sassy_shell
Execute shell commands in the host's native shell, with tunable timeouts and safeguards against destructive actions.
Instructions
Execute a shell command in the host's native shell.
shell: Windows -> powershell (default), cmd, wsl. macOS/Linux -> zsh/bash (default is the login shell), sh. Leave empty to use the host default. Automatically normalizes syntax (e.g. && to ; for PowerShell); POSIX shells run the command verbatim.
timeout_seconds > 120: auto-promoted to a background session and returns a JSON handle ({"auto_detached": true, "session_name": ...}). Poll with sassy_session_read; stop with sassy_session_stop. This is because synchronous waits past the MCP client's ~240s response wall wedge the connection. For known long-running work, prefer calling sassy_session_start directly with a memorable name.
allow_pattern: opt-in escape hatch for power users. When set to a specific pattern label (e.g. 'truncate-by-redirect') OR to '*', a regex-pattern match with that label is allowed to execute instead of being blocked. The bypass is recorded as a 'pattern_bypass' audit entry. Keyword matches (rm/del/remove-item) are NEVER affected by this flag — only regex patterns can be opted out, and only one pattern at a time.
Tiered destructive-action handling: when
interceptor.destructiveAction = "confirm" (config), MEDIUM- and
HIGH-tier pattern matches return a confirmation_required JSON
payload with a single-use token instead of hard-blocking. Call
sassy_shell_confirm(token) (HIGH tier also requires a typed
phrase) to actually run the command. LOW-tier matches always run
after a log entry. The default action remains "block".
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| shell | No | ||
| command | Yes | ||
| allow_pattern | No | ||
| timeout_seconds | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |