Log inSubmit server
MCP stdio ShellGuard logo

MCP stdio ShellGuard

Guards Node.js process execution with allowlists, sandboxing, replay checks, and AST-based shell-injection audits.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install MCP stdio ShellGuard

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "mcp-stdio-shellguard": {
      "command": "npx",
      "args": [
        "-y",
        "-p",
        "mcp-stdio-shellguard",
        "mcp-shellguard-audit"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

npx -y -p mcp-stdio-shellguard mcp-shellguard-audit

No response to initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 3d ago.

Overview

MCP stdio ShellGuard provides guarded wrappers for Node.js `child_process.exec` and `child_process.spawn`, with default-deny allowlists, sandbox limits, and replay detection. Its reference MCP server exposes execution controls, trust assessment, sandbox status, and source-audit tools for TypeScript and JavaScript paths. The companion CLI scans server code for shell-injection anti-patterns and can emit Markdown, JSON, or SARIF 2.1.0 reports. Reach for it when an MCP stdio server needs controlled subprocess execution and security checks in development or CI.

Use cases

  • Wrap MCP subprocess calls with default-deny execution rules
  • Scan TypeScript or JavaScript MCP sources for shell-injection patterns
  • Gate CI builds on audit findings above a chosen severity
  • Check repeated invocations before allowing execution
  • Inspect sandbox limits and tool trust tiers

Key features

  • Allowlisted `exec` and `spawn` wrappers
  • Default-deny executable registration
  • Strict, standard, and permissive sandbox profiles
  • Replay-window checks with canonical SHA-256 hashes
  • AST scanning for twelve shell-injection anti-patterns
  • Markdown, JSON, and SARIF 2.1.0 audit reports

Tools8

What MCP stdio ShellGuard lets your agent do. Expand a tool for its parameters.

Self-reported~221 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 2d ago

Recent health check succeeded.

11/11 checks healthy over the last 55d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 4d ago via OSV.dev · mcp-stdio-shellguard (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

npm downloads483Package downloads in the last 30 days.
Last commit6d agoMost recent push to the default branch.
Install checkInconclusiveDidn't respond in our test window — often a slow first install.
Tools exposed8Callable tools this server registers over MCP.

How MCP stdio ShellGuard works

What MCP stdio ShellGuard does

MCP stdio ShellGuard adds controls around subprocess execution in Node.js MCP servers. Its library API provides guarded alternatives to child_process.exec and child_process.spawn, while its reference MCP server makes those controls available as MCP tools.

Execution is governed by a registered executable and argument allowlist. Unregistered tools are denied by default. Guarded calls also use sandbox profiles and a replay window, allowing the result to include a canonical SHA-256 invocation hash, replay status, and a derived trust tier.

The package also includes an AST-based audit CLI and an MCP audit tool. These inspect TypeScript and JavaScript source for unsafe shell-call patterns, including dynamic commands, shell-enabled process options, risky argument construction, missing timeouts, and unbounded output buffers.

How it works

Register each permitted tool with an executable and optional argument regular expressions. A call through guardExec or guardSpawn then checks the registration, applies the selected sandbox profile, and evaluates the invocation against the replay window. Callers may reduce the timeout or file-descriptor budget for an individual invocation, but cannot raise those values above the profile limits.

The default standard profile allows a 30-second timeout, 10 MB of stdout, 1 MB of stderr, and 256 file descriptors. strict reduces those limits to 5 seconds, 1 MB of stdout, 256 KB of stderr, and 32 file descriptors. permissive allows up to 5 minutes, 100 MB of stdout, 10 MB of stderr, and 1,024 file descriptors. cgroup-v2 controls are active for the strict and standard profiles.

The audit scanner parses source code and reports findings by severity. It resolves renamed child_process imports and bindings, and covers synchronous process variants as well as asynchronous calls. Findings can be filtered by severity for CI use.

Setup and configuration

Install the package with npm:

Terminal
npm install mcp-stdio-shellguard

The audit command can also run without a project installation:

Terminal
npx -y -p mcp-stdio-shellguard mcp-shellguard-audit scan ./src

The CLI supports output formats including SARIF and accepts an output path. Its exit status is 0 for a clean scan at the selected severity floor, 1 when findings meet that floor, and 2 for parsing or I/O errors.

Library consumers create an allowlist registry and replay window, register an executable such as Git with permitted argument patterns, and pass both objects to a guarded execution call. The package targets Node.js 20 or newer and follows the MCP specification dated 2025-06-18.

Tools and capabilities

The reference MCP server exposes:

  • guard_exec for defended child_process.exec calls, returning process output, exit status, hash, replay state, and trust tier.
  • guard_spawn for defended child_process.spawn calls. It rejects shell: true and returns SHA-256 hashes for stdout and stderr.
  • register_allowlist for adding an executable and argument patterns to the registry.
  • audit_source for scanning a TypeScript or JavaScript path.
  • audit_report for formatting audit results as Markdown, JSON, or SARIF 2.1.0.
  • replay_check for checking whether an invocation hash is already in the replay window.
  • sandbox_status for reporting the active profile, limits, and cgroup-v2 state.
  • trust_tier for assigning LOW through CRITICAL status and returning improvement hints.

The scanner recognizes twelve anti-pattern categories, ranging from missing timeouts to dynamic command strings and shell-enabled execution. shellguard:ignore-next-line suppresses one finding, while shellguard:ignore-file suppresses a complete file.

Limitations and notes

The reference server is one way to drive the package; the library API is intended for integration into an MCP server's own code. Allowlist registrations with no argument patterns receive a lower trust tier because any arguments are accepted. The scanner's ignore-glob input is bounded to 128 strings, with length and grouping-character limits.

guard_spawn returns hashes rather than complete stdout and stderr bodies. Sandbox limits cannot be widened per call, and the permissive profile does not use cgroup-v2 controls. The package bundles parser dependencies, which increases its archive and unpacked size and means dependency security updates require a new package archive.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about MCP stdio ShellGuard

MCP stdio ShellGuard is an MCP server that connects agent workflows to guarded Node.js child-process execution and TypeScript/JavaScript source auditing. Its main tools include `guard_exec`, `guard_spawn`, `register_allowlist`, `audit_source`, `audit_report`, `replay_check`, `sandbox_status`, and `trust_tier` for controlled execution and security review.

Install it with `npm install mcp-stdio-shellguard`. To run the audit CLI without adding the package to a project, use `npx -y -p mcp-stdio-shellguard mcp-shellguard-audit scan ./src`. The package requires Node.js 20 or newer.

Run `mcp-shellguard-audit scan ./src` against the source directory. Add `--severity-floor HIGH` to use the scan as a CI gate, or `--format sarif --output audit.sarif` to write a SARIF report. The scanner checks TypeScript and JavaScript AST patterns.

Yes, it can be used with Cursor as a standard stdio MCP server. The reference server is also described for Claude Desktop, and its tools can be driven by MCP-compatible clients that support stdio configuration.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewMCP stdio ShellGuard AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/mcp-stdio-shellguard?style=directory)](https://allmcps.com/mcp/mcp-stdio-shellguard)
HTML Embed
<a href="https://allmcps.com/mcp/mcp-stdio-shellguard"><img src="https://allmcps.com/api/badge/mcp-stdio-shellguard?style=directory" alt="MCP stdio ShellGuard on AllMCPs" /></a>