mcp-wsl-exec
mcp-wsl-exec
Linux용 Windows 하위 시스템(WSL) 환경에서 명령을 실행하기 위한 모델 컨텍스트 프로토콜(MCP) 서버입니다. 이 서버는 내장된 보안 기능과 검증 기능을 통해 안전한 명령 실행을 제공합니다.
특징
🔒 WSL 환경에서 안전한 명령 실행
⚡ 내장된 안전 기능:
위험한 명령 감지
명령 확인 시스템
경로 탐색 방지
명령 살균
📁 작업 디렉토리 지원
⏱️ 명령 시간 초과 기능
🔍 자세한 명령 출력 형식
❌ 오류 처리 및 검증
🛡️ 쉘 주입에 대한 보호
Related MCP server: Windows CLI MCP Server
구성
이 서버를 사용하려면 MCP 클라이언트를 통한 구성이 필요합니다. 다음은 다양한 환경에 대한 예시입니다.
클라인 구성
Cline MCP 설정에 다음을 추가하세요.
지엑스피1
클로드 데스크톱 구성
Claude Desktop 구성에 다음을 추가하세요.
{
"mcpServers": {
"mcp-wsl-exec": {
"command": "npx",
"args": ["-y", "mcp-wsl-exec"]
}
}
}API
서버는 두 가지 MCP 도구를 구현합니다.
실행 명령
안전 검사 및 검증을 통해 WSL에서 명령을 실행합니다.
매개변수:
command(문자열, 필수): 실행할 명령working_dir(문자열, 선택 사항): 명령 실행을 위한 작업 디렉토리timeout(숫자, 선택 사항): 밀리초 단위의 시간 초과
확인_명령
안전 검사를 통해 표시된 위험한 명령의 실행을 확인합니다.
매개변수:
confirmation_id(문자열, 필수): execute_command에서 수신된 확인 IDconfirm(부울, 필수): 명령 실행을 진행할지 여부
안전 기능
위험한 명령 감지
서버는 다음을 포함하여 실행하기 전에 명시적인 확인이 필요한 잠재적으로 위험한 명령 목록을 유지 관리합니다.
파일 시스템 작업(rm, rmdir, mv)
시스템 명령(종료, 재부팅)
패키지 관리(apt, yum, dnf)
파일 리디렉션(>, >>)
권한 변경(chmod, chown)
그리고 더 많은 것...
명령 살균
모든 명령은 다음을 방지하기 위해 정리되었습니다.
셸 메타문자 주입
경로 탐색 시도
홈 디렉토리 참조
위험한 명령 체이닝
개발
설정
저장소를 복제합니다
종속성 설치:
pnpm install프로젝트를 빌드하세요:
pnpm build개발 모드에서 실행:
pnpm dev출판
이 프로젝트에서는 버전 관리를 위해 변경 세트를 사용합니다. 게시하려면 다음을 수행하세요.
변경 세트를 만듭니다.
pnpm changeset패키지 버전:
pnpm changeset versionnpm에 게시:
pnpm release기여하다
기여를 환영합니다! 풀 리퀘스트를 제출해 주세요.
특허
MIT 라이센스 - 자세한 내용은 LICENSE 파일을 참조하세요.
감사의 말
모델 컨텍스트 프로토콜을 기반으로 구축됨
안전한 WSL 명령 실행을 위해 설계되었습니다.
