# Simple Mcp

> A simple Model Context Protocol server in Go configurable to use shell commands.

- **Type:** MCP server
- **Install:** `agentstack add mcp-vojtechpavlik-simple-mcp`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [vojtechpavlik](https://agentstack.voostack.com/s/vojtechpavlik)
- **Installs:** 0
- **Category:** [Integrations](https://agentstack.voostack.com/c/integrations)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [vojtechpavlik](https://github.com/vojtechpavlik)
- **Source:** https://github.com/vojtechpavlik/simple-mcp

## Install

```sh
agentstack add mcp-vojtechpavlik-simple-mcp
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# **Simple shell-interface MCP Server (simple-mcp)**

simple-mcp is a Model Context Protocol (MCP) server designed interface basic
Linux shell command line commands to LLM-based agents. It is built using Go and
the [mcp-go](https://github.com/mark3labs/mcp-go) library.

## **Prerequisites**

* **Go 1.23+** (for building)
* **mcphost** (or another MCP-compliant client)
* **Ollama** (or another LLM provider) running a capable model
  (e.g., qwen3-coder, llama3).

## **Building**

To build the server and CLI binary:

make

This will produce the `simple-mcp` and `simple-mcp-cli` binaries in the
current directory.

## **Command Line Options**

* `-config `: Path to the YAML configuration file
  (default: `./simple-mcp.yaml`).
* `-listen-addr `: The network address and port to listen on
  (default: `localhost:8080`). The server will expose multiple standard MCP
  endpoints: `/mcp` (multiplexed), `/sse` (dedicated SSE), and `/messages`
  (dedicated Streamable HTTP).
* `-tmpdir `: Path to a directory for the scratch space. Enabling this
  enables file manipulation tools.
* `-verbose`: Enable verbose logging of MCP protocol messages.
* `-max-async-tasks `: Maximum number of asynchronous tasks to keep in
  memory (default: 20).
* `-transport `: Transport method for MCP. Options: `auto` (default), `sse`,
  `http` (Streamable HTTP), or `stdio`.

## **Configuration**

The server is configured via `simple-mcp.yaml`. The `spec` section supports the
following global options:

* `listenAddr`: Same as `-listen-addr`.
* `tmpDir`: Same as `-tmpdir`.
* `verbose`: Same as `-verbose`.
* `maxAsyncTasks`: Same as `-max-async-tasks`.
* `transport`: Same as `-transport`.

The `spec` section also defines:

* **Resources:** Data endpoints the LLM can read.
  * `uri`: The unique identifier for the resource.
  * `description`: A human-readable description.
  * `content`: Static text content.
  * `contentFile`: Path to a file whose content will be loaded (relative to the
    config file).
  * `directory`: Path to a directory whose entire subtree of files will be added
    as individual resources. The file's relative path will be appended to the
    resource URI.
  * `command`: A shell command to execute to generate dynamic content.
  * `intervalSeconds`: Suggested refresh interval for the client.
* **Tools:** Executable commands exposed to the LLM.
  * `name`: The name of the tool.
  * `description`: What the tool does.
  * `command`: The shell command to run. If the path points to an executable
    file (e.g. a script with a shebang), it is executed directly. Otherwise, it
    is executed as a shell command (`sh -c`) with `set -o pipefail` enabled by
    default. Supports Go template syntax (e.g., `{{.paramName}}`).
  * `parameters`: A list of parameter names the tool accepts.
  * `envVars`: A list of environment variable names to pass from the host.
    **Note:** Commands now run in a clean environment by default; you must
    explicitly list any host environment variables needed.
  * `ignoreExitCodes`: A list of return codes to consider as success.
  * `async`: If true, the tool runs in the background and returns a task URI for
    monitoring.
  * `timeoutSeconds`: Maximum execution time for the command (default: 30s).

### **Generating Configurations with LLMs**

You can use an LLM to generate secure, hardened configurations for `simple-mcp`.
The [`llm-config-generation/`](./llm-config-generation/) directory contains a
specialized system prompt and examples that can turn an LLM into a "Security
Architect" for your MCP setup.

See the [llm-config-generation README](./llm-config-generation/README.md) for
detailed instructions.

### **Parameter Validation**

Tool parameters can be validated before execution by specifying their `type`
and/or a `validator` regular expression:

* **`type`**:
  * `path`: A valid shell path (no unescaped spaces or control characters).
  * `directory`: An existing directory on the host.
  * `file`: An existing file on the host.
  * `number`: A valid number.
  * `integer`: A valid integer.
  * `word`: An alphanumeric string without spaces.
  * `filename`: A valid filename without path separators.
  * `tmpDir`: An existing directory within the scratch space.
  * `tmpFile`: An existing file within the scratch space.
* **`validator`**: A regular expression that the parameter value must match.

Example:

