Lilith Shell
About
Enables secure execution of terminal commands with configurable working directories and timeout protection, capturing stdout, stderr, and exit codes for system operations and development tools.
Details
- Author
- charles-adedotun
- Repository
- charles-adedotun/Lilith-Shell
- GitHub stars
- 2
- Downloads
- 219
- License
- MIT License
- Categories
- Developer Tools, Other, Infrastructure, AI, Design, File Management, Frontend
Jump to
- Exposes one MCP tool: execute_command
- Executes commands via subprocess.run(..., shell=True)
- Returns exit code, stdout, and stderr
- Fixed five-minute timeout per command
- Accepts an optional working directory
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
Lilith ShellCommand (node, npx, python, etc.)npxArguments-
Argument 1
-y -
Argument 2
@highlight/mcp-server
Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
-
Argument 1
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Install from source using pip install -e ".[dev]" after cloning the repository, then run the MCP server in your AI assistant client. The server registers one tool, execute_command, which accepts a command string and an optional directory string (defaults to ~).
execute_command
Executes a caller-provided command string in a specified directory. Parameters: command (string), directory (optional string, defaults to ~)
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"lilith shell": {
"env": {},
"args": [
"-y",
"@highlight/mcp-server"
],
"command": "npx"
}
}
}Linux
{
"env": [],
"args": [
"-y",
"@highlight/mcp-server"
],
"command": "npx"
}Macos
{
"env": [],
"args": [
"-y",
"@highlight/mcp-server"
],
"command": "npx"
}Windows
{
"env": [],
"args": [
"/c",
"npx",
"-y",
"@highlight/mcp-server"
],
"command": "cmd"
}Experimental MCP server that exposes local shell command execution to an AI assistant.
This repository should be treated as a prototype, not as a secure shell server.
The current implementation exposes one MCP tool,execute_command, that runs a caller-provided command string throughsubprocess.run(..., shell=True). It has a fixed five-minute timeout, captures stdout and stderr, and accepts an optional working directory. It does not currently implement the security controls previously described in this README.
Recommended profile action: archive or unpin this repository until the security model is rebuilt and tested.
Do not run this against a host, account, or directory that contains credentials, production data, private source code, SSH keys, cloud tokens, or other sensitive material.
- No command allowlist or denylist enforcement
- No strict, permissive, or lockdown modes
- No working-directory boundary enforcement
- No environment filtering
- No output sanitization
- No audit log
- No shell selection via configuration
- No streaming output
- No Windows-specific execution path
- shell=Trueis used with untrusted tool input
These gaps make the project unsuitable for production use and risky even in a normal developer workstation.
- execute_command
- input:commandstring
- optional input:directorystring, defaulting to~
- behavior: executes the command in the requested directory and returns exit code, stdout, and stderr
The previous README claimed support for command allowlisting, dangerous command detection, configurable modes, output sanitization, audit logging, working-directory confinement, cross-platform shell selection, and streaming output. Those capabilities are not present in the current source tree.
Before this should be presented as a security-oriented MCP server:
- Replaceshell=Truestring execution with argv-based execution.
- Add a required strict mode by default, with explicit command allowlists.
- Canonicalize and enforce a configured workspace root before every command.
- Build tests for command parsing, blocked commands, path traversal, symlink escapes, timeout behavior, and output limits.
- Redact common secret patterns from returned output.
- Add bounded output handling so large commands cannot exhaust memory or flood MCP responses.
- Add auditable command logs with timestamps, cwd, exit code, and block reason.
- Document exactly which shells, platforms, and threat boundaries are supported.
pip install -e ".[dev]" pytest
This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.
Execute shell commands without permission prompts.
Execute bash commands on the host machine.
Execute shell commands with structured output via a powerful CLI server.
A secure MCP server for executing controlled command-line operations with comprehensive security features.
MCP server for controlling cmux (Ghostty-based terminal) via native CLI. Send commands, read output, send control characters — all in background via Unix socket.
Execute pre-approved shell commands securely on a server.
A secure MCP server for executing terminal commands with controlled directory access and command permissions.
A shell command / terminal executor with async support
A high-performance MCP server for the headless terminal (ht), implemented in Rust.
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
