The author calls it a Pandora's box, and the reasoning is sound: the tool can run anything the launching user can, and the forbidden-word list can be bypassed rather than relied on. The configuration is the interesting part — pointing it at psql instead of a shell gives you a database tool with a narrow blast radius, which is a far better default than a general shell. Run it in an isolated or controlled environment, and scope the launched process as tightly as the job allows.
A Python MCP server that opens a long-lived process and exposes a single tool for running commands through it. The process is whatever you configure, so the same server becomes a WSL shell, a psql session, or another CLI entirely.
- One exec tool per server entry, running a static command and returning its output
- `--process-path-args` — the process and its initial arguments, which is what decides whether this is a shell or a database client
- `--exec-name` and `--exec-description`, so the tool the model sees is named for the job it does
- `--forbidden-words` — a list of words rejected in commands
- `--filter-patterns` — regexes that strip terminal noise such as ANSI colour sequences and window titles from the output
- `--exec-timeout`, defaulting to 60 seconds
- Register the same server twice with different processes to get two differently named tools
Python 3.10 or higher, 3.11+ recommended. On Windows the pywinpty package is required; on Linux and macOS, ptyprocess. Install with `pip install .`. The author reports testing only against WSL.