_SUDO": "my-password"

La forma admitida es:

["sudo", "id"]

Las banderas personalizadas de sudo como sudo -u postgres ... no se aceptan. Esto evita que la capa de políticas tenga que interpretar la gramática completa del comando sudo.

WORK_DIR

Directorio de trabajo opcional.

  • Vacío o sin configurar: el servidor MCP puede trabajar desde cualquier directorio existente especificado en la llamada a la herramienta.

  • Configurado: el servidor entra en modo estricto. directory debe resolverse dentro de WORK_DIR, y cada proceso se ejecuta dentro de un espacio de nombres de montaje de Bubblewrap donde / es de solo lectura, WORK_DIR está montado de lectura-escritura, y /tmp y /run son temporales.

Usar cwd solo no sería suficiente para garantizar este aislamiento. Un proceso aún podría escribir en /etc, /home/..., o seguir enlaces simbólicos fuera del proyecto. Por esta razón, el servidor falla al inicio si WORK_DIR está configurado pero bwrap no está disponible.

En este modo, sudo se rechaza porque la elevación de privilegios a nivel de host sería incompatible con la garantía de que las escrituras del sistema de archivos permanezcan confinadas al espacio de trabajo.

ALLOW_COMMANDS

Lista de nombres de ejecutables separados por comas.

"ALLOW_COMMANDS": "git,ls,cat,grep,python,node,pnpm"

  • Vacío o sin configurar: todos los ejecutables están permitidos.

  • Configurado: solo se permiten nombres de ejecutables exactos de la lista, y deben invocarse por nombre en lugar de mediante rutas como /usr/bin/git.

  • Si el comando comienza con sudo, se valida el ejecutable real que sigue a sudo.

La lista de permitidos se aplica a ejecutables, no a argumentos. Permitir bash, python, node, env u otra herramienta capaz de ejecutar procesos expande significativamente lo que el cliente MCP puede hacer.

Instalación

uv sync

Para desarrollo:

uv sync --extra dev

Ejecución Manual

uv run mcp-shell-sudo

El transporte es stdio. Los registros nunca se escriben en stdout para evitar corromper los mensajes JSON-RPC; los registros se escriben en stderr.

Configuración de MCP

Ejemplo con comandos sin restricciones y sudo habilitado:

{
  "mcpServers": {
    "shell": {
      "command": "uv",
      "args": [
        "--directory",
        "/ABSOLUTE/PATH/mcp-shell-sudo",
        "run",
        "mcp-shell-sudo"
      ],
      "env": {
        "PASSWORD_SUDO": "YOUR_PASSWORD",
        "WORK_DIR": "",
        "ALLOW_COMMANDS": ""
      }
    }
  }
}

Ejemplo confinado a un proyecto específico:

{
  "mcpServers": {
    "shell-project": {
      "command": "uv",
      "args": [
        "--directory",
        "/ABSOLUTE/PATH/mcp-shell-sudo",
        "run",
        "mcp-shell-sudo"
      ],
      "env": {
        "PASSWORD_SUDO": "",
        "WORK_DIR": "/home/user/projects/app",
        "ALLOW_COMMANDS": "git,ls,cat,grep,find,python,node,pnpm"
      }
    }
  }
}

Herramienta shell_execute

Entrada básica:

{
  "command": ["ls", "-la"]
}

Con un directorio de trabajo:

{
  "command": ["git", "status"],
  "directory": "backend"
}

Con stdin:

{
  "command": ["cat"],
  "stdin": "hello\n"
}

Con sudo:

{
  "command": ["sudo", "id"]
}

Respuesta:

{
  "stdout": "uid=0(root) gid=0(root) groups=0(root)\n",
  "stderr": "",
  "status": 0,
  "execution_time": 0.031,
  "timed_out": false,
  "output_limited": false
}

Herramienta shell_config

Devuelve la configuración efectiva no secreta.

Nunca devuelve PASSWORD_SUDO; solo indica si se ha configurado una contraseña de sudo.

Medidas de Seguridad Implementadas

  • Usa create_subprocess_exec; no usa shell=True.

  • command se pasa como un array argv explícito.

  • La contraseña de sudo nunca aparece en argv, respuestas, registros ni en el entorno del proceso hijo.

  • Si PASSWORD_SUDO no está configurado, sudo -n evita que el proceso se cuelgue esperando un prompt interactivo de contraseña.

  • ALLOW_COMMANDS valida el ejecutable real que sigue a una invocación simple de sudo.

  • Usa un PATH fijo y reducido para evitar resolver ejecutables desde . o rutas heredadas arbitrarias.

  • Usa un entorno hijo reducido en lugar de heredar todo el entorno del servidor MCP.

  • Tiempo de espera por llamada: 60 segundos por defecto, con un máximo de 600 segundos.

  • Límite de salida: 2 MiB por flujo. Si se supera el límite, se termina todo el grupo de procesos.

  • Los procesos se ejecutan en una nueva sesión y todo el grupo de procesos se termina al agotarse el tiempo de espera.

  • WORK_DIR usa Bubblewrap y falla de forma segura si no se puede proporcionar aislamiento.

Limitaciones Importantes

  1. ALLOW_COMMANDS="" significa ejecución arbitraria de comandos con los permisos del usuario que ejecuta el servidor MCP. Si PASSWORD_SUDO también está configurado, el cliente MCP puede solicitar acciones como root. Use esta configuración solo con un cliente y modelo que usted controle.

