The interesting part is not that it runs commands — it is that the directory list and the shell list are arguments to the server, so what the assistant can reach is decided by you at launch rather than by the model at call time.
A shell for an AI client with the blast radius set at startup. You list the directories commands may run in and the shells they may run under; anything outside those lists is rejected before it executes.
- `execute_command` — runs a command line in a named shell with a working directory, and returns the output
- Bash, sh, cmd and powershell, each registered by name and path so the assistant asks for one you approved
- Working-directory validation, so a path that tries to climb out of the allowed set is refused rather than followed
Python 3.11+, installed with `pip install shell-mcp-server` or `uv pip install shell-mcp-server`. Allowed directories are positional arguments and each shell is registered with `--shell name path`, so both lists are fixed at launch. `COMMAND_TIMEOUT` caps execution time in seconds, default 30. Commands run with the same permissions as the server process, so start it as the user you want those commands to be.
One command — pip install shell-mcp-server