run_shell_command
Execute whitelisted shell commands for development tasks like npm, git, node, and code quality tools within the AI Development Pipeline workspace.
Instructions
Run a whitelisted shell command in the workspace (npm, yarn, git, node, npx, tsc, eslint, prettier)
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes |
Implementation Reference
- local-mcp-server.ts:76-103 (handler)Handler function that validates the command using validateCommand, executes the shell command with child_process.exec limited to workspace cwd, 30s timeout, 1MB buffer, sanitizes output by removing control characters, and returns the stdout or error as content.
async ({ command }) => { return new Promise((resolve) => { try { validateCommand(command); exec(command, { cwd: WORKSPACE_ROOT, timeout: 30000, // 30 second timeout maxBuffer: 1024 * 1024 // 1MB max output }, (error, stdout, stderr) => { if (error) { resolve({ content: [{ type: 'text', text: `Error: ${stderr || error.message}` }] }); } else { // Sanitize output to prevent log injection const sanitizedOutput = stdout.replace(/[\x00-\x1f\x7f-\x9f]/g, ''); resolve({ content: [{ type: 'text', text: sanitizedOutput }] }); } }); } catch (err: any) { resolve({ content: [{ type: 'text', text: `Security error: ${err.message}` }] }); } }); } - local-mcp-server.ts:75-75 (schema)Input schema defining the 'command' parameter as a Zod string.
{ command: z.string() }, - local-mcp-server.ts:72-104 (registration)MCP server tool registration for 'run_shell_command' with description, schema, and handler.
server.tool( 'run_shell_command', 'Run a whitelisted shell command in the workspace (npm, yarn, git, node, npx, tsc, eslint, prettier)', { command: z.string() }, async ({ command }) => { return new Promise((resolve) => { try { validateCommand(command); exec(command, { cwd: WORKSPACE_ROOT, timeout: 30000, // 30 second timeout maxBuffer: 1024 * 1024 // 1MB max output }, (error, stdout, stderr) => { if (error) { resolve({ content: [{ type: 'text', text: `Error: ${stderr || error.message}` }] }); } else { // Sanitize output to prevent log injection const sanitizedOutput = stdout.replace(/[\x00-\x1f\x7f-\x9f]/g, ''); resolve({ content: [{ type: 'text', text: sanitizedOutput }] }); } }); } catch (err: any) { resolve({ content: [{ type: 'text', text: `Security error: ${err.message}` }] }); } }); } ); - local-mcp-server.ts:24-31 (helper)Helper to validate the base command is whitelisted by splitting on whitespace and checking against ALLOWED_COMMANDS.
function validateCommand(command: string): void { const commandParts = command.trim().split(/\s+/); const baseCommand = commandParts[0]; if (!ALLOWED_COMMANDS.includes(baseCommand)) { throw new Error(`Command '${baseCommand}' is not allowed`); } } - local-mcp-server.ts:10-12 (helper)Constant array defining allowed base commands for shell execution.
const ALLOWED_COMMANDS = [ 'npm', 'yarn', 'git', 'node', 'npx', 'tsc', 'eslint', 'prettier' ];