MladenSU/cli-mcp-server

---
A secure Model Context Protocol (MCP) server implementation for executing controlled command-line operations with
comprehensive security features.
---
Table of Contents
1. Overview
2. Features
3. Configuration
4. Available Tools
- run_command
- show_security_rules
5. Usage with Claude Desktop
- Development/Unpublished Servers Configuration
- Published Servers Configuration
6. Security Features
7. Error Handling
8. Development
- Prerequisites
- Building and Publishing
- Debugging
9. License
---
Overview
This MCP server enables secure command-line execution with robust security measures including command whitelisting, path
validation, and execution controls. Perfect for providing controlled CLI access to LLM applications while maintaining security.
Features
- 🔒 Secure command execution with strict validation
- ⚙️ Configurable command and flag whitelisting with 'all' option
- 🛡️ Path traversal prevention and validation
- 🚫 Shell operator injection protection
- ⏱️ Execution timeouts and length limits
- 📝 Detailed error reporting
- 🔄 Async operation support
- 🎯 Working directory restriction and validation
Configuration
Configure the server using environment variables:
| Variable | Description | Default |
|---------------------|------------------------------------------------------|-------------------|
| ALLOWED_DIR | Base directory for command execution (Required) | None (Required) |
| ALLOWED_COMMANDS | Comma-separated list of allowed commands or 'all' | ls,cat,pwd |
| ALLOWED_FLAGS | Comma-separated list of allowed flags or 'all' | -l,-a,--help |
| MAX_COMMAND_LENGTH| Maximum command string length | 1024 |
| COMMAND_TIMEOUT | Command execution timeout (seconds) | 30 |
| ALLOW_SHELL_OPERATORS | Allow shell operators (&&, \|\|, \|, >, etc.) | false |
Note: Setting ALLOWED_COMMANDS or ALLOWED_FLAGS to 'all' will allow any command or flag respectively.
Installation
To install CLI MCP Server for Claude Desktop automatically via Smithery:
Available Tools
run_command
Executes whitelisted CLI commands within allowed directories.
**Input Schema:**
**Security Notes:**
- Shell operators (&&, |, >, >>) are not supported by default, but can be enabled with ALLOW_SHELL_OPERATORS=true
- Commands must be whitelisted unless ALLOWED_COMMANDS='all'
- Flags must be whitelisted unless ALLOWED_FLAGS='all'
- All paths are validated to be within ALLOWED_DIR
show_security_rules
Displays current security configuration and restrictions, including:
- Working directory
- Allowed commands
- Allowed flags
- Security limits (max command length and timeout)
Usage with Claude Desktop
Add to your ~/Library/Application\ Support/Claude/claude_desktop_config.json:
> Development/Unpublished Servers Configuration
> Published Servers Configuration
> In case it's not working or showing in the UI, clear your cache via uv clean.
Security Features
- ✅ Command whitelist enforcement with 'all' option
- ✅ Flag validation with 'all' option