run_commandLABSCO SUMMARY
Shell access with the fence written down.
Every server that runs commands claims to be careful; this one makes the boundary inspectable — the rules tool returns what is actually permitted, so you can check the fence instead of trusting the README.
What it is
A Python MCP server for controlled command-line execution. Commands run only from a whitelist, inside a base directory you set, with shell-operator injection blocked, path traversal validated, and timeouts and output limits enforced. A second tool prints the rules currently in force.
What you get
- Commands executed under strict validation, with detailed error reporting
- A whitelist of allowed commands and flags, with an all option when you want it open
- Execution confined to one base directory, with path traversal prevented
- Shell operator injection blocked
- Execution timeouts and output length limits
- The active security rules printed on request, so the boundary is visible rather than assumed
Requirements
A recent Python. The base directory is required and the server will not start without it; the commands it may run are given as a comma-separated list. Both are set in the environment.
Setup effort
Add the configuration to your client
USE CASES
01
Letting an assistant run a build without handing over the shell
Whitelist the few commands the job needs and let it run only those.
02
Checking exactly what it is allowed to do
Print the active rules — allowed commands, allowed flags, the base directory — rather than inferring them.
03
Keeping work inside one project directory
Confirm the base directory in the rules, then run commands that cannot escape it.
04
Running a fixed set of diagnostics
Give it the read-only commands you would run yourself, with a timeout so nothing hangs.
2 tools
Listed in project docs. Your client may show a different list.
show_security_rulesBEFORE YOU INSTALL
What to know first
Tools you get
2 tools named in the project's documentation.
Requires
- uvx on PATH
- Python 3.10+
Where it runs
Both documented setups run the server on your machine.
INSTALLATION
Connect your client
MCP Clients
Claude Desktop — uvx
CLAUDE DESKTOP — UVX · JSON
{
"mcpServers": {
"cli-mcp-server": {
"command": "uvx",
"args": [
"cli-mcp-server"
],
"env": {
"ALLOWED_DIR": "</your/desired/dir>",
"ALLOWED_COMMANDS": "ls,cat,pwd,echo",
"ALLOWED_FLAGS": "-l,-a,--help,--version",
"MAX_COMMAND_LENGTH": "1024",
"COMMAND_TIMEOUT": "30",
"ALLOW_SHELL_OPERATORS": "false"
}
}
}
}Claude Desktop — development
CLAUDE DESKTOP — DEVELOPMENT · JSON
{
"mcpServers": {
"cli-mcp-server": {
"command": "uv",
"args": [
"--directory",
"<YOUR_PATH_TO_REPO>/cli-mcp-server",
"run",
"cli-mcp-server"
],
"env": {
"ALLOWED_DIR": "</your/desired/dir>",
"ALLOWED_COMMANDS": "ls,cat,pwd,echo",
"ALLOWED_FLAGS": "-l,-a,--help,--version",
"MAX_COMMAND_LENGTH": "1024",
"COMMAND_TIMEOUT": "30",
"ALLOW_SHELL_OPERATORS": "false"
}
}
}
}
