allow-start-process registers a script with its args and cwd, and list-allowed-processes-in-cwd reads that back per directory, so what an agent may launch is inspectable instead of implicit. The limit is stated plainly: start-process warns against invoking background processes that will not exit on their own, and says stdout and stderr will not be captured in that case. For processes that do behave, get-process-stdout and get-process-stderr read output back a chunk at a time rather than all at once.
A process manager with 11 tools: an allowlist of permitted script and argument combinations per working directory, and the start, restart, delete, inspect and output-reading tools for what runs from it.
- The allowlist as explicit tools: allow-start-process registers a script, its args and a cwd as permitted, list-allowed-processes-in-cwd shows what is permitted in a directory, and delete-allowed-process removes an entry.
- Process control: start-process with a name, script, args, cwd and envs, then restart-process and delete-process by id.
- Inspection: list-processes for everything running, and get-process-info for one process by id.
- Output read back in chunks: get-process-stdout and get-process-stderr, each taking a chunkCount.
- get-server-id for the server's own identifier.
A machine the server can run processes on, and an allowlist entry for each script and argument combination before it can be started.
One command — npx -y procm-mcp