Most shell tools start unrestricted and leave hardening to you. This one starts locked to read-only utilities and makes you opt into anything wider — including a startup warning if you allowlist an interpreter, which is the single mistake that silently voids the whole policy. The per-binary flag rules are the other unusual touch: allowing `git` without allowing `git -c` is a distinction almost nobody makes.
An MCP server that runs shell commands, written in Go, with the security policy as the actual product. With no configuration at all it boots in secure mode restricted to a narrow allowlist of read-only utilities — `ls`, `cat`, `grep`, `find`, `head`, `tail` and similar — and you write a config file only to widen that.
- A command-running tool taking `command`, plus `base64` to encode stdout and stderr when output is not plain text
- Structured responses carrying `status`, `exit_code`, `stdout`, `stderr`, `command`, `execution_time` and optional `security_info`
- Secure mode with no shell interpretation: the command is parsed into a shell AST and only a single, fully literal command is accepted — no pipes, lists, substitution, redirection or globs — and its executable must be on the allowlist
- Interpreters hard-denied even if you allowlist them, with a startup warning when one is found in your config
- Per-tool policies for governed binaries: `git` limited to read-only subcommands, and the known escape hatches rejected — `git -c`, `find -exec`, `sort -o`, `tar -I` and anything unrecognised
- Policy knobs in YAML: `allowed_executables`, `blocked_patterns` for argument-level restrictions, `max_execution_time`, `max_output_size`, `working_directory` and `audit_log`
- A legacy mode with real shell execution and command-string allow/block lists, for when you need pipes and accept the injection risk
The Docker image `sonirico/mcp-shell:latest` — non-root, Alpine-based — or a Go build with `make install`. No config file is needed to start safely. `MCP_SHELL_SEC_CONFIG_FILE` points at your YAML policy; `MCP_SHELL_ALLOW_UNSAFE=true` disables all validation. Logging is controlled by `MCP_SHELL_LOG_LEVEL`, `MCP_SHELL_LOG_FORMAT` and `MCP_SHELL_LOG_OUTPUT`. The author is direct about the boundary: the checks are an early-reject layer, not a sandbox, so pair it with a read-only filesystem and dropped capabilities.
One command — docker run -it --rm -v /tmp/mcp-workspace:/tmp/mcp-workspace sonirico/mcp-shell:latest