Available Tools
7 toolsconfirm_commandConfirm dangerous command executionCDestructive
Confirm dangerous command execution
| Name | Required | Description | Default |
|---|---|---|---|
| confirmation_id | Yes | Confirmation ID | |
| confirm | Yes | Proceed with execution |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and readOnlyHint=false, so the agent knows this is a destructive write operation. The description adds the 'dangerous' qualifier which reinforces the destructive nature, but doesn't provide additional behavioral context like what happens after confirmation, whether confirmation is reversible, or what specific dangers are involved. The description aligns with but doesn't significantly expand beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise at just three words, with zero wasted language. It's front-loaded with the core concept and doesn't contain any unnecessary elaboration. For a simple confirmation tool, this brevity is appropriate.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive tool with no output schema, the description is inadequate. It doesn't explain what happens after confirmation, what gets executed, how to obtain the confirmation_id, or what the dangerous command actually is. Given the destructive nature and workflow context implied by the tool name, more guidance about the confirmation process and its consequences is needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both parameters (confirmation_id and confirm) with their types and basic descriptions. The description doesn't add any meaning about what a confirmation_id represents, how it's obtained, or the implications of setting confirm to true versus false. Baseline 3 is appropriate when the schema provides complete parameter documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tautological: description restates name/title.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided about when to use this tool versus alternatives. The description doesn't mention prerequisites, when this confirmation step is required, or how it relates to sibling tools like 'execute_command'. There's no indication of workflow context or sequencing with other tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
execute_commandExecute a command in WSL (use read-only tools when possible)CDestructive
Execute a command in WSL (use read-only tools when possible)
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | Command to execute | |
| working_dir | No | Working directory | |
| timeout | No | Timeout (ms) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate destructiveHint=true and readOnlyHint=false, which the description doesn't contradict. However, the description adds minimal behavioral context beyond annotations—it doesn't explain what makes commands destructive, potential side effects, or execution constraints like permissions or rate limits. The 'use read-only tools when possible' hint adds some caution but lacks specificity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very brief—a single sentence with a parenthetical note. It's front-loaded with the core purpose, but the parenthetical feels tacked on and doesn't integrate smoothly. While concise, it could be more structured to separate purpose from guidance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the destructive nature (per annotations) and lack of output schema, the description is insufficient. It doesn't explain what the tool returns, error conditions, or safety considerations, leaving gaps for a mutation tool with potential side effects. The context signals don't compensate for these omissions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema description coverage, the input schema fully documents all three parameters. The description adds no parameter-specific information beyond what's in the schema, so it meets the baseline of 3 without compensating or adding value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tautological: description restates name/title.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. While it mentions 'use read-only tools when possible,' this is vague advice that doesn't specify concrete alternatives or scenarios where this tool should be preferred or avoided compared to siblings like get_directory_info or list_processes.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_directory_infoGet directory contents and infoCRead-only
Get directory contents and info
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Directory path | |
| details | No | Show detailed info |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds no behavioral information beyond what the readOnlyHint annotation already provides. While the annotation correctly indicates this is a read-only operation, the description doesn't disclose any additional behavioral traits such as what happens with invalid paths, whether it follows symlinks, what format the output takes, or any rate limits. With annotations covering the safety profile, this meets the baseline but adds minimal value.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise at just four words with no wasted language. While this conciseness comes at the expense of completeness, every word directly relates to the tool's function. The structure is front-loaded with the core purpose, though there's no additional information to structure beyond this basic statement.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has readOnlyHint annotation but no output schema, the description should provide more context about what information is returned. The description doesn't explain what 'contents and info' includes, whether it returns file lists, metadata, permissions, or other directory attributes. For a tool with two parameters and no output schema, this leaves significant gaps in understanding what the tool actually produces.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema description coverage, the input schema already fully documents both parameters (path and details). The description adds no additional meaning about what 'directory contents and info' specifically entails, how the boolean 'details' parameter affects the output, or what constitutes a valid path format. The baseline score of 3 reflects adequate schema coverage without description enhancement.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tautological: description restates name/title.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. With siblings like 'get_disk_usage' and 'get_system_info' that might overlap in system information retrieval, there's no indication of when directory-specific information is needed, what prerequisites exist, or when other tools might be more appropriate. This leaves the agent without context for tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_disk_usageGet disk space informationCRead-only
