"Making an MCP server interact with launched shell commands, including interactive commands" matching MCP tools:

• run_instance_commandA

  Cycle MCPA

  Run a shell command inside a running container instance on Cycle, over the instance's SSH gateway, and return the shell output. Use this for one-time setup that must run inside a container — e.g. initializing a MongoDB replica set with 'mongosh --eval "rs.initiate({...})"'. The instance must be RUNNING (start the container first). If the container has multiple instances, pass 'instance' (id or hostname); otherwise the sole instance is used. Containers reach each other by hostname over the environment's private network, so commands can reference sibling containers (e.g. mongo-1:27017). This executes an arbitrary command inside your container — it is powerful and mutating. Always call with preview:true first: it echoes back the exact command and target without making any connection, so the user can confirm it is what they intend (nothing is validated — the command may still fail when run). Confirm with the user, then call again without preview. Never run a command without explicit confirmation. Short-lived SSH credentials are generated for the run and expired immediately after. The command runs in an interactive shell; make destructive commands idempotent where possible.

  Connector

  Destructive

  API key

• x402card.get_install_commandA

  x402card: Virtual Cards + Freeland eSIMA

  Return the shell install command and CLI discovery commands.

  ConnectorNo auth

• scan_securityA

  claude-skill-validatorA

  Scan a Claude Skill for dangerous shell commands, hardcoded secrets, or prompt-injection phrases. Returns findings with excerpts.

  ConnectorNo auth

• forge_run_site_commandB

  Laravel Forge MCP by usefulapiB

  ⚠️ Runs an arbitrary shell command in the site's directory on the server. Use with care. Forge v2: POST /orgs/{organization}/servers/{server}/sites/{site}/commands.

  Connector

  Destructive

  No auth

• job_declare_actionB

  ToolYour MCP ServerB

  Declare a HIGH or CRITICAL host action for this job. ToolYour cannot see undeclared shell commands. Not an approve-all.

  ConnectorAPI key

• works_verify_public_repositoryA

  WORKS Public VerifierA

  Use only after works_public_eligibility returns eligible. Download that immutable public GitHub snapshot, run the selected pinned static contract without executing repository commands, and return a signed receipt. Return the report field verbatim and stop.

  ConnectorNo auth

• validate_pythonA

  CodeCraftA

  Validates a Python automation script that runs OUTSIDE the game, on three axes: Python syntax (using the real interpreter), Minecraft commands embedded in the script (against the official command index), and the shape of the /connect WebSocket message envelope. For behavior pack scripts use validate_script instead — Python does not run inside a pack. The embedded command check is the most valuable one: a command written from memory can look syntactically fine and still do nothing in the game. Only strings starting with / are treated as commands. If syntax could not be checked, syntaxChecked is false in the result; ok:true alone does not mean the syntax is valid.

  ConnectorNo auth

• safe_preflight_checkA

  AgentWorldB

  [PAID $0.01 USDC per call — optional third-party check] Preflight a proposed command or tool call through HumanMirror Safe Preflight (humanmirror.fr, x402-verified seller) before executing it. Returns the independent risk verdict (risk level, findings, required guards) from their circuit engine. Use for genuinely risky external tool calls where a second opinion matters. Benign commands settle $0.01 USDC on Base and return the verdict; commands they judge over-limit are blocked and refunded (no charge). This is an OPTIONAL external check — AgentWorld's own spend-authority, solvency and circuit-breaker layers remain primary and free.

  ConnectorNo auth

• safe_preflight_checkA

  AgentWorld — Live AI Agent EconomyB

  [PAID $0.01 USDC per call — optional third-party check] Preflight a proposed command or tool call through HumanMirror Safe Preflight (humanmirror.fr, x402-verified seller) before executing it. Returns the independent risk verdict (risk level, findings, required guards) from their circuit engine. Use for genuinely risky external tool calls where a second opinion matters. Benign commands settle $0.01 USDC on Base and return the verdict; commands they judge over-limit are blocked and refunded (no charge). This is an OPTIONAL external check — AgentWorld's own spend-authority, solvency and circuit-breaker layers remain primary and free.

  ConnectorNo auth

• runA

  Comment.ioA

  Run one Comment.io command or restricted shell script in your workspace, exactly as an SSH exec: same commands, output and exit codes. Start with {"command":"help"}. The command runs on Comment.io, not on your machine; pass text for --stdin commands in stdin. Every call ends within 45 seconds: error: deadline (exit 3) means the outcome is unknown and writes may still land within seconds. After a deadline, a nonzero exit or a lost response, reread state rather than repeating a mutation.

  Connector

  Destructive

  OAuth

• lorg_helpA

  lorg-mcp-serverA

  List every available Lorg tool with a plain-English description. Call this when the user says /help, /options, "what can you do", or "show me available commands".

  ConnectorNo auth

• resource_use_instructionsA

  SuperSkill RegistryA

  Return the best safe next action for a mixed resource. Pass version to bind an immutable hosted release. Hosted skills expose explicit-consent exact native client install commands; upstream-only resources stay open-only.

  ConnectorNo auth

• verify_integrationA

  Alter OnboardingA

  Return a copy-pasteable recipe to VERIFY an integration works: `first-call` (code↔design, an audit row, correct attribution) or `per-user-isolation` (a multi-user/broker server runs two users under different credentials and rejects cross-user access). Guidance only — you run the commands.

