Any server can run a command. What decides whether you would let an agent near it is what happens to the command it should not run — here, prefix validation against an explicit set, no shell execution, and an error that names what was permitted. Set ALLOWED_COMMANDS deliberately: the default includes npm and python, which are broad enough to run a lot of other things.
A single-tool command runner with an allowlist. Commands are checked by prefix against a configured set, and execution does not go through a shell, which removes the usual injection route.
- execute_command takes a command string and runs it if the allowlist permits
- The default allowlist is git, ls, mkdir, cd, npm, npx and python
- ALLOWED_COMMANDS replaces that list with your own, as a comma-separated string
- A rejected command returns an InvalidParams error naming the allowed commands, rather than failing silently
- Command output streams back, and a failed command returns its error as tool output rather than crashing the server
Node.js, built from a checkout with `npm install` and `npm run build`; the client points at build/index.js. Communication is over stdio. The only configuration is ALLOWED_COMMANDS, and the default set is deliberately restrictive.
One command — npx -y nodejs-example