execute_commandLABSCO SUMMARY
Shell access with the boundary declared in the launch line.
The allowlist is checkable rather than implied: list_allowed_commands reads back exactly what this server will run, so the scope of what you granted is visible from inside the conversation. Two things to weigh before granting it — --allowed-commands=* removes the boundary entirely, and command output goes back to the model, so anything the command prints is in the transcript.
What it is
A Go server that executes shell commands through bash or zsh and returns what they produced. The allowlist is the design: only commands passed to --allowed-commands can run, unless that flag is set to * to permit everything. It keeps a record of what it ran, so past executions can be read back.
What you get
- A command executed in bash or zsh, returning stdout, stderr, exit code and execution time
- Recently executed commands listed with timestamps and status
- The current allowlist read back — the exact set of commands this server will run
Requirements
The binary on your PATH — go install github.com/gamunu/mcp-unix-shell — and an --allowed-commands argument at launch that names what it may run. It runs as the user who started the client, with that user's permissions.
Setup effort
One command — go install github.com/gamunu/mcp-unix-shell@latest
USE CASES
01
Letting an assistant look around a machine safely
Launch with a read-only set — ls, cat, find — and the assistant can answer questions about what is on disk without holding the ability to change any of it.
02
Confirming what you actually granted
Read the allowlist back before trusting a session with anything sensitive, rather than reasoning from what you meant to put in the config a month ago.
03
Running the one command that answers the question
Output comes back with exit code and execution time attached, so a command that failed is distinguishable from one that succeeded and printed nothing.
04
Retracing what the session did
List the recent executions with their timestamps and status when you want to know what an agent ran before things changed.
3 tools
Listed in project docs. Your client may show a different list.
list_recent_commandslist_allowed_commandsBEFORE YOU INSTALL
What to know first
Tools you get
3 tools named in the project's documentation.
Requires
mcp-unix-shell on PATH
Where it runs
The documented client runs the server on your machine.
INSTALLATION
Connect your client
Server setup
TERMINAL
go install github.com/gamunu/mcp-unix-shell@latestMCP Clients
Claude Desktop
CLAUDE DESKTOP · JSON
{
"mcpServers": {
"shell": {
"command": "mcp-unix-shell",
"args": [
"--allowed-commands=ls,cat,echo,find"
]
}
}
}
