medium

MCP server that can run shell commands

The server's name or package suggests it executes commands on your machine.

Why it matters

A prompt injection in any document, issue or web page the agent reads could run commands with your access.

How to fix it

Run it in a sandbox or container, require approval for every command, and keep it away from agents that read untrusted content. The checker keeps flagging it after you do this, because it can still run commands; that's intended.

Before

{
  "mcpServers": {
    "shell": {
      "command": "npx",
      "args": [
        "[email protected]"
      ],
      "autoApprove": [
        "run_command"
      ]
    }
  }
}

After

{
  "mcpServers": {
    "shell": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "--network",
        "none",
        "-v",
        "/home/alex/sandbox:/work",
        "some/shell-mcp:1.0.0"
      ]
    }
  }
}

Illustrative configs. The checker flags both versions with this finding on purpose: the “after” server can still run commands, it's just contained.

Check your own config