Get disk space information
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Path to check |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare readOnlyHint=true, so the agent knows this is a safe read operation. The description doesn't contradict this (it uses 'get' which aligns with read-only). However, the description adds no behavioral context beyond what annotations provide—it doesn't mention what specific disk metrics are returned, whether it requires special permissions, if there are rate limits, or how it handles errors. With annotations covering safety, a baseline 3 is appropriate as the description adds minimal value.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise—a single phrase with zero wasted words. It's front-loaded with the core purpose, though this brevity comes at the cost of detail. Every word earns its place, making it efficient for quick scanning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (1 optional parameter, read-only annotation, no output schema), the description is incomplete. It doesn't explain what disk information is returned (e.g., free space, total space, usage percentage), how to interpret results, or default behavior if 'path' is omitted. With no output schema, the description should compensate by outlining return values, but it fails to do so.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 1 parameter with 100% description coverage ('Path to check'), so the schema fully documents the parameter. The description adds no meaning beyond what the schema provides—it doesn't explain what 'path' means in context (e.g., filesystem path, default behavior if omitted), nor does it provide examples or constraints. Baseline 3 is correct when schema coverage is high.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tautological: description restates name/title.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. There are no explicit when/when-not instructions, no mention of prerequisites, and no reference to sibling tools like 'get_directory_info' or 'get_system_info' that might offer overlapping functionality. The agent receives no usage context beyond the tool name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_environmentGet WSL environment variablesCRead-only
Get WSL environment variables
| Name | Required | Description | Default |
|---|---|---|---|
| filter | No | Filter pattern (grep) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare readOnlyHint=true, so the agent knows this is a safe read operation. The description doesn't add any behavioral context beyond what the annotations provide - no information about what specifically gets retrieved, how the filtering works, whether there are rate limits, or what the output format looks like. However, it doesn't contradict the annotations, so it earns a baseline score for not creating confusion while adding minimal value.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise at just three words. While it's arguably too brief for adequate tool documentation, it contains zero wasted words and is perfectly front-loaded with the core purpose. Every word earns its place, making this maximally efficient in terms of word economy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no output schema and only basic annotations, the description is incomplete. It doesn't explain what format the environment variables are returned in, whether it retrieves all variables or a subset, or how the filtering parameter interacts with the retrieval. While the schema covers the single parameter, the overall context for using this tool effectively is insufficient given the complexity of environment variable retrieval.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage with the 'filter' parameter clearly documented as 'Filter pattern (grep)'. The description itself provides no additional parameter information. With complete schema coverage, the baseline score of 3 is appropriate since the schema does all the parameter documentation work and the description doesn't need to compensate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tautological: description restates name/title.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides absolutely no guidance about when to use this tool versus alternatives. There's no mention of when this tool is appropriate, when other tools might be better suited, or any prerequisites for its use. Given that there are multiple 'get_' sibling tools that retrieve different types of system information, this lack of differentiation guidance is a significant gap.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_system_infoGet WSL system informationCRead-only
Get WSL system information
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations include readOnlyHint: true, indicating this is a safe read operation. The description doesn't contradict this, as 'Get' aligns with read-only behavior. However, it adds no behavioral context beyond what annotations provide—such as what specific information is returned, potential rate limits, or authentication needs. With annotations covering the safety profile, the description adds minimal value, meeting the baseline for this dimension.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise—a single phrase with no wasted words. It's front-loaded and to the point, which is efficient for a simple tool. However, it's arguably too concise, bordering on under-specification, as it sacrifices clarity for brevity. This earns a high score for conciseness but not a perfect 5 due to the trade-off with completeness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (0 parameters, read-only annotations) and lack of an output schema, the description is incomplete. It doesn't explain what 'system information' entails (e.g., WSL version, distribution details, or hardware info), leaving the agent uncertain about the return values. With no output schema, the description should provide more context on the expected data, but it fails to do so, making it inadequate for full understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has 0 parameters, and the schema description coverage is 100%, so there are no parameters to document. The description doesn't need to compensate for any gaps, as the schema fully handles the lack of inputs. This justifies a baseline score of 4, as the description isn't required to add parameter semantics in this case.