Which integrations are available for this server?

Allows secure execution of whitelisted shell commands with support for stdin input, returning stdout, stderr, exit status, and execution time.

How do I use MCP Shell Server?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@MCP Shell Server list the files in my project directory" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

MCP Shell Server

by fastmcp-me

Overview Schema Related Servers Score Discussions

Python

Local

Add to Cursor Add to VS Code Add to Claude Add to ChatGPT Add to Codex Add to Gemini

MCP Shell Server

codecov

A secure shell command execution server implementing the Model Context Protocol (MCP). This server allows remote execution of whitelisted shell commands with support for stdin input.

Features

Secure Command Execution: Only whitelisted commands can be executed
Standard Input Support: Pass input to commands via stdin
Comprehensive Output: Returns stdout, stderr, exit status, and execution time
Shell Operator Safety: Validates commands after shell operators (; , &&, ||, |)
Timeout Control: Set maximum execution time for commands

Related MCP server: Shell-MCP

MCP client setting in your Claude.app

Published version

code ~/Library/Application\ Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "shell": {
      "command": "uvx",
      "args": [
        "mcp-shell-server"
      ],
      "env": {
        "ALLOW_COMMANDS": "ls,cat,pwd,grep,wc,touch,find"
      }
    },
  }
}

Local version

Configuration

code ~/Library/Application\ Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "shell": {
      "command": "uv",
      "args": [
        "--directory",
        ".",
        "run",
        "mcp-shell-server"
      ],
      "env": {
        "ALLOW_COMMANDS": "ls,cat,pwd,grep,wc,touch,find"
      }
    },
  }
}

Installation

Installing via Smithery

To install Shell Server for Claude Desktop automatically via Smithery:

npx -y @smithery/cli install mcp-shell-server --client claude

Manual Installation

Installing via Smithery

To install Shell Server for Claude Desktop automatically via Smithery:

npx -y @smithery/cli install mcp-shell-server --client claude

Manual Installation

pip install mcp-shell-server

Installing via Smithery

To install Shell Server for Claude Desktop automatically via Smithery:

npx -y @smithery/cli install mcp-shell-server --client claude

Usage

Starting the Server

ALLOW_COMMANDS="ls,cat,echo" uvx mcp-shell-server
# Or using the alias
ALLOWED_COMMANDS="ls,cat,echo" uvx mcp-shell-server

The ALLOW_COMMANDS (or its alias ALLOWED_COMMANDS ) environment variable specifies which commands are allowed to be executed. Commands can be separated by commas with optional spaces around them.

Valid formats for ALLOW_COMMANDS or ALLOWED_COMMANDS:

ALLOW_COMMANDS="ls,cat,echo"          # Basic format
ALLOWED_COMMANDS="ls ,echo, cat"      # With spaces (using alias)
ALLOW_COMMANDS="ls,  cat  , echo"     # Multiple spaces

Request Format

# Basic command execution
{
    "command": ["ls", "-l", "/tmp"]
}

# Command with stdin input
{
    "command": ["cat"],
    "stdin": "Hello, World!"
}

# Command with timeout
{
    "command": ["long-running-process"],
    "timeout": 30  # Maximum execution time in seconds
}

# Command with working directory and timeout
{
    "command": ["grep", "-r", "pattern"],
    "directory": "/path/to/search",
    "timeout": 60
}

Response Format

Successful response:

{
    "stdout": "command output",
    "stderr": "",
    "status": 0,
    "execution_time": 0.123
}

Error response:

{
    "error": "Command not allowed: rm",
    "status": 1,
    "stdout": "",
    "stderr": "Command not allowed: rm",
    "execution_time": 0
}

Security

The server implements several security measures:

Command Whitelisting: Only explicitly allowed commands can be executed
Shell Operator Validation: Commands after shell operators (;, &&, ||, |) are also validated against the whitelist
No Shell Injection: Commands are executed directly without shell interpretation

Development

Setting up Development Environment

Clone the repository

git clone https://github.com/yourusername/mcp-shell-server.git
cd mcp-shell-server

Install dependencies including test requirements

pip install -e ".[test]"

Running Tests

pytest

API Reference

Request Arguments

Field	Type	Required	Description
command	string[]	Yes	Command and its arguments as array elements
stdin	string	No	Input to be passed to the command
directory	string	No	Working directory for command execution
timeout	integer	No	Maximum execution time in seconds

Response Fields

Field	Type	Description
stdout	string	Standard output from the command
stderr	string	Standard error output from the command
status	integer	Exit status code
execution_time	float	Time taken to execute (in seconds)
error	string	Error message (only present if failed)

Requirements

Python 3.11 or higher
mcp>=1.1.0

License

MIT License - See LICENSE file for details

Available Tools

1 tool

shell_executeC

Execute a shell command Allowed commands: echo, cat, ls Allowed patterns:

ParametersJSON Schema

Name	Required	Description
`stdin`	No	Input to be passed to the command via stdin
`command`	Yes	Command and its arguments as array
`timeout`	No	Maximum execution time in seconds
`directory`	Yes	Absolute path to a working directory where the command will be executed

