AI Development Pipeline MCP

Instructions

Implementation Reference

• local-mcp-server.ts:76-103 (handler)

  Handler function that validates the command using validateCommand, executes the shell command with child_process.exec limited to workspace cwd, 30s timeout, 1MB buffer, sanitizes output by removing control characters, and returns the stdout or error as content.

  async ({ command }) => {
    return new Promise((resolve) => {
      try {
        validateCommand(command);
        exec(command, {
          cwd: WORKSPACE_ROOT,
          timeout: 30000, // 30 second timeout
          maxBuffer: 1024 * 1024 // 1MB max output
        }, (error, stdout, stderr) => {
          if (error) {
            resolve({
              content: [{ type: 'text', text: `Error: ${stderr || error.message}` }]
            });
          } else {
            // Sanitize output to prevent log injection
            const sanitizedOutput = stdout.replace(/[\x00-\x1f\x7f-\x9f]/g, '');
            resolve({
              content: [{ type: 'text', text: sanitizedOutput }]
            });
          }
        });
      } catch (err: any) {
        resolve({
          content: [{ type: 'text', text: `Security error: ${err.message}` }]
        });
      }
    });
  }

• local-mcp-server.ts:75-75 (schema)

  Input schema defining the 'command' parameter as a Zod string.

  { command: z.string() },

• local-mcp-server.ts:72-104 (registration)

  MCP server tool registration for 'run_shell_command' with description, schema, and handler.

  server.tool(
    'run_shell_command',
    'Run a whitelisted shell command in the workspace (npm, yarn, git, node, npx, tsc, eslint, prettier)',
    { command: z.string() },
    async ({ command }) => {
      return new Promise((resolve) => {
        try {
          validateCommand(command);
          exec(command, {
            cwd: WORKSPACE_ROOT,
            timeout: 30000, // 30 second timeout
            maxBuffer: 1024 * 1024 // 1MB max output
          }, (error, stdout, stderr) => {
            if (error) {
              resolve({
                content: [{ type: 'text', text: `Error: ${stderr || error.message}` }]
              });
            } else {
              // Sanitize output to prevent log injection
              const sanitizedOutput = stdout.replace(/[\x00-\x1f\x7f-\x9f]/g, '');
              resolve({
                content: [{ type: 'text', text: sanitizedOutput }]
              });
            }
          });
        } catch (err: any) {
          resolve({
            content: [{ type: 'text', text: `Security error: ${err.message}` }]
          });
        }
      });
    }
  );

• local-mcp-server.ts:24-31 (helper)

  Helper to validate the base command is whitelisted by splitting on whitespace and checking against ALLOWED_COMMANDS.

  function validateCommand(command: string): void {
    const commandParts = command.trim().split(/\s+/);
    const baseCommand = commandParts[0];
  
    if (!ALLOWED_COMMANDS.includes(baseCommand)) {
      throw new Error(`Command '${baseCommand}' is not allowed`);
    }
  }

• local-mcp-server.ts:10-12 (helper)

  Constant array defining allowed base commands for shell execution.

  const ALLOWED_COMMANDS = [
    'npm', 'yarn', 'git', 'node', 'npx', 'tsc', 'eslint', 'prettier'
  ];