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tautological: description restates name/title.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't specify what type of system information it retrieves (e.g., OS details, version, configuration) compared to siblings like get_disk_usage or list_processes, leaving the agent to guess based on the tool name alone. There are no explicit instructions on context or exclusions, resulting in poor usage guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_processesList running processes in WSLCRead-only
List running processes in WSL
| Name | Required | Description | Default |
|---|---|---|---|
| filter | No | Filter by name |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds minimal behavioral context beyond the annotations. The annotation 'readOnlyHint: true' already indicates this is a safe read operation. The description implies it lists processes but doesn't disclose details like output format, pagination, or performance characteristics. It doesn't contradict annotations, but offers little additional value.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise—a single sentence that directly states the tool's purpose without unnecessary words. It's front-loaded with the core functionality, making it efficient for quick comprehension. Every word earns its place, adhering to best practices for brevity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (one optional parameter) and the presence of annotations covering safety, the description is minimally adequate. However, without an output schema, it doesn't explain what the tool returns (e.g., process list format), leaving a gap in completeness. It relies heavily on structured data for context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema description coverage, the input schema fully documents the optional 'filter' parameter. The description doesn't add any parameter semantics beyond what the schema provides, such as examples of filter usage or format. This meets the baseline for high schema coverage but doesn't enhance understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tautological: description restates name/title.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention scenarios where this is preferred over sibling tools like 'get_system_info' or 'execute_command', nor does it specify prerequisites or exclusions. This lack of context could lead to incorrect tool selection by an AI agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
7 tool updates
v1.0.0- Changed
confirm_command3 fields changed- added
Input schema / $schemaAdded value: +"http://json-schema.org/draft-07/schema#" - changed
Input schema / properties / confirm / descriptionPrevious value: -"Whether to proceed with the command execution"New value: +"Proceed with execution" - changed
Input schema / properties / confirmation_id / descriptionPrevious value: -"Confirmation ID received from execute_command"New value: +"Confirmation ID"
- Changed
execute_command3 fields changed- added
Input schema / $schemaAdded value: +"http://json-schema.org/draft-07/schema#" - changed
Input schema / properties / timeout / descriptionPrevious value: -"Timeout in milliseconds"New value: +"Timeout (ms)" - changed
Input schema / properties / working_dir / descriptionPrevious value: -"Working directory for command execution"New value: +"Working directory"
- Added
get_directory_info - Added
get_disk_usage - Added
get_environment - Added
get_system_info - Added
list_processes
2 tool updates
- First observed
confirm_command - First observed
execute_command
TDQS
Scored across 7 tools
Each tool has a clearly distinct purpose: confirm_command handles safety checks, execute_command runs commands, get_directory_info lists files, get_disk_usage shows storage, get_environment retrieves variables, get_system_info provides system details, and list_processes shows running processes. There is no overlap or ambiguity between these functions.
All tools follow a consistent verb_noun pattern with snake_case (e.g., confirm_command, execute_command, get_directory_info). The naming is uniform throughout, using 'get_' for retrieval operations and clear action-object pairs.
With 7 tools, the server is well-scoped for WSL execution and system monitoring. Each tool serves a specific and necessary function, covering command execution, file management, system diagnostics, and process handling without being overly sparse or bloated.
The toolset provides strong coverage for WSL operations, including command execution, file system inspection, system monitoring, and environment management. A minor gap exists in file manipulation (e.g., create/delete files) or network-related tools, but core workflows are well-supported.
Maintenance
Related MCP Connectors
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
MCP server for Superserve sandboxes: create, exec, and manage Firecracker microVMs
MCP server for secureFlows: token-free URL builders and integration-linting tools for AI agents.
MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.
Related MCP Servers
- AlicenseBqualityDmaintenanceA secure MCP server for executing whitelisted shell commands with resource and timeout controls, designed for integration with Claude and other MCP-compatible LLMs.20389 npm7MIT
- AlicenseBqualityFmaintenanceA Model Context Protocol server that provides secure command-line access to Windows systems, allowing MCP clients like Claude Desktop to safely execute commands in PowerShell, CMD, and Git Bash shells with configurable security controls.9750 npm269MIT
- AlicenseAqualityFmaintenanceAn MCP server that enables secure execution of shell commands across Windows, macOS, and Linux with built-in whitelisting and approval mechanisms for enhanced security.973 npm21MIT
- AlicenseBqualityAmaintenanceA secure MCP server for shell operations, terminal management, and process control, enabling AI assistants to safely execute commands and manage interactive sessions.13161 npm6MIT