  2. Una lista de permitidos de ejecutables no valida semánticamente los argumentos de los comandos. python, node, bash, sh, perl y herramientas similares son efectivamente equivalentes a permitir la ejecución de código arbitrario.

  3. WORK_DIR confina las ubicaciones del sistema de archivos que son escribibles, pero no está diseñado para comportarse como una VM o un sandbox de red. Un comando con acceso a red aún puede modificar recursos remotos para los que tenga credenciales válidas.

  4. PASSWORD_SUDO almacenado en la configuración del cliente MCP sigue siendo un secreto almacenado en ese archivo. Restrinja los permisos del archivo con chmod 600 y nunca lo envíe al control de versiones.

Pruebas

uv run --extra dev pytest
uv run --extra dev ruff check .

Available Tools

2 tools
shell_configA

Return the effective non-secret shell policy configuration.

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description serves as the only behavioral disclosure. It implies a read-only operation ('Return') but does not explicitly state that it has no side effects or that it is safe. It does clarify that secrets are excluded, which is a useful constraint. However, it does not mention any authentication or permission requirements, which could be relevant.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that front-loads the action ('Return') and specifies the resource. There is no wasted verbiage.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that there are no parameters, the description sufficiently conveys the tool's function. The existence of an output schema covers return details, so the description need not elaborate. It does not mention usage context, but that is already addressed in usage_guidelines; for a simple config retrieval, this is complete enough.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are zero parameters, so the description is not required to explain parameter syntax. The phrase 'non-secret' adds context about the output scope but does not relate to parameters. For a parameterless tool, this is adequate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Return') and a clear resource ('effective non-secret shell policy configuration'). It distinguishes itself from the sibling tool by nature (configuration retrieval vs. execution), though it does not explicitly name the alternative. The purpose is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given for when to use this tool versus the sibling shell_execute. An agent must infer that this is for reading configuration, not executing commands. The description does not mention any prerequisites, alternatives, or context for selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

shell_executeA

Execute one command as an argv array.

Args: command: Executable and arguments, for example ["ls", "-la"] or ["sudo", "systemctl", "status", "ssh"]. Shell syntax is not interpreted. stdin: Optional text sent to the command's standard input. directory: Optional working directory. With WORK_DIR configured, this path must resolve inside WORK_DIR. Without WORK_DIR, any existing directory may be used. timeout: Execution timeout in seconds. Values above 600 seconds are capped at 600.

Returns: stdout, stderr, exit status, execution time, timeout flag, and output-limit flag.

NameRequiredDescriptionDefault
stdinNo
commandYes
timeoutNo
directoryNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of disclosing behavioral traits. It mentions that shell syntax is not interpreted, that the timeout is capped at 600 seconds, and that directory paths must resolve inside WORK_DIR if configured. However, it does not warn about the potentially destructive nature of executing arbitrary commands or the side effects of the executed process, which is a notable omission for a command execution tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is structured with a clear one-line summary, a detailed 'Args' section, and a 'Returns' section. It is appropriately detailed for a tool with multiple parameters but remains readable. The example for the command parameter adds clarity without bloat.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the essential invocation details: command format, directory constraints, timeout cap, and the return fields (stdout, stderr, exit status, etc.). It does not explain prerequisites such as the meaning of WORK_DIR, but this is likely a global configuration rather than tool-specific. Given the presence of an output schema (though not shown), the return-field listing is sufficient. Overall, it provides enough for an agent to call the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides no descriptions for any of the four parameters (schema coverage 0%), so the description must fully compensate. It does so thoroughly by explaining each parameter: the command array with examples, optional stdin, directory restrictions relative to WORK_DIR, and timeout cap. This adds substantial meaning beyond the schema's type definitions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Execute one command as an argv array.' It clearly distinguishes from the sibling tool 'shell_config' by implying execution vs. configuration, and provides a concrete example to clarify the argv format.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides clear guidance on how to invoke the tool, including the requirement to pass an argv array rather than shell syntax, and clarifies timeout and directory constraints. However, it does not explicitly state when to prefer this tool over shell_config, though the purpose difference is evident from the name and description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 2 tool updatesv0.1.0
    • First observedshell_config
    • First observedshell_execute
Deploy Server
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A3.9/5.0

Scored across 2 tools

Disambiguation5/5

The two tools have completely distinct purposes: one executes commands and the other returns configuration. There is no overlap or potential for misselection between them.

Naming Consistency5/5

Both tools follow the same snake_case verb_noun pattern (shell_execute, shell_config). The naming is clear, predictable, and consistent.

Tool Count3/5

With only two tools, this server feels thin, but the narrow scope (shell execution and configuration) justifies the limited surface. It is at the lower edge of what is reasonable, as stated in the calibration.

Completeness4/5

The tool surface covers the core functionality of executing shell commands and retrieving configuration. There is no obvious missing operation for the stated purpose; the only minor gap might be a way to list allowed commands or test, but that is not essential.

Maintenance

ActivityStale
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • mcp-shell

    imajeure
    A
    license
    Not graded
    quality
    D
    maintenance
    Provides a secure, token-authenticated command execution tool over MCP Streamable HTTP, with a default-deny allowlist and shell metacharacter rejection.
    11 npm
    1
    Apache 2.0