Executive brief
mcp-shell is a server that allows AI language models to execute shell commands via an MCP (Model Context Protocol) interface. The tool has two critical configuration flaws: security validation is disabled by default in bare-binary deployments, and the official Docker image includes shell interpreters (bash, python) in its command allowlist, which defeats the intended security filtering. Together, these issues mean that default deployments run unrestricted shell command execution accessible to any connected language model via prompt injection or tool manipulation.
Technical details
mcp-shell provides remote shell execution via stdio-based MCP transport. Finding 1: In config.go line 49, the SecurityConfig has Enabled: false by default. The main.go initialization (lines 35–39) reads MCP_SHELL_SEC_CONFIG_FILE from the environment, but if unset, logs "security disabled" and continues without validation. The documented README install path (git clone && make install && mcp-shell) sets no environment variables, resulting in security.go lines 26–29 short-circuiting all validation when Enabled=false. Any connected language model can then call shell_exec with arbitrary commands. Finding 2: The official security.yaml includes /bin/bash and /usr/bin/python3 in allowed_executables. When secure mode is enabled (use_shell_execution: false), executor.go lines 142–163 parse commands via strings.Fields() and check for dangerous metacharacters (|, &, ;, $). However, an attacker can call shell_exec(command="/bin/bash -i") or shell_exec(command="/usr/bin/python3 /path/to/payload.py"), which passes the allowlist and metacharacter filter because the dangerous code lives in the interpreter's arguments or stdin, not in the direct command string. Both vulnerabilities are remotely exploitable by any MCP client (typically the operator's own language model) without network access or authentication. Patched in version 0.6.0.
Affected products
- sonirico mcp-shell < 0.6.0
Timeline
- 2026-06-14: disclosed: GitHub Security Advisory published
- 2026-08-25: advisory: Updated advisory with addendum
- 2026-08-25: patched: Patched in version 0.6.0