Nothing here asks you to approve a command mid-session — the decision was made when the allowlist was written, which means the assistant runs freely inside a fenced area and gets refused outside it. That is a good fit for letting a model look around a repository, build it and query it; it is not a sandbox, since whitelisted tools like `curl` and `python` can still reach the network and run arbitrary code.
A stdio server that gives an assistant a shell, with the dangerous half removed before it starts. Commands are checked against a whitelist covering file inspection, text processing, developer tooling, system info, network lookups and archives. Destructive operations and privilege escalation are not on that list, so they are refused rather than guarded by a prompt.
- `execute_command` runs a whitelisted command with arguments and returns its output
- File inspection: `ls`, `cat`, `head`, `tail`, `find`, `tree`, `wc`, `du`, `df`, `stat`
- Text processing: `grep`, `sed`, `awk`, `sort`, `uniq`, `cut`, `tr`
- Developer tooling: `git`, `npm`, `yarn`, `pip`, `python`, `node`, `cargo`, `make`, `go`, `java`
- System and network: `ps`, `uptime`, `uname`, `which`, `curl`, `wget`, `ping`, `dig`
- A 30-second execution timeout, so a hung command does not hold the session
Python and a checkout — `pip install -e .` (package `shell-executor-mcp`, version 0.1.0), then point your client at `python src/mcp_server.py` over stdio. Set `MCP_API_TOKEN` in the server's `env` block; it ships with a default value, so change it. No account and no external service: everything runs on your machine, as you.