The inheritance model is what makes this usable rather than all-or-nothing: set the strict defaults globally, then loosen or tighten one shell — a longer timeout for PowerShell, a different blocklist for WSL — instead of running one permission level everywhere. Configure allowed paths before connecting anything, because with the restriction enabled and no paths listed, the only directory available is the initial one. The configuration tool matters more than it looks: an agent that can read the limits stops burning turns on commands that were never going to run.
A command-line bridge with a permission model. Every execution names its shell and working directory, and is checked against the allowed paths, blocked commands, blocked arguments, blocked operators and timeout in effect for that shell.
- Commands executed in PowerShell, CMD, Git Bash, Bash or WSL, with the working directory, timeout and maximum output lines set per call
- Truncated output retrieved in full afterwards by execution id, paged with start and end lines or narrowed with a search
- A working directory the server holds between calls, read and set as its own tools, for when a sequence of commands belongs in one place
- The server's own effective configuration read back — global defaults plus each enabled shell's overrides — so an agent can see the limits before hitting them
- Directories checked against the allowed paths before you try to work in them, globally or against one shell's own list
- Configuration that inherits: global security, restriction and path settings, with any shell overriding what it needs — its own timeout, command length limit, blocked commands or operators
- WSL path mapping through a configurable mount point, so Windows paths and Linux paths resolve to the same place
- Execution logs stored and exposed as readable resources for querying past output
It grants command execution on the machine it runs on, so the configuration is the safety surface, not an optimisation. Started as npx -y wcli0, with --config pointing at a JSON file, --shell selecting a single shell, --initialDir setting the starting directory and --logDirectory choosing where logs land; --init-config writes a starter file. If allowedPaths is left out, nothing is allowed by default — with restrictWorkingDirectory on, only initialDir is added, and --allowAllDirs is the explicit flag for turning the restriction off. Defaults are a 2000-character command limit and a 30-second timeout, with injection protection on. Windows is the primary target, and Unix hosts are supported through the Bash shell. It can also serve over Streamable HTTP or the legacy SSE transport, with host, port and allowed origins in the config. MIT.
One command — npx -y wcli0