Nothing runs that is not named in `ALLOWED_COMMANDS`, and because it has no default, an unset variable means an unusable server rather than an open one — which is the right failure. Start narrow: the docs' own example is three read-only commands, and each addition should be weighed against what that binary can reach. The advanced path, a `commands.yaml` referenced by `COMMAND_CONFIG`, adds per-command flag and path restrictions.
An MCP server for executing system commands under three constraints: a whitelist you set, a confirmation prompt before anything runs, and an audit log of what happened.
- A command executed from the allowed list, with arguments passed as a list — `execute_command`
- The current allowlist readable by the model, so it can see what it may run — `list_allowed_commands`
- The execution history as an MCP resource — `audit://log`, with timestamp, command and result per entry
- Input sanitization on arguments: special characters escaped and path traversal rejected before a process starts
- A confirmation step in front of every execution, with the command shown as it will run
Python 3.10 or higher. The README's install line names `mcp-command-server`, which PyPI does not have. The allowlist is mandatory and has no default: `ALLOWED_COMMANDS` is a comma-separated list, set in the shell or in the client's env block — the documented example is `ls,pwd,echo`. Two optional variables tune it: `LOG_LEVEL` (default `INFO`) and `CONFIRMATION_TIMEOUT` (default `30` seconds), after which the call fails rather than waiting. Logs are written to `~/Library/Logs/Claude/mcp-command-server.log`. The project version is 0.1.0.