TDQS

C2.7/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavior. It does state allowed commands, but the incomplete 'Allowed patterns:' and lack of information about error handling, permissions, or side effects leave important behavioral context unknown. For a shell execution tool, this is a significant gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is brief but not well-structured: the second sentence is cut off mid-phrase ('Allowed patterns: '), making it appear as a formatting artifact rather than concise prose. It should either complete the pattern list or remove the line.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of annotations, output schema, and sibling context, the description is incomplete for a security-sensitive tool. It fails to mention what happens with disallowed commands, whether stdin is always supported, timeout semantics, or any examples of valid invocations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All parameters have descriptions in the input schema (100% coverage), so the description adds no additional parameter semantics. The mention of 'Allowed commands' relates to possible values for the 'command' array but does not specify format or constraints beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the primary action 'Execute a shell command' and enumerates a specific allowlist ('Allowed commands: echo, cat, ls'), which differentiates it from arbitrary shell executors. However, the 'Allowed patterns:' line is incomplete, slightly muddying the exact scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided about when to choose this tool over alternatives, and there are no sibling tools listed. The description only states what commands are allowed, not when execution is appropriate. Since the tool name suggests a general shell executor, the description should clarify that it's restricted to safe read-only commands like echo, cat, and ls.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

1 tool updatev0.1.0Aug 2, 2026
- First observedshell_execute

Install Server

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

B3/5.0

Disambiguation5/5

There is only one tool, so there is no possibility of confusion. The tool's purpose is clearly defined as executing shell commands with specific allowed commands.

Naming Consistency5/5

With a single tool, naming consistency is trivially maintained. The name 'shell_execute' follows a predictable pattern and clearly conveys its function.

Tool Count3/5

The single tool is borderline for a server named 'MCP Shell Server'. While the restricted command set makes it coherent, a full shell server would typically require more tools to handle different operations.

Completeness2/5

The tool only supports echo, cat, and ls, which is a very limited subset of shell capabilities. Missing common operations like file manipulation, process control, or piping leaves significant gaps for a tool claiming to be a shell server.

Maintenance

ActivityInactive

ResponsivenessNo issues

Resources

GitHub Repository

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

DynamicEndpoints-powershell-exec-mcp-serverOAuth
ai.smithery
Execute PowerShell commands securely with controlled timeouts and input validation. Retrieve syste…
Shell Access Command Line OS Automation
21
PromptGuard Scan MCP
space.promptguardscan
Paid remote MCP for LLM security scans, jailbreak checks, analytics, checkout, and readiness.
Security Penetration Testing
2
agentmailrooms-mcp
com.clauxel.agentmailrooms
A paid remote MCP for OpenAI Codex agent coordination MCP, built to return verdicts, receipts, usage
Agent Orchestration Autonomous Agents
2
clawmanagerfleet-mcp
com.clauxel.clawmanagerfleet
A paid remote MCP for ClawManager, built to return verdicts, receipts, usage logs, and audit-ready J
Payments & Billing Monitoring
2

Related MCP Servers

mcp-shell-server
Shell Access Code Execution
tumf
A
license
A
quality
A
maintenance
A secure shell command execution server implementing the Model Context Protocol (MCP). This server allows remote execution of whitelisted shell commands with support for stdin input.
Updated 5 days ago (2026-09-01 18:53 UTC)
1
191
MIT
Shell-MCP
Shell Access Command Line Code Execution
kevinwatt
A
license
B
quality
D
maintenance
A secure MCP server for executing whitelisted shell commands with resource and timeout controls, designed for integration with Claude and other MCP-compatible LLMs.
Updated 2 years ago (2025-02-20 18:14 UTC)
20
389
7
MIT
Bash MCP Server
Shell Access Command Line
NimbleBrainInc
A
license
A
quality
C
maintenance
An MCP server that enables the execution of arbitrary bash commands and returns detailed output including stdout, stderr, and exit codes. It supports customizable working directories, execution timeouts, and environment variable configurations.
Updated 3 months ago (2026-05-30 02:18 UTC)
1
MIT
shell-mcp
kg912
A
license
Not graded
quality
D
maintenance
Enables secure execution of shell commands via MCP with multiple security layers including command whitelisting and directory restrictions.
Updated 4 months ago (2026-04-26 06:45 UTC)
22
MIT

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/fastmcp-me/mcp-shell-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server

MCP Shell Server

Features

MCP client setting in your Claude.app

Published version

Local version

Configuration

Installation

Installing via Smithery

Manual Installation

Installing via Smithery

Manual Installation

Installing via Smithery

Usage

Starting the Server

Request Format

Response Format

Security

Development

Setting up Development Environment

Running Tests

API Reference

Request Arguments

Response Fields

Requirements

License

Available Tools

TDQS

Tool Schema Changelog

TDQS

Maintenance

Resources

Looking for Admin?

Related MCP Connectors

Related MCP Servers

mcp-shell-server

Shell-MCP

Bash MCP Server

shell-mcp

Latest Blog Posts

MCP directory API