Mcp-Shell - CraftedSignal Threat Feed

MCP-Shell Secure Mode Allowlist Bypass via Shell Interpreter

hello@craftedsignal.io — Tue, 25 Aug 2026 16:02:16 +0000

The mcp-shell utility, often deployed as an MCP (Model Context Protocol) tool, contains a critical security flaw in its secure mode validation logic. By default, the application ships with a security.yaml configuration that includes /bin/bash in its allowed_executables allowlist. The application's validation function, located in security.go, performs command authorization by splitting input strings on whitespace and evaluating only the first token (the executable) against the allowlist.

Because the validator fails to inspect subsequent arguments or identify shell command-mode flags, an attacker can supply a command payload such as /bin/bash -c . The application validates the first token (/bin/bash), confirms it is on the allowlist, and proceeds to execute the full command string via exec.CommandContext. This results in the execution of unapproved binaries and shell scripts within the container environment under the mcpuser identity. The vulnerability is present in the official Docker image and requires no authentication or server configuration changes to exploit.

Attack Chain

Attacker identifies an MCP tool interface exposing the shell_exec function.
Attacker prepares a JSON-RPC request to the tools/call method with name set to shell_exec.
Attacker sets the command argument to /bin/bash -c (e.g., /bin/bash -c id).
The application receives the input in handler.go and triggers the validation logic in security.go.
security.go splits the input string and identifies the executable as /bin/bash, which passes the allowlist check.
The checkBlockedPatternsAndCommands function fails to identify the -c flag as a security risk, returning a successful validation state.
The full command string is passed to executor.go, which invokes exec.CommandContext with the provided arguments.
The container executes the malicious payload via the shell interpreter, granting the attacker arbitrary command execution.

Impact

Successful exploitation results in arbitrary OS command execution (CWE-78) within the container's environment. Attackers can leverage the installed base of binaries (e.g., curl, wget, grep, sed) to perform data exfiltration, read sensitive files accessible to mcpuser, modify the container's writable filesystem, or pivot to other network-accessible resources. The impact is elevated for production environments where these containers are used to bridge LLM agents with internal infrastructure.

Recommendation

Remove shell interpreters (e.g., /bin/bash, /bin/sh, /bin/dash) from the allowed_executables list in security.yaml to prevent command-mode injection.
Implement argument-level validation in security.go to explicitly deny common shell command-mode flags (such as -c) when a shell interpreter is used.
Upgrade to a patched version of mcp-shell that incorporates regex-based argument validation for sensitive binaries.
Review and harden the container's entrypoint and environment variables to ensure that only the minimum necessary binaries are present in the runtime image.

mcp-shell Insecure Configuration and Allowlist Bypass

hello@craftedsignal.io — Tue, 25 Aug 2026 16:02:06 +0000

mcp-shell, a tool designed to provide shell execution capabilities to Large Language Models (LLMs) via the Model Context Protocol (MCP), contains two critical configuration flaws that negate its security controls. First, the application ships with security features disabled by default in config.go. Unless an operator explicitly defines the MCP_SHELL_SEC_CONFIG_FILE environment variable, the validateCommand function short-circuits and allows all incoming commands without restriction. Second, the default security.yaml configuration included in the Docker image provides an insecure allowlist containing shell interpreters such as /bin/bash and /usr/bin/python3.

These flaws enable an LLM connected to the mcp-shell server to execute arbitrary commands on the underlying system. The attack surface is significant because mcp-shell operates via stdio transport; an attacker (or a compromised/misaligned LLM agent) can issue shell_exec calls that bypass validation either due to the "disabled by default" state or by abusing allowed interpreters to execute nested command strings, effectively bypassing metacharacter filters. These vulnerabilities affect all deployments prior to version 0.6.0, including source-based and official container-based installations.

Attack Chain

The operator deploys mcp-shell using default installation steps (git clone or official Docker image).
The operator fails to explicitly set the MCP_SHELL_SEC_CONFIG_FILE environment variable, leaving the security module in a disabled state (Finding 1) OR the operator uses the default security.yaml which permits shell interpreters (Finding 2).
The attacker (e.g., a malicious or poisoned LLM) establishes a session with the mcp-shell server over the stdio transport.
The attacker sends a tools/call request to the mcp-shell server specifying the shell_exec method.
The server process receives the command request; if security is disabled, it proceeds directly to system execution.
If in "secure mode" with an insecure allowlist, the attacker executes /bin/bash -c '' which the server permits because /bin/bash is on the allowlist and the string contains no forbidden metacharacters.
The server process spawns the interpreter, which in turn executes the embedded malicious payload.
The attacker achieves arbitrary code execution on the host with the privileges of the mcp-shell process.

Impact

Successful exploitation allows for full arbitrary command execution on the host system running mcp-shell. Given that mcp-shell is designed to interact with LLMs, this can result in unauthorized data exfiltration, system configuration changes, and lateral movement from the host. Because the threat model involves LLMs acting as the agent, the vulnerability is reachable without network-level access, provided the LLM has been tricked or configured to invoke the shell_exec tool.

Recommendation

Upgrade mcp-shell to version 0.6.0 or higher immediately to address the insecure default configurations and updated example allowlists.
For existing deployments, manually create a restrictive security.yaml that excludes all shell interpreters (e.g., bash, sh, python, perl, ruby) and enforce Enabled: true in the configuration.
Set the MCP_SHELL_SEC_CONFIG_FILE environment variable explicitly in all deployment environments (including Kubernetes/Docker orchestrators) to ensure validation is active.
Implement strict sandboxing (e.g., Docker containers with minimal capabilities or separate namespaces) for mcp-shell processes as a layer of defense-in-depth, acknowledging that sandboxing does not mitigate the primary vulnerability of unauthorized intra-session command execution.