SSH

• v1.1.14 — security hardening v1.1.14 Latest Oct 19, 2026

  ## Security
  
  Upgrade to **1.1.14** to receive these fixes:
  
  - Enforce the documented safe child `PATH` for normal commands and every pipeline stage. POSIX command lookup no longer falls back to the server's parent `PATH`. Explicit `PATH` delegation through `MCP_SHELL_CHILD_ENV_ALLOWLIST` remains supported.
  - Reject the known execution wrappers/runtimes `setarch`, `strace`, `valgrind`, `deno`, and `bun`, even when allowlisted. Reject `find -ok` and `-okdir` alongside the existing execution primaries.
  - Harden `tar`, `gtar`, and `bsdtar` against long-option abbreviations, clustered and old-style `-I`/`-F`, additional helper options, and GNU/BSD option-grammar differences. Both dialect interpretations must pass.
  - Reject Git grep pager execution, rebase execution options, `filter-branch`, and `bisect run`; retain existing external-helper rejection on other Git subcommands.
  - Reject Git send-email program selectors (`sendmail-cmd`, `to-cmd`, `cc-cmd`, `header-cmd`, and program-like `smtp-server` values) while preserving ordinary SMTP host values and option-looking data. Recognize the command's finite three-pass option grammar under both default and `POSIXLY_CORRECT` modes, including invalid early-option residuals. Missing and empty SMTP server values are also rejected.
  
  Advisories:
  - [Safe child PATH](https://github.com/tumf/mcp-shell-server/security/advisories/GHSA-x97g-5v53-g5cq)
  - [Known execution wrappers and Git/find argument policy](https://github.com/tumf/mcp-shell-server/security/advisories/GHSA-g5pp-52qm-8mp8)
  - [Tar execution-option grammar](https://github.com/tumf/mcp-shell-server/security/advisories/GHSA-3g42-7xr6-4x77)
  
  ## Compatibility
  
  - Tools outside the default POSIX system directories must be added to `MCP_SHELL_SAFE_PATH`. To deliberately preserve parent/per-call `PATH`, explicitly allowlist `PATH` in `MCP_SHELL_CHILD_ENV_ALLOWLIST`.
  - The newly denied executable names have no override, including version/attach-only invocations.
  - All `tar --checkpoint-action` forms are denied, including non-execution actions. Numeric checkpoint intervals remain allowed. A helper option reachable under either supported tar dialect is rejected.
  - `git filter-branch` is rejected categorically. Git grep/rebase reject unknown short options and ambiguous prefixes that could select the protected execution options.
  
  The server is a **trusted argv execution tool, not a sandbox**. Command-name allowlisting and finite argument hardening do not contain every allowed program's helpers, recipes, configuration, file I/O, or network access. Untrusted inputs require least-privilege external OS/container isolation.
  
  ## Thanks
  
  Thank you @chrispham-cyber and @r3d5t0x3 for the environment and execution-policy reports; @literary-echoes, @president-xd, and @tal7aouy for the overlapping tar reports; and @eros938 and @hash3liZer for analysis. Credits remain attached to the corresponding advisories.
  
  Install: `uv tool install mcp-shell-server==1.1.14`
  
  Upgrade: `uv tool upgrade mcp-shell-server`
  
  For other installation methods, pin or upgrade to `mcp-shell-server==1.1.14` or later.
  

  View on GitHub ↗
• v1.1.13 Oct 14, 2026

  ## Fixed
  
  - Report non-zero exits from single commands as MCP errors, preserving exit status and stdout/stderr in the client response (#61).
  - Keep failed-command output out of server logs and add a regression test for this boundary.
  
  ## Operator guidance
  
  - Clarify that command-name allowlisting is trusted execution, not a complete sandbox. Allowed programs run with the server process's OS authority; untrusted inputs require external OS/container isolation.
  - Emit one startup warning on stderr without changing MCP stdout framing.
  
  Commands such as `grep` (no match, exit 1) and `diff` (differences, exit 1) now also produce `isError: true`. Successful command output is unchanged. Pipeline failure handling is unchanged.
  
  Thanks to @PseudoSky for #61 and its regression tests.
  
  Install: `uv tool install mcp-shell-server==1.1.13`
  Upgrade: `uv tool upgrade mcp-shell-server`
  
  Local verification: 369 tests, formatter/linter/type checks, package build, strict distribution metadata checks, and a fresh-wheel MCP stdio smoke test. OpenSpec validation passed all eight specs with one pre-existing long-requirement warning.
  

  View on GitHub ↗
• v1.1.12 Sep 19, 2026

  Security release: reject persistent `git config` invocations prefixed by the value-taking `--attr-source` or `--shallow-file` global options. These parser mismatches could bypass the existing policy and persist an executable Git alias.
  
  Affected versions: `<= 1.1.11`. Upgrade to `1.1.12` or later.
  
  Advisory: https://github.com/tumf/mcp-shell-server/security/advisories/GHSA-7v25-vcp6-4hcr

  View on GitHub ↗
• v1.1.11 Sep 18, 2026

  ## Security
  
  - Reject GNU awk `@nsinclude` external program-source directives.
  - Complete the AWK hardening tracked in [GHSA-8wm7-jvxq-2r3m](https://github.com/tumf/mcp-shell-server/security/advisories/GHSA-8wm7-jvxq-2r3m).
  - Preserve option-parser state for `--`, inline program boundaries, and values consumed by safe options.
  
  Versions `<=1.1.10` are affected. Upgrade to `1.1.11` or later.
  

  View on GitHub ↗
• v1.1.10 Sep 18, 2026

  ## Security
  
  - Reject AWK program-source and extension-loading options that bypass argv program inspection, including GNU long options, accepted abbreviations, short forms and clusters, `-W` aliases, and `@include`/`@load` directives.
  - Fixes [GHSA-8wm7-jvxq-2r3m](https://github.com/tumf/mcp-shell-server/security/advisories/GHSA-8wm7-jvxq-2r3m).
  
  Versions `<=1.1.9` are affected. Upgrade to `1.1.10` or later.
  

  View on GitHub ↗

No comments yet. Sign in to start the discussion.

More System servers

• Shell

  Run arbitrary shell commands — full control of the host with configurable allow/deny lists.

• Docker

  Manage Docker containers, images, and networks — full CLI surface as MCP tools.

• Kubernetes

  Inspect + modify Kubernetes resources — pods, deployments, services, ConfigMaps, secrets.