execute_commandLABSCO SUMMARY
The categories are yours to edit, and command lists merge with the defaults rather than replace them.
Read, write, system and blocked are just lists, so adding jq and rg to the read category is one environment variable and does not cost you the built-in set. On Claude Desktop, set CMD_LINE_MCP_SECURITY_REQUIRE_SESSION_ID to false — the author flags it as the way to avoid repeated approval prompts.
What it is
An MCP server that runs terminal commands under a four-stage safety check: dangerous patterns blocked, every command classified, the target directory whitelisted, and write or system commands held for session approval.
What you get
- Read-only commands that run without asking — execute_read_command
- Write and system commands behind approval — execute_command
- Grant access as you go: approve_directory and approve_command_type
- See the current boundaries: list_directories, list_available_commands, get_configuration
- Usage guidance for a command before you run it — get_command_help
- Pipes, semicolons and & supported, with each segment validated independently
- Shells and interpreters blocked outright, including indirect routes such as awk system(), sed /e and find -exec
Requirements
pip install cmd-line-mcp, then run cmd-line-mcp with an optional --config path. Settings come from a JSON file, a .env file or environment variables named CMD_LINE_MCP_<SECTION>_<SETTING>; version 0.6.0.
Setup effort
One command — pip install cmd-line-mcp
USE CASES
01
Letting an assistant look around your filesystem
Read commands run straight away inside whitelisted directories, with no prompt.
02
Running something that changes files, on purpose
Approve the command category for the session, then run it.
03
Opening up one more directory mid-session
Grant that path and check what is currently authorized.
04
Checking what it is actually allowed to do
List the command categories and read back the settings in force.
8 tools
Listed in project docs. Your client may show a different list.
execute_read_commandapprove_directoryapprove_command_typelist_directorieslist_available_commandsget_command_helpget_configurationBEFORE YOU INSTALL
What to know first
Tools you get
8 tools named in the project's documentation.
Requires
pip on PATH
Where it runs
The documented client runs the server on your machine.
INSTALLATION
Connect your client
Server setup
TERMINAL
pip install cmd-line-mcpMCP Clients
Claude Desktop
CLAUDE DESKTOP · JSON
{
"mcpServers": {
"cmd-line": {
"command": "<YOUR_PATH_TO_VENV>/bin/cmd-line-mcp",
"args": [
"--config",
"<YOUR_PATH_TO_CONFIG>"
],
"env": {
"CMD_LINE_MCP_SECURITY_REQUIRE_SESSION_ID": "false",
"CMD_LINE_MCP_SECURITY_AUTO_APPROVE_DIRECTORIES_IN_DESKTOP_MODE": "true"
}
}
}
}
