An MCP server (stdio, Python stdlib only) with one tool, run: a bash command, its exit code and its output. Gives any MCP client's model a terminal.

python3 shellmcp.py [--mode readonly|all] [--cwd DIR] [--timeout 60] [--max-output 8000] [--hide PATH]...

--mode readonly (default): every command runs in bubblewrap. The filesystem is read-only except a private /tmp; no network; no other processes visible; ~/.ssh, ~/.gnupg and each --hide PATH look empty. Needs bwrap.
--mode all: the user's full permissions (here: wheel and docker, so effectively root). Use it only with a client that asks before each tool call.

The tool description names the host, user, directory, limits and which modern tools (rg, fd, jq, ...) are installed, so the model prefers them.

Where commands run

Wherever this process runs. The client starts it (stdio), so with "command": "python3" the commands run on the client's machine. To act on the GPU host from any machine, start it over ssh (key login needed):

"command": "ssh", "args": ["fabian@192.168.2.169", "python3", "/home/fabian/coding/misc/shellmcp/shellmcp.py", "--mode", "readonly"]

Clients

ollmcp with gemma4 on vLLM (examples/ollmcp.json registers shell and shell-rw):

ollmcp -p openai -H http://127.0.0.1:8000/v1 -m gemma4 -j examples/ollmcp.json

Claude Code:

claude mcp add shell -- python3 /home/fabian/coding/misc/shellmcp/shellmcp.py --mode readonly

OpenAI-API apps without MCP (Open WebUI and the like): wrap it as an OpenAPI server with uvx mcpo --port 8001 -- python3 shellmcp.py --mode readonly.

Test

python3 -m unittest -v test_shellmcp