Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@win-cli-mcp-server Check disk space using PowerShell"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Hardened MCP server for Windows CLI and SSH interactions. Provides controlled access to PowerShell, CMD, Git Bash, and remote systems via SSH from MCP clients like Claude Desktop.
This is a maintained, hardened fork:
SimonB97/win-cli-mcp-server (original, development stalled) -> delorenj/super-win-cli-mcp-server (super-win-cli variant) -> this repo (bug fixes, hardening, dependency updates)
The original project is no longer actively maintained. This fork fixes critical bugs, updates dependencies, and is used in production daily.
Related MCP server: Super Shell MCP Server
GUI window popups -- Added windowsHide: true to child_process.spawn(). Shell windows no longer flash on screen during MCP execution.
SSH event listener leak -- Reconnection cycles accumulated duplicate handlers on the ssh2 Client instance, causing memory leaks. Fixed by creating a fresh Client on each reconnect and using .once() for connection-scoped events.
SSH stderr silently dropped -- When stdout had content, stderr was discarded (output || errorOutput). Now both streams are combined.
Silent config fallback on BOM -- UTF-8 BOM in config.json caused JSON.parse() to throw, silently falling back to restrictive defaults. BOM is now stripped before parsing.
Dead dependency removed -- @modelcontextprotocol/server-memory-dynamic pointed to file:../servers/src/memory (author's local dev path). Removed.
SSH agent auth support -- Config validation required password or privateKeyPath. If neither was specified, the entire config load failed. Now optional -- ssh2 falls back to ssh-agent automatically.
SIGTERM handler -- Only SIGINT triggered cleanup. When the parent process sends SIGTERM (common when Claude Desktop restarts), SSH connections now close gracefully.
MCP SDK updated -- Jumped from v1.0.1 to v1.29.0 (28 versions of bug fixes, security patches, protocol improvements). Zero breaking changes.
npm audit clean -- All known vulnerabilities resolved.
Dead code removed -- resolveCommandPath, isPathAllowed, validateWorkingDirectory, normalizeWindowsPath (exported but never imported). Unused imports (exec, promisify) also removed.
@types/ssh2 moved to devDependencies -- Type packages don't belong in production deps.
Output size cap -- Shell output is now capped at 1MB to prevent OOM on commands that dump large outputs. Truncated output includes a notice.
Add to your claude_desktop_config.json:
{
"mcpServers": {
"win-cli": {
"command": "node",
"args": [
"C:/path/to/win-cli-mcp-server/dist/index.js",
"--config",
"C:/path/to/win-cli-mcp-server/config.json"
]
}
}
}Or clone and set up:
git clone https://github.com/mhprol/win-cli-mcp-server.git
cd win-cli-mcp-server
npm install
npm run buildCopy config.example.json to config.json and customize:
{
"security": {
"maxCommandLength": 50000,
"blockedCommands": [],
"blockedArguments": [],
"allowedPaths": [],
"restrictWorkingDirectory": false,
"logCommands": true,
"maxHistorySize": 2000,
"commandTimeout": 600,
"enableInjectionProtection": false
},
"shells": {
"powershell": {
"enabled": true,
"command": "C:\\Program Files\\PowerShell\\7\\pwsh.exe",
"args": ["-NoProfile", "-NoLogo", "-NonInteractive", "-Command"],
"blockedOperators": []
},
"cmd": {
"enabled": true,
"command": "cmd.exe",
"args": ["/c"],
"blockedOperators": []
},
"gitbash": {
"enabled": true,
"command": "C:\\Program Files\\Git\\bin\\bash.exe",
"args": ["--norc", "-c"],
"blockedOperators": []
}
},
"ssh": {
"enabled": true,
"defaultTimeout": 30,
"maxConcurrentSessions": 5,
"keepaliveInterval": 10000,
"keepaliveCountMax": 3,
"readyTimeout": 20000,
"connections": {
"my-server": {
"host": "192.168.1.100",
"port": 22,
"username": "user",
"privateKeyPath": "C:\\Users\\you\\.ssh\\id_ed25519"
}
}
}
}SSH authentication priority: explicit key > password > ssh-agent (automatic).
