Part of the StudioMeyer MCP Stack — Built in Mallorca 🌴 · ⭐ if you use it

mcp-stdio-shellguard

Defense-in-depth bundle for MCP stdio servers. Wraps `child_process.exec/spawn`

with allowlist + sandbox + replay-detection, plus an AST audit CLI (mcp-shellguard-audit) that scans MCP server sources for unsanitized shell calls. Closes the Ox-Security MCP stdio-RCE class (200k vulnerable servers, May 2026 disclosure).

• MCP spec: 2025-06-18
• SDK: @modelcontextprotocol/sdk ^1.29.0
• Node: >= 20
• License: MIT
• Author: Matthias Meyer (StudioMeyer)

Install

npm install mcp-stdio-shellguard

Or run the audit CLI directly without installing:

npx -y -p mcp-stdio-shellguard mcp-shellguard-audit scan ./src

What it gives you

Three layers, opt-in piecewise:

1. Library API — drop-in guardExec / guardSpawn you call from your own MCP server. Default-deny allowlist, sandbox profiles, replay window.
2. Audit CLI — mcp-shellguard-audit scan <path> walks the AST, reports 12 anti-patterns from LOW (no timeout) to CRITICAL (exec(\...${userInput}...`)`).
3. Reference MCP server — mcp-stdio-shellguard-demo exposes 8 tools so the MCP Inspector / Claude Desktop can drive the bundle directly.

Tools (reference server)

Tool	Type	Purpose
guard_exec	destructive	Defended child_process.exec. Forces args[] vector, allowlist + sandbox + replay. Returns stdout, stderr, exitCode, canonicalHash, isReplay, trustTier.
guard_spawn	destructive	Defended child_process.spawn. Returns SHA-256 hashes of stdout/stderr instead of full bodies. Hard-rejects shell:true.
register_allowlist	mutating	Register a tool name with executable + args regex. Without registration the default-deny applies.
audit_source	read-only	Scan a TS/JS path for shell-injection anti-patterns. Returns AuditFinding[] + summary.
audit_report	read-only	Format an audit result as markdown / json / SARIF 2.1.0.
replay_check	read-only	Compute canonical SHA-256 hash for an invocation and report whether it's already in the replay window.
sandbox_status	read-only	Report active sandbox profile + concrete limits + cgroup-v2 active flag.
trust_tier	read-only	Derive LOW/MEDIUM/HIGH/CRITICAL tier for a registered tool plus improvement hints.

Sandbox profiles

Profile	Timeout	Max stdout	Max stderr	FD budget	cgroup-v2
strict	5 s	1 MB	256 KB	32	yes (cpu/memory)
standard (default)	30 s	10 MB	1 MB	256	yes
permissive	5 min	100 MB	10 MB	1024	no

Caller can tighten via timeoutMs / fdBudget per call. Caller cannot widen beyond the profile.

Trust tiers

Tier	Condition
LOW	tool not registered (default-deny)
MEDIUM	registered but argsPatterns empty (any args allowed)
HIGH	argsPatterns set but sandbox or replay

... View full README on GitHub