v1.1.14 — security hardening

Security

Upgrade to 1.1.14 to receive these fixes:

• Enforce the documented safe child PATH for normal commands and every pipeline stage. POSIX command lookup no longer falls back to the server's parent PATH. Explicit PATH delegation through MCP_SHELL_CHILD_ENV_ALLOWLIST remains supported.
• Reject the known execution wrappers/runtimes setarch, strace, valgrind, deno, and bun, even when allowlisted. Reject find -ok and -okdir alongside the existing execution primaries.
• Harden tar, gtar, and bsdtar against long-option abbreviations, clustered and old-style -I/-F, additional helper options, and GNU/BSD option-grammar differences. Both dialect interpretations must pass.
• Reject Git grep pager execution, rebase execution options, filter-branch, and bisect run; retain existing external-helper rejection on other Git subcommands.
• Reject Git send-email program selectors (sendmail-cmd, to-cmd, cc-cmd, header-cmd, and program-like smtp-server values) while preserving ordinary SMTP host values and option-looking data. Recognize the command's finite three-pass option grammar under both default and POSIXLY_CORRECT modes, including invalid early-option residuals. Missing and empty SMTP server values are also rejected.

Advisories:

• Safe child PATH
• Known execution wrappers and Git/find argument policy
• Tar execution-option grammar

Compatibility

• Tools outside the default POSIX system directories must be added to MCP_SHELL_SAFE_PATH. To deliberately preserve parent/per-call PATH, explicitly allowlist PATH in MCP_SHELL_CHILD_ENV_ALLOWLIST.
• The newly denied executable names have no override, including version/attach-only invocations.
• All tar --checkpoint-action forms are denied, including non-execution actions. Numeric checkpoint intervals remain allowed. A helper option reachable under either supported tar dialect is rejected.
• git filter-branch is rejected categorically. Git grep/rebase reject unknown short options and ambiguous prefixes that could select the protected execution options.

The server is a trusted argv execution tool, not a sandbox. Command-name allowlisting and finite argument hardening do not contain every allowed program's helpers, recipes, configuration, file I/O, or network access. Untrusted inputs require least-privilege external OS/container isolation.

Thanks

Thank you @chrispham-cyber and @r3d5t0x3 for the environment and execution-policy reports; @literary-echoes, @president-xd, and @tal7aouy for the overlapping tar reports; and @eros938 and @hash3liZer for analysis. Credits remain attached to the corresponding advisories.

Install: uv tool install mcp-shell-server==1.1.14

Upgrade: uv tool upgrade mcp-shell-server

For other installation methods, pin or upgrade to mcp-shell-server==1.1.14 or later.