Config notes:
File must be valid JSON without BOM (UTF-8, no BOM). Most editors default to this.
config.json is gitignored to protect credentials. Use config.example.json as template.
Shell command paths should point to the actual executable (e.g., pwsh.exe for PS7, not powershell.exe for PS5.1).
Tool | Description |
| Run a command in PowerShell, CMD, or Git Bash |
| Retrieve history of executed commands |
| Execute a command on a configured remote host |
| Close an SSH connection |
This server provides direct access to your system's command line and remote systems via SSH. The default configuration is intentionally open for trusted single-user environments. For shared or exposed setups:
Enable restrictWorkingDirectory and set allowedPaths
Populate blockedCommands and blockedArguments
Enable enableInjectionProtection
Set blockedOperators per shell
Use key-based SSH auth, never store passwords in config
Simon Benedict -- Original win-cli-mcp-server author
delorenj -- super-win-cli fork with extended config
Hardening, bug fixes, and maintenance by Matt Prol
MIT -- see LICENSE.
Execute a command in the specified shell (powershell, cmd, or gitbash)
Example usage (PowerShell):
{
"shell": "powershell",
"command": "Get-Process | Select-Object -First 5",
"workingDir": "C:\Users\username"
}Example usage (CMD):
{
"shell": "cmd",
"command": "dir /b",
"workingDir": "C:\Projects"
}Example usage (Git Bash):
{
"shell": "gitbash",
"command": "ls -la",
"workingDir": "/c/Users/username"
}| Name | Required | Description | Default |
|---|---|---|---|
| shell | Yes | Shell to use for command execution | |
| command | Yes | Command to execute | |
| workingDir | No | Working directory for command execution (optional) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of disclosing behavior. It gives examples but does not mention return values, exit codes, error handling, side effects, environment specifics, or security implications. For a command execution tool, this is insufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The opening one-sentence description is concise and front-loaded. The three examples are redundant in structure but serve to illustrate cross-shell syntax. Each sentence earns its place, though the examples could be trimmed to one or two without loss.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool that executes arbitrary system commands, there is no mention of output format, timeouts, working directory defaults, or safety considerations. The presence of sibling ssh_execute suggests a need to clarify local vs remote execution, which is absent. The examples help but do not fill all gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already covers 100% of parameters, but the description adds value through concrete examples showing valid shell values, command syntax, and workingDir formatting (e.g., Windows paths vs Git Bash paths). This enhances understanding beyond the schema's terse descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool executes a command in a specified shell (powershell, cmd, or gitbash), which is a specific verb+resource. It is distinguishable from siblings like get_command_history and ssh_execute, though it does not explicitly call out these differences. The mention of the shell options adds specificity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus alternatives such as ssh_execute (remote execution) or get_command_history. The examples imply usage but do not provide context, prerequisites, or exclusions. This is a clear gap.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get the history of executed commands
Example usage:
{
"limit": 5
}Example response:
[
{
"command": "Get-Process",
"output": "...",
"timestamp": "2024-03-20T10:30:00Z",
"exitCode": 0
}
]| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of history entries to return (default: 10, max: 1000) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It adds transparency by showing a detailed example response with fields (command, output, timestamp, exitCode), which clarifies the return format. However, it does not explicitly state whether history is session-scoped, how results are ordered, or that it has no side effects. Given the absence of annotations, there are notable but not critical gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise: a single opening sentence plus two compact JSON examples. The purpose is front-loaded, and every element adds value—the example usage demonstrates the parameter, and the example response shows the expected output structure. No redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter, no-output-schema tool, the description is quite complete: it states the purpose, shows how to invoke it, and provides a representative response. Minor omissions like ordering or session scope are not critical for a list-history tool. The example response effectively substitutes for an output schema, making the tool actionable for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already fully documents the 'limit' parameter with default (10) and max (1000) values, providing 100% coverage. The description's example usage (limit: 5) reinforces the parameter but adds no new semantic meaning beyond the schema. Baseline 3 is appropriate because the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a clear verb+resource statement: 'Get the history of executed commands'. It distinguishes itself from sibling tools like execute_command (execution) and ssh_execute (remote execution) by focusing specifically on retrieval of prior commands. The example response reinforces the purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a clear usage context: to retrieve previously executed commands, with an example showing the optional limit parameter. It does not explicitly state when not to use it, but the purpose is self-evident and no competing history tools exist among siblings. No explicit exclusions are given, but this is clearly a read-only counterpart to the execution siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Disconnect from an SSH server
Example usage:
{
"connectionId": "raspberry-pi"
}Use this to cleanly close SSH connections when they're no longer needed.
