Shell Command MCP Server
셸 명령 MCP 서버
Docker 컨테이너 내에서 셸 명령을 실행할 수 있는 MCP(Model Context Protocol) 서버입니다. 호스트 Docker 데몬에 대한 접근 권한을 부여하지 않고도 명령을 실행할 수 있는 안전하고 격리된 작업 공간을 제공합니다.
특징
간단한 MCP 인터페이스를 통해 셸 스크립트 실행
동기 실행
4가지 다른 모드를 갖춘 비동기 실행
완료: 명령이 완료되면 알림
line: 출력의 각 줄에 알림
chunk: 출력의 각 청크에 대해 알림
문자: 출력의 각 문자에 대해 알림
포함된 Kubernetes 도구: kubectl, helm, kustomize, hemfile
루트가 아닌 사용자가 있는 격리된 Docker 컨테이너 환경
호스트-컨테이너 사용자 ID/그룹 ID 매핑이 구현되었습니다. 이를 통해 컨테이너는 호스트와 동일한 사용자로 실행될 수 있으며, 컨테이너에서 생성된 파일은 호스트에서 생성된 파일과 동일한 소유권과 권한을 갖습니다.
지속성을 위해 호스트 디렉토리를 컨테이너 /home/mcp 디렉토리에 마운트합니다. 이는 AI가 작업하는 홈 디렉토리가 됩니다.
호스트 디렉토리가 비어 있으면 초기 파일은 컨테이너의 백업에서 복사됩니다.
Related MCP server: K8s MCP Server
디자인 철학
이 MCP 서버는 AI에게 사람과 유사한 작업 공간을 제공합니다. 권한 부여는 MCP 기능이 아닌 컨테이너 격리 및 외부 권한 부여 제한에 의해 제한됩니다.
셸 스크립트 실행과 같은 보다 일반적인 도구를 제공하므로 도구 사용에 대한 전문적인 지식이 없어도 사용할 수 있습니다.
코드 감사를 용이하게 하기 위해 서버 구현은 가능한 한 단순하게 유지됩니다.
시작하기
필수 조건
도커
Claude for Desktop 사용
Claude for Desktop 구성 파일에 다음 구성을 추가합니다.
맥OS:
지엑스피1
/Users/user-name/ClaudeWorks 컨테이너에서 사용할 수 있도록 하려는 디렉토리로 바꾸세요.
윈도우:
"shell-command": {
"command": "docker",
"args": [
"run",
"--rm",
"-i",
"--mount",
"type=bind,src=\\\\wsl.localhost\\Ubuntu\\home\\user-name\\MCPHome,dst=/home/mcp",
"ghcr.io/kaznak/shell-command-mcp:latest"
]
}몇 가지 프롬프트를 제공하세요
마운트된 디렉토리의 파일을 작동합니다.
사용 가능한 MCP 도구
보안 고려 사항
MCP 서버는 컨테이너 내에서 루트가 아닌 사용자로 실행됩니다.
컨테이너가 호스트 Docker 데몬에 액세스할 수 없습니다.
사용자 작업 공간은 지속성을 위해 호스트에서 마운트됩니다.
특허
MIT
Available Tools
2 toolsexecute-bash-script-asyncA
This tool executes shell scripts asynchronously in bash. Executing each command creates a new bash process. Synchronous execution requires to wait the scripts completed. Asynchronous execution makes it possible to execute multiple scripts in parallel. You can reduce waiting time by planning in advance which shell scripts need to be executed and executing them in parallel. Avoid using execute-bash-script-sync tool unless you really need to, and use this execute-bash-script-async tool whenever possible.
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | The bash script to execute | |
| options | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It explains that 'Executing each command creates a new bash process' and describes the asynchronous nature, but lacks details about error handling, security implications, resource consumption, or what the tool returns. It mentions 'Synchronous execution requires to wait the scripts completed' which helps contrast behaviors, but more operational transparency would be beneficial for a tool executing arbitrary shell scripts.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately sized at 6 sentences. It's front-loaded with the core purpose, then explains the asynchronous nature and benefits, and ends with usage guidance. Some sentences could be more concise (e.g., 'Synchronous execution requires to wait the scripts completed' could be simplified), but overall it's well-structured with minimal redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of executing arbitrary shell scripts with no annotations and no output schema, the description is incomplete. It explains the asynchronous nature and provides usage guidance, but lacks critical information about security considerations, error handling, return values, or execution environment. For a tool that could have significant side effects, more comprehensive context is needed despite the good usage guidelines.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50% (only 'command' has a description in the schema, while 'options' and its nested properties lack schema descriptions). The tool description provides no parameter information beyond what's implied by the tool's purpose. The description doesn't mention any parameters, their meanings, or how they affect execution, so it doesn't compensate for the schema coverage gap. With 2 parameters and low schema coverage, this represents a significant documentation gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool 'executes shell scripts asynchronously in bash', providing a specific verb ('executes') and resource ('shell scripts'). It distinguishes from the sibling tool 'execute-bash-script-sync' by mentioning it in the last sentence, though the differentiation is more about usage preference than functional distinction. The purpose is clear but could be more specific about what 'asynchronously' means operationally.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on when to use this tool versus alternatives. It states 'Avoid using execute-bash-script-sync tool unless you really need to, and use this execute-bash-script-async tool whenever possible.' It also explains the benefit of asynchronous execution for parallel processing and reducing waiting time, giving clear context for when this approach is advantageous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
execute-bash-script-syncA
This tool executes shell scripts synchronously in bash. Executing each command creates a new bash process. Synchronous execution requires to wait the scripts completed. Asynchronous execution makes it possible to execute multiple scripts in parallel. You can reduce waiting time by planning in advance which shell scripts need to be executed and executing them in parallel. Avoid using this execute-bash-script-sync tool unless you really need to, and use the execute-bash-script-async tool whenever possible.
