mcp-shell Insecure-by-Default Command Execution

Technical Analysis

The vulnerability stems from config.go initializing Security.Enabled to false and main.go proceeding to start the shell_exec tool without loading a security policy when MCP_SHELL_SEC_CONFIG_FILE is unset. SecurityValidator.validateCommand then short-circuits validation entirely, meaning any command string passed to shell_exec via the MCP stdio transport is executed unchecked. The entry point is the MCP tool-call interface itself: an LLM agent (whether manipulated via prompt injection, a poisoned upstream instruction, or simply operating on untrusted input) can invoke shell_exec with attacker-controlled or attacker-influenced command strings and gain arbitrary OS-level code execution as the mcp-shell process user. Because the insecure configuration matches the documented from-source install and default MCP client config, this is not a misconfiguration edge case but the standard deployment path, making the tool-layer boundary between the LLM and the host OS effectively non-existent.

Affected Systems

mcp-shell; protocols: MCP

Detection Signatures

• Absence of MCP_SHELL_SEC_CONFIG_FILE environment variable in mcp-shell deployment
• Security.Enabled=false in mcp-shell runtime config or logs
• shell_exec tool invocations containing shell metacharacters, chained commands, or unexpected binaries (e.g. curl, wget, nc, bash -c)
• mcp-shell process spawning child processes outside an expected allow-list
• Versions of mcp-shell prior to 0.6.0 in dependency manifests or container images

Remediation Steps

1. 1

   Upgrade mcp-shell

   Update to mcp-shell version 0.6.0 or later, which fixes the insecure default.

2. 2

   Explicitly enable security policy

   Set MCP_SHELL_SEC_CONFIG_FILE and configure Security.Enabled=true with an explicit command allow-list before deploying, even on pre-0.6.0 versions.

3. 3

   Restrict process privileges

   Run mcp-shell under a least-privileged, sandboxed user/container to limit blast radius if command validation is ever bypassed.

4. 4

   Audit tool exposure

   Review all MCP servers exposing shell/OS command execution tools to LLM agents and confirm they require authentication, allow-listing, and logging before enabling shell_exec-style capabilities.

5. 5

   Monitor and log tool calls

   Enable detailed logging of shell_exec invocations and alert on anomalous commands or unexpected child processes.