| Name | Required | Description | Default |
|---|---|---|---|
| connectionId | Yes | ID of the SSH connection to disconnect |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the full burden. It mentions 'cleanly close' but doesn't disclose side effects like what happens to associated sessions, idempotency, or error behavior. It's minimally adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short and includes a practical JSON example, which helps the agent. It repeats the concept slightly ('Disconnect' and 'close SSH connections'), but overall it's well-structured and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool with no output schema, the description is adequate. It provides an example and clear use case. It doesn't cover errors or edge cases, but given the low complexity, this is not a significant gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with the parameter described as 'ID of the SSH connection to disconnect'. The example usage adds an illustrative value (raspberry-pi) but doesn't add semantic meaning beyond the schema, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Disconnect' and the resource 'SSH connection/server', which distinguishes it from siblings like ssh_execute and execute_command. The example usage reinforces the exact action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It says 'when they're no longer needed', providing clear context for when to use this tool. It doesn't explicitly mention alternatives or when not to use, but the sibling tool names imply the distinction, so a slight deduction is warranted.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Execute a command on a remote host via SSH
Example usage:
{
"connectionId": "raspberry-pi",
"command": "uname -a"
}Configuration required in config.json:
{
"ssh": {
"enabled": true,
"connections": {
"raspberry-pi": {
"host": "raspberrypi.local",
"port": 22,
"username": "pi",
"password": "raspberry"
}
}
}
}| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | Command to execute | |
| connectionId | Yes | ID of the SSH connection to use |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It mentions that SSH must be enabled in config.json and gives an example connection, which is useful. However, it does not disclose the command execution behavior (e.g., output format, error handling, potential destructive side-effects) or that it uses the specified password for authentication.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is structured and efficient, with a one-sentence purpose followed by illustrative JSON examples. The config block is large but necessary to show the setup requirements. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description should explain what the tool returns or what 'execute' entails. It does neither, though it does provide configuration context. For a command execution tool, the lack of mention of output or error behavior leaves a moderate gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema descriptions are minimal ('Command to execute', 'ID of the SSH connection to use'). The description adds meaningful value by showing an example usage and the config structure, clarifying that connectionId refers to a key in the 'connections' object and command is a shell string.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Execute a command on a remote host via SSH', using a specific verb and resource. It distinguishes itself from sibling tools like ssh_disconnect (manage connection) and get_command_history (retrieve history).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a concrete example and configuration requirement, implying when to use the tool (when you have a configured SSH connection and need to run a command). However, it does not explicitly state when to use it over alternatives like execute_command, nor does it provide exclusion criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v1.0.0ssh_disconnectssh_executeexecute_commandget_command_historyEach tool has a clearly distinct purpose: local execution, history retrieval, remote execution, and remote disconnection. There is no overlap or ambiguity between the four tools.
Names are mostly predictable: local tools use simple verb_noun (execute_command, get_command_history), while SSH tools consistently use the ssh_ prefix (ssh_execute, ssh_disconnect). The slight inconsistency is that ssh_execute uses 'execute' while the local counterpart is 'execute_command' with an extra noun.
Four tools is well-scoped for a Windows CLI MCP server. Each tool serves a core function without unnecessary bloat.
The local command execution and history retrieval cover the primary workflow. SSH execute and disconnect provide a basic remote capability, though there is no explicit ssh_connect (likely implied by ssh_execute) and no way to manage connections beyond disconnecting.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.
A paid remote MCP for ClawManager, built to return verdicts, receipts, usage logs, and audit-ready J
A paid remote MCP for CLI tool MCP, built to return verdicts, receipts, usage logs, and audit-ready
MCP server unifying ERPs, CRMs, APIs and knowledge base for Claude, ChatGPT and Gemini.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/mhprol/win-cli-mcp-server'
If you have feedback or need assistance with the MCP directory API, please join our Discord server