```yaml
  tools:
    - name: GetServiceLogs
      command: "journalctl -u {{.serviceName}} -n 10"
      parameters:
        - name: serviceName
          type: word
          validator: "^[a-z0-9.-]+$"
```

## **Built-in Capabilities**

* **Resource Search:** The server provides a built-in `SearchResources` tool
  that allows the LLM to search through all resource URIs, descriptions, and
  static content using regular expressions.
* **Async Tasks:** Tools marked as `async: true` will run in the background.
  The server provides `ListPendingTasks` and `TaskStatus` tools to monitor
  these jobs. The total number of tasks in memory is limited by `maxAsyncTasks`.
  If the limit is reached, starting a new task will evict the oldest completed
  or failed task. If all slots are filled with active (pending or running)
  tasks, new asynchronous tasks will fail until a slot becomes available.

## **Scratch Space**

When the `-tmpdir` flag or `tmpDir` configuration option is set, `simple-mcp`
provides a set of tools to the LLM for manipulating files within that
directory. This includes creating, reading, deleting, and modifying files
(using regex search-and-replace), as well as copying resources into the
scratch space.

## **CLI Tool (simple-mcp-cli)**

A command-line client is provided for testing and interacting with the server:

* `make inspect`: Launch the interactive MCP Inspector UI (requires Node.js/npx).
* `simple-mcp-cli list-tools`: List all available tools.
* `simple-mcp-cli show-tool `: Show description of a tool.
* `simple-mcp-cli list-resources`: List all available resources.
* `simple-mcp-cli show-resource `: Show description of a resource.
* `simple-mcp-cli resource `: Read the content of a resource.
* `simple-mcp-cli tool  [--param value]...`: Call a tool with parameters.

### **CLI Options**

* `--server `: The address or full URL of the MCP server
  (default: `localhost:8080`). If a path is omitted, `/mcp` is used.
* `--transport `: Transport method to use (`sse`, `http`, or `stdio`).
* `--command `: For `stdio` transport, the command and arguments to run.
  Can be specified multiple times.

### **Examples**

* **SSE (default):** `simple-mcp-cli --server localhost:8080 list-tools`
* **Custom Path:** `simple-mcp-cli --server http://localhost:8080/sse list-tools`
* **Streamable HTTP:**
  `simple-mcp-cli --transport http --server localhost:8080 list-tools`
* **Stdio:**
  `simple-mcp-cli --transport stdio --command ./simple-mcp`
  `--command --transport --command stdio list-tools`

## **Security & Remote Access**

**Important:** This tool provides shell execution capabilities. Do not expose
this service to the public internet without authentication.

### **Non-Root Execution**

It is highly recommended to run `simple-mcp` as a dedicated non-root user (e.g.,
`simple-mcp`). The provided `simple-mcp.service` is configured to run as this
user and uses Systemd's hardening features to limit the process's capabilities.

If your tools require specific privileges (like `iptables` or `dmesg`), you
should grant them via `AmbientCapabilities` in the service file rather than
running the entire server as root.

### **Restricting Network Access**

By default, simple-mcp binds to localhost:8080, allowing only local connections.

The Model Context Protocol (MCP) does not implement authentication itself. If you
need to use simple-mcp outside of the machine it is running on, it is
highly recommended to use a **standard reverse proxy** (like Nginx, Apache,
Caddy, or Traefik) to handle:

* **TLS/SSL Encryption:** To protect data in transit.
* **Authentication:** To restrict access to authorized users (e.g., Basic
    Auth, OAuth2, OIDC).

### **Example: Nginx with Basic Auth**

Comprehensive examples for various reverse proxies can be found in the
[`webauth-examples/`](./webauth-examples/) directory:

* **Nginx:** [Basic Auth](./webauth-examples/nginx-basic-auth.conf), [OAuth2/OIDC](./webauth-examples/nginx-oauth2-proxy.conf)
* **Apache:** [Basic Auth](./webauth-examples/apache-basic-auth.conf), [OpenID Connect](./webauth-examples/apache-oidc.conf)
* **Caddy:** [Basic Auth & Forward Auth](./webauth-examples/Caddyfile)
* **Traefik:** [Docker Labels for Basic/Forward Auth](./webauth-examples/traefik-docker-compose.yaml)

### **Parameters and Shell Injection**

`simple-mcp` uses environment variables to pass parameters to shell commands.
This prevents direct command injection (e.g., passing `dummy; touch /tmp/evil`
as a parameter will not execute the second command).

However, users must still be careful when designing tool commands:

* **Argument Splitting & Globbing:** By default, if you use `{{.param}}`
    without quotes, the shell will expand the variable and then perform word
    splitting and globbing. For example, if `param` is `hello world`, `echo {{.param}}`
    becomes `echo hello world` (two arguments). If `param` is `*`, it might
    expand to a list of files.
* **Use Double Quotes:** It is highly recommended to use double quotes around
    parameters: `"{{.param}}"`. This ensures the shell treats the parameter
    as a single string and prevents globbing.
* **Input Validation:** While direct execution is prevented, parameters are
    still passed to underlying programs. Ensure these programs handle untrusted
    input safely and don't have vulnerabilities that could be triggered by
    maliciously crafted arguments (e.g., "Bobby Tables" scenarios).
* **Avoid `eval`:** Do not use `eval` or similar constructs with parameters
    in your commands, as this would re-introduce shell injection risks.

## **Usage with mcphost**

This repository includes an example configuration for mcphost. To use it

1. Ensure ollama is running and you have the qwen3-coder:30b (or similar) model
   pulled.
2. Edit mcphost.yaml if you need to change the model name or provider URL.
3. Run mcphost: mcphost \--config mcphost.yaml

**Note:** The mcphost.yaml configuration references systemprompt.txt using a
relative path. You must run mcphost from the directory containing
systemprompt.txt (or update the yaml to provide the full path), otherwise
mcphost will fail to load the system prompt.

## **License**

This project is licensed under the MIT License - see the
[LICENSE](./LICENSE) file for details.

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [vojtechpavlik](https://github.com/vojtechpavlik)
- **Source:** [vojtechpavlik/simple-mcp](https://github.com/vojtechpavlik/simple-mcp)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-vojtechpavlik-simple-mcp
- Seller: https://agentstack.voostack.com/s/vojtechpavlik
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.