The allowlist is checkable rather than implied: list_allowed_commands reads back exactly what this server will run, so the scope of what you granted is visible from inside the conversation. Two things to weigh before granting it — --allowed-commands=* removes the boundary entirely, and command output goes back to the model, so anything the command prints is in the transcript.
A Go server that executes shell commands through bash or zsh and returns what they produced. The allowlist is the design: only commands passed to --allowed-commands can run, unless that flag is set to * to permit everything. It keeps a record of what it ran, so past executions can be read back.
- A command executed in bash or zsh, returning stdout, stderr, exit code and execution time
- Recently executed commands listed with timestamps and status
- The current allowlist read back — the exact set of commands this server will run
The binary on your PATH — go install github.com/gamunu/mcp-unix-shell — and an --allowed-commands argument at launch that names what it may run. It runs as the user who started the client, with that user's permissions.
One command — go install github.com/gamunu/mcp-unix-shell@latest