  ConnectorNo auth

• run_auth_flowA

  opencode-workbenchA

  Return the acquisition plan for one credential on a target: the provider URL, the exact non-interactive command when one exists (e.g. `opencode auth login`, `opencode mcp auth vercel`, `gh auth login`), and whether it is already present. Read-only and value-blind: it emits guidance and re-checks presence with one read-only probe; it does not run the commands or handle secret values. Parameter semantics: `var` must be an env var name returned by list_required_credentials (unknown names error); `target` selects the machine and its `home` is where the value should be written. Use it for a single credential; it does not replace that listing.

  ConnectorNo auth

• run_admin_commandA

  VeriTeknikA

  Preview up to 10 administrative shell commands, in order, on a VPS owned by this company - install packages, edit and restart services, clone and build an application, write files, adjust the firewall. The first call resolves and returns the full numbered execution plan, including prerequisites added by the server rules marked source: server_rule, and a single use 15-minute confirmationToken; it changes nothing on the server. Show the whole list to the user. The token binds this plan; if the rules change it before execution, nothing runs and a new preview and approval are required. Only after they approve, repeat the same arguments plus confirmationToken with a new requestId (preview and execute need different requestIds). Execution stops at the first non-zero exit and reports which command failed. The server's own policy decides what runs: its BIOS rules, the shared safety classifier and its autonomy level. Commands in the dangerous class (mass deletion, disk formatting, user removal, reinstall) are refused as PANEL_ONLY; a server whose autonomy level requires a TOTP for moderate commands answers PRECONDITION_REQUIRED and nothing runs, because a connected app cannot ask for that code: the customer unlocks it in the hub on the server Morpheus tab, or raises the autonomy level there, and only then is a retry worth making. Each line is ONE program: no unquoted ; && || | and no command substitution - put the next step in the next line. Quotes and redirection are allowed; write a system file with sudo -n tee /etc/path <<< "content" (a shell redirect into /etc is the dangerous class and refused). Prefix root work with sudo -n. Every run is logged with this connection's id and the company is notified. Use run_command for reads; use this only for changes the user asked for.

  Connector

  Destructive

  OAuth

• run_auth_flowA

  opencode-workbenchA

  Return the acquisition plan for one credential on a target: the provider URL, the exact non-interactive command when one exists (e.g. `opencode auth login`, `opencode mcp auth vercel`, `gh auth login`), and whether it is already present. Read-only and value-blind: it emits guidance and re-checks presence with one read-only probe; it does not run the commands or handle secret values. Parameter semantics: `var` must be an env var name returned by list_required_credentials (unknown names error); `target` selects the machine and its `home` is where the value should be written. Use it for a single credential; it does not replace that listing.

  ConnectorNo auth

• site_consoleA

  AskYourStackA

  Run a site's own command line tool as the site's owner, in the site's folder: bin/console for Shopware 6 and PrestaShop, artisan for Laravel, drush for Drupal, cli/joomla.php for Joomla, ghost (ghost-cli) for Ghost (list_sites shows each site's console; Magento 2 has the magento tool and WordPress the wp tool). Pass the command and its options as args, like ["cache:clear"] or ["plugin:list", "--json"]. For a site in a Docker container it runs inside the container. Listing and status commands run straight away; uninstalling or deleting, anything that drops or resets the database, generating new keys, an admin login link and commands that run arbitrary PHP (tinker, php:eval) need approval. Symfony's console and artisan are run with --no-interaction; drush asks nothing only when you pass -y. Set background true for slow commands.

  Connector

  Destructive

  OAuth

• get_upload_urlA

  Sign PDFA

  Get a place to upload a PDF file. Use it when the document is a file, not text: a PDF you made with a file skill (your sandbox usually cannot reach Portant, so do not send it as base64), a PDF the user has, or any PDF over 1 MB. In Claude and ChatGPT, the Portant card shown with this result has an upload area: ask the user to download the file if needed and drop it there. The card then tells you the upload_id. If you can run shell commands and have the file, PUT it instead, for example: curl -T file.pdf -H "Content-Type: application/pdf" <upload_url> (add the same Authorization header you use for Portant, if any). Then pass upload_id to send_for_signature. PDF only: save a Word file as PDF first.

  ConnectorOAuth

• roll_proxy_credentialA

  Hextrap MCPA

  Roll (regenerate) the personal proxy credential for a firewall. This invalidates the previous password and returns a new one with ready-to-use configuration commands. Only call this when the user explicitly needs new credentials — it will break any existing package manager configuration using the old password.

  ConnectorAPI key

• oruk_get_startedA

  oruk SpeechA

  Quickstart for the oruk Speech API and this MCP server: how to get an API key, per-client MCP configuration snippets, SDK install commands, and an optional routing rule the user can add to their agent instructions. No API key required. Use this when setting oruk up for the first time or when the user asks how oruk works.

  ConnectorNo auth

• get_topup_quoteA

  MyOTP.AppA

  Get the live price and payment options for buying MyOTP credits, without making a purchase. Use this when generate_otp or another send fails with HTTP 403 insufficient balance / NoBalance, or before calling `top_up_credits` to show the cost. Returns USDC and card client commands and never exposes the configured API key.

  ConnectorNo auth