mcp_command_server
Provides a JSON-RPC 2.0 HTTP API for executing shell commands on a server, with a pattern-based command exclusion/validation system (configured via exclude.yaml) and a /context endpoint that serves markdown API documentation.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
Security relies primarily on command pattern exclusion plus container non-root execution. The README does not describe TLS requirements, authentication/authorization, rate limiting, auditing, or input handling details beyond regex/pattern filtering. The presence of a cited 'whitespace injection' CVE is a positive sign of active security maintenance, but details are not independently verifiable from the provided content. Because this is remote command execution, any weaknesses in filtering or deployment controls can create critical risk.
⚡ Reliability
Best When
When the command set is tightly controlled via exclude.yaml (or equivalent configuration) and the service is placed behind a trusted network boundary (e.g., internal only) with monitoring and operational guardrails.
Avoid When
When exposing the service to untrusted users/agents, or when you cannot enforce network-level access restrictions and robust command allow/deny policies.
Use Cases
- • Running predefined/approved operational shell commands from an AI agent or automation client
- • On-prem/containerized remote command execution with pre-execution allow/deny filtering
- • Integrating command execution into systems that speak JSON-RPC 2.0
- • Providing self-documented endpoints for tooling via /context
Not For
- • General-purpose unrestricted remote shell access
- • Executing untrusted commands without strict allowlists and hardened hosting
- • Running in environments requiring strong authentication/authorization guarantees (no auth described)
Interface
Authentication
No authentication/authorization mechanism is described in the provided README (requests appear to be sent directly to http://localhost:3030/).
Pricing
Open-source (MIT) repository; no pricing information provided.
Agent Metadata
Known Gotchas
- ⚠ Command execution endpoints are inherently high-risk; agents should not attempt to bypass validation or craft shell payloads beyond the intended safe subset.
- ⚠ The service relies on pattern filtering (exclude.yaml). Overly broad exclusions or gaps in patterns can lead to either denial of legitimate commands or accidental acceptance of harmful ones.
- ⚠ No auth is documented; agents should assume you must secure network access and deployment configuration separately.
Alternatives
Full Evaluation Report
Comprehensive deep-dive: security analysis, reliability audit, agent experience review, cost modeling, competitive positioning, and improvement roadmap for mcp_command_server.
AI-powered analysis · PDF + markdown · Delivered within 30 minutes
Package Brief
Quick verdict, integration guide, cost projections, gotchas with workarounds, and alternatives comparison.
Delivered within 10 minutes
Score Monitoring
Get alerted when this package's AF, security, or reliability scores change significantly. Stay ahead of regressions.
Continuous monitoring
Scores are editorial opinions as of 2026-04-04.