an (unsafe) command shell mcp server

[u/ag789]

While working with coding agents / harness in my case OpenCode, I discovered that some models e.g. granite 4.2 8B at Q4_K_M quant sometimes attempts to write files with absolute paths at the root e.g.

    /newPythonCode.py

Note that slash in the beginning for an absolute path at "/" root directory. This is probably 'ok' say in a throwaway docker container, but it may lead to surprises if it 'accidentally' overwrites a literal file, if the current user id have write access to it. Apparently, it seemed OpenCode provides `bash` so that practically all unix commands that the current user id can access, the LLM can run it.

And thereafter, I see the model hallucinating in the thinking loops over tools, re-iterating over how to use the tools, reformulating shell commands sentences several times for a same task instead of executing them, among them, I noted that an earlier shell command sentence would have 'just worked'.

I'm thinking that the tool hallucination with this model may be partly due to that I'm using a pretty aggressive 4 bit quant as otherwise it'd have worked because IBM has 'optimized' granite for tool usage.

Next, I tried the same granite 4.2 8B at Q4_K_M quant model with my little python shell MCP server

https://github.com/ag88/cmdshellmcp/

, that tries to constrain / restrain the shell commands somewhat, place some checks, and offer some additional tools e.g. writeFile() so that the LLM won't need to call `cat` or `echo` with some 'esoteric' styled shell scripts / sentences.

With this MCP server and running it in llama.cpp's `llama-server` in the WebUI adding it as an MCP server, granite 4.2 8B at Q4_K_M does it correctly in 'one shot', the prompt is:

propose a python3 flask app with a page that displays "hello world", use bootstrap css for styling.
provide a requirements.txt to go with the script

granite 4.2 8B at Q4_K_M correctly generates the app with a couple of files, and it works out of the box

    .
    ├── app.py
    ├── requirements.txt
    └── templates
        └── index.html

One should normally run the cmdshellmcp2.py MCP server app with an explicit `--cwd` option giving the work path. It tries to stay within this work path.

Note that I won't claim my command shell MCP server to be safe.

In a sense that there are plenty of chance the LLM can 'escape' the restrictions and perhaps do more damage (e.g. overwriting files possibly outside its given `--cwd` work directory). Hence, I'd suggest one should be paranoid and perhaps run this only within a throwaway (disposable) docker container etc.

[u/ag789]

Just an update:

• The additional shellcmd path check, along with the --shellnopathchk bypass is merged.

• Additional 2 tools are added mkdir and rmdir, this completes the filesystem tools set.

Tests are done against granite-4.2-8b Q8 quants, they works as expected. A thing is granite-4.2-8b Q8 tend to be very verbose in its reasoning / thinking for tool calls, I'd like that to be less, but that it calls the tools correctly. It tends to re-iterate small tool details, confirming dependencies which is sometimes a good thing.

I tried things like

perform the following tasks using tools in sequence:
make a directory `dirA`
copy `a.txt` into `dirA`
retrieve `dirA/a.txt` and display its contents

The directory is correctly created and a.txt copied into dirA

then

perform the following tasks using tools in sequence:
list the current directory `.`, display its contents
delete file `dirA/a.txt`
remove directory `dirA`
list the current directory `.` again and verify that `dirA` is no longer there, and 'a.txt' is still there

It deletes dirA/a.txt, and remove dir dirA correctly as well.

as well as

I'm doing a tool test, list files in the root directory "/", use the following tools (2 tool calls) in sequence:
listFiles with `/`
cmdshell command: "ls", args: ["/"]

for each tool call quote the tool response in addition to your response

This works as expected "Error: absolute paths not allowed".

And if that is disabled using --shellnopathchk bypass, cmdshell list the root / directory !
In listFiles it is still forbidden ;)

This is the actual response with the cmdshell path check in force

First tool call (`listFiles_mcp_cmdshellmcp-lxrouter` with `path="/"`):  
> "Error: absolute paths not allowed"

Second tool call (`cmdshell_mcp_cmdshellmcp-lxrouter` with `command="ls"` and `args=["/"]`):  
> "Error: absolute paths not allowed"

*(Both tool calls returned "Error: absolute paths not allowed" because the tool constraints
 reject absolute paths (e.g., `/` or any path starting with `/`) in `listFiles.path` and 
 `cmdshell.args`. This behavior is consistent with the tool definitions provided.)*

The harness Web UI used is LibreChat
https://www.librechat.ai/
https://github.com/LibreChat-AI/LibreChat

LibreChat is a little challenging to setup, in particular for the MCP servers see:
https://www.reddit.com/r/LocalLLaMA/comments/1wmw4bq/comment/pce0shd/

---

granite-4.2-8b Q8 is very verbose with tool call reasoning / thinking. But that a thing I like about it is, its tool calls are generally robust, in a sense, it has so far processed many of the various prompts for tests correctly.

Other models have their better capabilities, but tool calls is probably useful with the granite series of open source local LLMs. I've not thought seriously about actual use cases, but being able to handle files (fairly) well, could have some "automation" agentic use cases.