MCP Shell Server

uvx mcp-shell-server

{
  "mcpServers": {
    "shell-server-mcp": {
      "command": "uvx",
      "args": [
        "mcp-shell-server"
      ]
    }
  }
}

Every containment idea here follows from one refusal: never hand a string to a shell. Allowed commands run as argv arrays, pipelines keep their segments separate and validated, and redirection targets must resolve inside the requested working directory. Child processes get a small allowlisted environment instead of inheriting the server's, so tokens sitting in the parent's environment do not leak into a command. Naming a binary in ALLOW_COMMANDS is also not treated as trusting it — known escape routes such as find -exec, git -c overrides, GNU sort's external-program options and interpreter launchers are rejected before the process is created. Timeouts, output caps and redacted audit logging complete it; stdin, stdout, stderr, exit status and duration all come back.