shell-mcp
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@shell-mcplist files in the projects directory"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
shell-mcp
A super-secure MCP (Model Context Protocol) server for running shell commands safely with a local LLM client.
Security Model
Commands pass through 8 independent security layers — every one must pass:
Layer | What it does |
1 | Zod schema validation — strict type checks before any processing |
2 | No-shell spawn — |
3 | Hardcoded blocklist — |
4 | Argument inspection — rejects metacharacters, null bytes, suspicious patterns, per-command dangerous flags |
5 | Directory allowlist — every path must be inside |
6 | Symlink resolution — symlinks resolved before path check (no escape via symlink) |
7 | Resource limits — timeout, output size cap, concurrency limit |
8 | Sanitized environment — strips |
Related MCP server: MCP Shell Server
Quick Start
# Clone and build
git clone https://github.com/your-username/shell-mcp.git
cd shell-mcp
npm install
npm run build
# Run (must specify at least one --allow-dir)
node dist/index.js --allow-dir ~/projects --allow-dir ~/dataLLM Client Configuration
{
"shell-mcp": {
"command": "node",
"args": [
"/path/to/shell-mcp/dist/index.js",
"--allow-dir", "/home/user/projects",
"--allow-dir", "/home/user/data",
"--allow-cmd", "ls",
"--allow-cmd", "cat",
"--allow-cmd", "grep",
"--allow-cmd", "find",
"--allow-cmd", "python3",
"--timeout", "30",
"--log-file", "/home/user/.shell-mcp/audit.log"
]
}
}Flags
Flag | Description | Default |
| Permitted directory (required, repeatable) | none — server won't start |
| Whitelist specific commands (repeatable) | all non-blocked |
| Extra commands to block | — |
| Max execution time (1–300) | 30 |
| Max output size | 1048576 (1MB) |
| Max parallel commands (1–10) | 3 |
| Audit log file path | stderr only |
| Enable | off |
| Permit overwriting files | off |
| Disables all writes (overrides | off |
| Unblock curl, wget, nc | off |
| Forward full env to child processes | off (sanitized) |
Tools Exposed to the LLM
run_command
Run a command with explicit arguments array. No shell — pipes and redirects won't work.
{
"command": "grep",
"args": ["-r", "TODO", "/home/user/projects/myapp"],
"cwd": "/home/user/projects/myapp",
"timeout": 10
}read_file
Read a file's contents. Supports line ranges and binary (base64) output.
{
"path": "/home/user/projects/myapp/src/main.py",
"startLine": 1,
"endLine": 50
}list_directory
List a directory with tree view, sizes, and permissions.
{
"path": "/home/user/projects/myapp",
"recursive": true
}write_file (requires --enable-write)
Write a file. Won't overwrite without --allow-overwrite.
{
"path": "/home/user/projects/myapp/notes.txt",
"content": "Hello world"
}get_server_info
Returns current server config and restrictions. Useful for the LLM to understand its sandbox before acting.
Permanently Blocked Commands
These cannot be enabled by any flag:
rm, rmdir, shred, dd, mkfs, fdisk, diskutil, sudo, su, doas,
osascript, defaults, open, launchctl, crontab,
curl, wget, nc, ssh, scp, rsync,
brew, npm, yarn, pip, gem, cargo, docker,
gcc, clang, kill, killall, shutdown, reboot,
gpg, security (macOS keychain), ...and moreAudit Log
Every command attempt (allowed or denied) is logged in JSON:
{"timestamp":"2024-01-01T12:00:00.000Z","sessionId":"A3F9B2C1","event":"COMMAND_DENY","command":"rm","args":["-rf","/"],"denyLayer":3,"denyReason":"Command \"rm\" is on the hardcoded blocklist"}
{"timestamp":"2024-01-01T12:00:01.000Z","sessionId":"A3F9B2C1","event":"COMMAND_ALLOW","command":"ls","args":["-la"],"cwd":"/home/user/projects","exitCode":0,"durationMs":12,"outputBytes":1024}Inspect with MCP Inspector
npx @modelcontextprotocol/inspector node dist/index.js --allow-dir /tmp/testThis server cannot be installed
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Servers
- AlicenseAqualityDmaintenanceAn MCP server that enables secure execution of shell commands across Windows, macOS, and Linux with built-in whitelisting and approval mechanisms for enhanced security.96319MIT
- AlicenseBqualityDmaintenanceEnables secure execution of whitelisted shell commands through MCP, with support for stdin input, timeout control, and comprehensive output including stdout, stderr, and execution time.1MIT

terminal-toolkit-mcpofficial
Alicense-qualityCmaintenanceEnables LLM clients to execute shell commands safely through the MCP protocol, with features like session management, safe mode, and process control.1Apache 2.0- Alicense-qualityDmaintenanceEnables safe shell command execution with configurable directory and command restrictions, allowing Claude Desktop to run shell commands securely.MIT
Related MCP Connectors
Remote MCP for Android CLI agent build gate, structured receipts, audit logs, and reviewer-ready evi
Remote MCP for Copilot CLI switch gate MCP, structured receipts, audit logs, and reviewer-ready evid
Static MCP manifest and tool-policy security preflight with signed input-redacted receipts
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/kg912/shell-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server