sonirico/mcp-shell

v0.6.0 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 1mo MCP Developer Tools

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 3 known CVEs

Topics

ai shell go llm mcp model-context-protocol

+2 more

os-exec cli

Affected surfaces

auth breaking_upgrade

ReleasePort's take

Moderate signal

editorial:auto 1mo

Secure mode is now the default for mcp‑shell; unrestricted behavior must be explicitly opted into. A bare‑binary install still disables secure mode by default, granting unrestricted access.

Why it matters: GHSA-f5pj-2738-996m reports that secure mode disabled in bare‑binary installs (severity 90) allows full system access; operators with such deployments must enable secure mode immediately.

Summary

AI summary

Updates What changed, high, and critical across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security
Security	Critical	GHSA-f5pj-2738-996m: Secure mode disabled by default in bare‑binary install, allowing unrestricted access. GHSA-f5pj-2738-996m: Secure mode disabled by default in bare‑binary install, allowing unrestricted access. Source: llm_adapter@2026-06-14 Confidence: high	—
Security	High	GHSA-3x77-wg38-92r3: `/bin/bash` and `python3` bypassed secure mode via command execution. GHSA-3x77-wg38-92r3: `/bin/bash` and `python3` bypassed secure mode via command execution. Source: llm_adapter@2026-06-14 Confidence: high	—
Security	High	GHSA-74hp-mggr-hv58: Git shell‑alias bypass using `!` metacharacter not blocked. GHSA-74hp-mggr-hv58: Git shell‑alias bypass using `!` metacharacter not blocked. Source: llm_adapter@2026-06-14 Confidence: low	—
Security	High	GHSA-74hp-mggr-hv58: Git shell‑alias (`git -c alias.x=!cmd`) bypassed secure mode because `!` was not blocked. GHSA-74hp-mggr-hv58: Git shell‑alias (`git -c alias.x=!cmd`) bypassed secure mode because `!` was not blocked. Source: granite4.1:30b@2026-06-14-audit Confidence: low	—
Breaking	High	Secure mode becomes default; unrestricted behavior requires explicit opt‑in. Secure mode becomes default; unrestricted behavior requires explicit opt‑in. Source: llm_adapter@2026-06-14 Confidence: high	—
Bugfix
Bugfix	Medium	Removed shell/language interpreters from default allowlist; startup warns if any are added. Removed shell/language interpreters from default allowlist; startup warns if any are added. Source: llm_adapter@2026-06-14 Confidence: high	—
Bugfix	Medium	Blocked `!` and `=!` as shell metacharacters in secure mode. Blocked `!` and `=!` as shell metacharacters in secure mode. Source: llm_adapter@2026-06-14 Confidence: high	—
Bugfix	Low	Corrected misleading "security disabled" startup log message. Corrected misleading "security disabled" startup log message. Source: llm_adapter@2026-06-14 Confidence: high	—

Full changelog

⚠️ Breaking change

Secure mode is now the default. With no config file, mcp-shell boots restricted to a narrow allowlist of read-only utilities. To restore the previous unrestricted behavior you must opt in explicitly:

MCP_SHELL_ALLOW_UNSAFE=true mcp-shell

Security fixes

Closes three advisories where "secure mode" did not deliver the advertised restriction:

GHSA-f5pj-2738-996m (critical) — security was disabled by default in the bare-binary install path.
GHSA-3x77-wg38-92r3 (high) — /bin/bash (and python3) in the default allowlist bypassed secure mode via bash -c.
GHSA-74hp-mggr-hv58 (high) — git shell-alias bypass (git -c alias.x=!cmd); ! was missing from the metacharacter blocklist.

What changed

Built-in secure defaults — no config file required.
Shell/language interpreters removed from the default security.yaml, with a startup warning if one is allowlisted.
! / =! blocked as shell metacharacters.
Fixed the misleading "security disabled" startup log.

Thanks to @dodge1218, @EQSTLab and @useworld for the reports.

Breaking Changes

Secure mode is now enabled by default; without a config file, only a narrow allowlist of read-only utilities runs. To restore the previous unrestricted behavior set MCP_SHELL_ALLOW_UNSAFE=true.
Built-in secure defaults require no config file; removal of shell/language interpreters from the default security.yaml with startup warning if allowed.
`!` and `=!` are now blocked as shell metacharacters.

Security Fixes

GHSA-f5pj-2738-996m (critical) – secure mode was disabled by default in the bare‑binary install path.
GHSA-3x77-wg38-92r3 (high) – `/bin/bash` and `python3` bypassed secure mode via `bash -c` when present in the allowlist.
GHSA-74hp-mggr-hv58 (high) – git shell‑alias bypass (`git -c alias.x=!cmd`) due to missing `!` metacharacter block.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track sonirico/mcp-shell

Get notified when new releases ship.

About sonirico/mcp-shell

🪟 Give hands to AI. MCP server to run shell commands securely, auditably, and on demand on isolated environments like docker.

All releases →