A
licenseNot graded
qualityD
maintenanceA Model Context Protocol server that allows LLMs to execute shell commands and receive their output in a controlled manner.
7
MIT
PermShell MCP
by mcollina
Provides secure execution of shell commands with permission notifications, allowing system operations with explicit user approval and safeguards against unauthorized usage.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@PermShell MCPlist all files in my Downloads folder"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
PermShell MCP
A Model Context Protocol (MCP) server for executing shell commands with permission notifications.
Features
Execute shell commands with explicit permissions through growl notifications
Built on the Model Context Protocol for standardized LLM tools
Multiple safeguards to prevent unauthorized command execution
Transparent permission dialog shows exactly what commands will be executed
Related MCP server: Command Executor MCP Server
Installation
# Clone the repository
git clone https://github.com/yourusername/perm-shell-mcp.git
cd perm-shell-mcp
# Install dependencies
npm install
# Build the project
npm run buildUsage
As a standalone tool
# Start the server directly
npm startWith Claude Desktop
Add the following configuration to your Claude Desktop configuration file:
{
"mcpServers": {
"permshell": {
"command": "node",
"args": ["/path/to/perm-shell-mcp/dist/index.js"]
}
}
}Available Tools
execute-command
Executes a shell command with permission.
Example:
Can you list the files in my home directory?system-info
Retrieves system information including OS, uptime, memory, disk, and CPU.
Example:
What's my system information?Security
All commands require explicit permission through desktop notifications
Commands display with their working directory for full transparency
Timeout limits prevent runaway processes
Input sanitization prevents command injection
Development
# Run in watch mode for development
npm run devAvailable Tools
2 toolsexecute-commandC
Execute a shell command
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | The shell command to execute | |
| cwd | No | Directory to run the command in (defaults to system temp directory) | |
| stdin | No | Optional input to provide to the command's standard input | |
| timeout | No | Timeout in milliseconds after which the process is killed |
TDQS
C2.9/5.0
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden for behavioral disclosure. 'Execute a shell command' implies a potentially dangerous operation with side effects, but it doesn't mention security risks, permission requirements, or what happens on failure. It lacks critical context about execution environment, error handling, or output behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise at just three words, with zero wasted language. It's front-loaded with the core purpose. Every word earns its place, making it highly efficient despite being minimal.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given this is a potentially dangerous execution tool with no annotations and no output schema, the description is inadequate. It doesn't explain what gets executed, security implications, return values, or error conditions. For a tool that could have significant side effects, this level of documentation is insufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters thoroughly. The description adds no additional parameter semantics beyond what's in the schema. The baseline of 3 is appropriate since the schema does the heavy lifting, but the description doesn't enhance understanding of the parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Execute a shell command' clearly states the verb ('execute') and resource ('shell command'), making the purpose immediately understandable. However, it doesn't differentiate from the sibling tool 'system-info', which appears to be a read-only system information tool, so it misses full sibling differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. There's no mention of prerequisites, security considerations, or when to choose this over other execution methods. The sibling tool 'system-info' seems unrelated, so no explicit comparison is made.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
system-infoC
Get system information
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
C2.9/5.0
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the tool 'gets' information, implying a read-only operation, but doesn't specify what information is returned, format, potential side effects, or performance considerations. This is inadequate for a tool with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise ('Get system information')—a single, front-loaded sentence with no wasted words. It efficiently communicates the core purpose without redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of annotations and output schema, the description is incomplete. It doesn't explain what 'system information' includes (e.g., OS, hardware, network details) or the return format, leaving significant gaps for the agent to understand the tool's behavior and output.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has 0 parameters with 100% schema description coverage, so no parameter documentation is needed. The description doesn't mention parameters, which is appropriate, earning a baseline score of 4 for not adding unnecessary information beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose3/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Get system information' clearly states the verb ('Get') and resource ('system information'), providing a basic purpose. However, it's somewhat vague about what specific information is retrieved and doesn't distinguish from the sibling tool 'execute-command', which might also provide system-related data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus the sibling 'execute-command' or other alternatives. The description lacks context about appropriate scenarios, prerequisites, or exclusions, leaving the agent to infer usage based on the tool name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
B3.1/5.0
Disambiguation5/5
The two tools have clearly distinct purposes: execute-command runs arbitrary shell commands, while system-info retrieves system information. There is no overlap or ambiguity between them, making it easy for an agent to select the correct tool based on the task.
Naming Consistency4/5
Both tools use a consistent hyphenated naming style (execute-command and system-info), which is readable and predictable. However, the pattern is not a standard verb_noun convention, and with only two tools, it's hard to assess full consistency, but there are no deviations in the limited set.
Tool Count3/5
With only 2 tools, the server feels thin for a shell-related purpose, as it might lack operations like file management, process control, or environment handling. While the tools cover basic execution and info, the count is borderline low for a typical shell utility scope.
Completeness2/5
For a shell server, there are significant gaps: no tools for file operations (e.g., list, read, write), process management, network commands, or environment variables. The surface is severely incomplete, as agents cannot perform common shell tasks beyond command execution and system info retrieval.
Maintenance
ActivityInactive
ResponsivenessNo issues
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
A comprehensive Model Context Protocol (MCP) server that enables AI assistants to interact with yo…
A Model Context Protocol server for Wix AI tools
Enable secure connectivity between Sentry issues and debugging data, and LLM clients, using a Model Context Protocol (MCP) server.
Remote MCP server for supportsheep: run AI interviews and manage support content for your blog.
Related MCP Servers
- AlicenseBqualityDmaintenanceA Model Context Protocol server that allows secure execution of pre-approved commands, enabling AI assistants to safely interact with the user's system.1822ISC
- FlicenseAqualityDmaintenanceA local Model Context Protocol server that allows LLMs to securely execute shell commands on remote Linux and Windows systems via SSH connections.6172
- FlicenseBqualityDmaintenanceA Model Context Protocol server that enables LLM applications to safely execute shell commands with error handling and timeout settings.1
Appeared in Searches
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/mcollina/perm-shell-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server