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | The bash script to execute | |
| options | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It discloses key behavioral traits: 'Executing each command creates a new bash process' and 'Synchronous execution requires to wait the scripts completed.' However, it lacks details about error handling, output format, security implications, or system resource usage. For a potentially dangerous tool like bash script execution with no annotations, this is a moderate disclosure level.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is 6 sentences with some redundancy ('synchronous execution' mentioned twice) and could be more front-loaded. The first sentence states the purpose clearly, but subsequent sentences mix behavioral details with usage guidelines in a somewhat disorganized way. It's not excessively verbose but could be more efficiently structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given this is a potentially dangerous tool (bash script execution) with no annotations and no output schema, the description provides moderate context. It covers the synchronous nature and sibling comparison well, but lacks critical details like what happens on script failure, what output is returned, security warnings, or performance implications. For a tool with this complexity and risk profile, the description should do more.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50% (2 parameters total, with 'command' well-described but 'options' object lacking overall description). The description adds no parameter semantics beyond what's in the schema - it doesn't explain what 'command' should contain or how 'options' affect execution. With moderate schema coverage, the description doesn't compensate enough, resulting in a baseline 3 score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool 'executes shell scripts synchronously in bash' with specific verb+resource. It distinguishes from the sibling tool by mentioning 'synchronous execution requires to wait the scripts completed' and contrasting with 'asynchronous execution makes it possible to execute multiple scripts in parallel.' However, it doesn't explicitly name the sibling tool in the purpose statement, keeping it at 4 rather than 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on when to use this tool vs alternatives: 'Avoid using this execute-bash-script-sync tool unless you really need to, and use the execute-bash-script-async tool whenever possible.' It also explains the trade-off: synchronous execution requires waiting, while asynchronous allows parallel execution to reduce waiting time. This is comprehensive guidance with clear alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
2 tool updates
- First observed
execute-bash-script-async - First observed
execute-bash-script-sync
TDQS
The two tools are perfectly distinct: one for asynchronous execution and one for synchronous execution. Their names and descriptions clearly differentiate their purposes, with no overlap or ambiguity in functionality.
Both tools follow a consistent verb_noun pattern with kebab-case (execute-bash-script-async and execute-bash-script-sync). The naming is predictable and uniform across the set.
With only 2 tools, the server feels thin for a shell command domain. While it covers basic execution modes, it lacks tools for other common operations like file manipulation, process monitoring, or environment inspection, making the scope incomplete.
The toolset is severely incomplete for a shell command server. It only provides script execution in two modes, missing essential operations like listing files, checking system status, managing processes, or handling input/output redirection, which are core to shell interactions.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Paid remote MCP for LLM security scans, jailbreak checks, analytics, checkout, and readiness.
Claude Code / MCP skills for the dev pipeline: discover, spec, design, build, ship, operate.
Deploy full-stack apps (Postgres, Redis, S3, workers, backups) from Claude or curl. 59 MCP tools.
Use AI models for chat, image, and video generation from Claude Code and other MCP hosts.
Related MCP Servers
- AlicenseNot gradedqualityFmaintenanceFacilitates isolated code execution within Docker containers, enabling secure multi-language script execution and integration with language models like Claude via the Model Context Protocol.5MIT
- AlicenseNot gradedqualityDmaintenanceEnables Claude to run Kubernetes CLI tools (kubectl, istioctl, helm, argocd) in a secure, containerized environment via the Model Context Protocol.213MIT
- AlicenseNot gradedqualityDmaintenanceA Docker-based MCP server that enables Claude to run Kubernetes CLI tools (kubectl, istioctl, helm, argocd) in a secure containerized environment for managing and troubleshooting clusters.MIT
- AlicenseNot gradedqualityCmaintenanceEnables executing shell commands on the host system via an MCP tool, with JWT/OAuth authentication and audit logging for secure remote access.MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/kaznak/shell-command-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server