shellfirm MCP
MCP checks shell commands, while shellfirm hooks apply rules to supported agent calls before they execute
- 953 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- Connection setup changes hooks and client configuration that affect command approval
- A policy can block useful commands or miss dangerous ones
- MCP tools receive command text, which can contain secrets
Install
- Works in
Manual install
npm install -g @shellfirm/cliInstalls the program. Connect your client with a separate command.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Connection setup changes hooks and client configuration that affect command approval
- A policy can block useful commands or miss dangerous ones
- MCP tools receive command text, which can contain secrets
This is third-party code. Review the repository files before installing.
What it does
shellfirm gives an agent tools for checking shell commands. Through MCP, submit a command string and receive matching rules with severity. Separate tools explain the reason and suggest an alternative. For Claude Code, `shellfirm connect claude-code` adds MCP and hooks. Hooks check supported calls before execution and can stop commands matched by risky rules. An ordinary MCP call does not intercept agent work by itself. Checks cover common filesystem and developer-tool mistakes. Custom rules can extend the policy. shellfirm inspects command text and available call parameters; it does not inspect arbitrary behavior inside a program once it runs.
Who it is for. For developers adding checks for common dangerous commands to coding-agent and terminal work.
Good fit when
- You want to inspect rule matches before running a command
- An agent needs a risk explanation and a less destructive alternative
- Claude Code or Cursor needs automatic checking hooks
- A team wants custom rules for sensitive paths
Not a fit when
- You need process isolation and enforced restrictions on arbitrary network access
- You require every deletion or secret-exfiltration method to be detected
- An application changes data through APIs shellfirm rules do not recognize
Example request
Check this command with `check_command`, explain matching rules and suggest an alternative. Do not execute the command.MCP
- Transport
- stdio
- Authentication
- not required
Limitations
npm installation needs Node.js; connect the client separately, since MCP calls alone do not intercept commands. Rules cover recognized command text and parameters, leaving behavior inside a running program outside the check. The ignore setting disables a selected check for both shell and agent, except project-required rules. Reconnect after upgrading from 0.3.10: old hooks approved commands without findings outright, while new hooks leave the decision to the client.
How to disable. Run `shellfirm connect claude-code --uninstall` if you connected Claude Code. For shell hooks, use `shellfirm init --uninstall`, then restart open shells. Inspect `shellfirm status` and uninstall through your package manager. Preserve or remove configuration and audit logs separately after review.
FAQ
How do I install shellfirm with npm?
Run `npm install -g @shellfirm/cli`, then `shellfirm connect claude-code` for Claude Code. Client configuration is a separate step.
Which tools does MCP provide?
`check_command` checks a command string, `suggest_alternative` proposes a replacement, and `explain_risk` explains a finding. `get_policy` shows policy. These tools act on requests; automatic interception requires hooks.
Can I run MCP manually on its own?
Yes. The server command is `shellfirm mcp`. It provides checking tools but does not add client hooks.
Does connecting change shared Claude Code settings?
Yes. User-scope installation writes hooks to `~/.claude/settings.json` and MCP to `~/.claude.json`. Project scope uses project files. Review the selected scope first.
Does shellfirm replace a sandbox?
No. Rules do not restrict process permissions or see every hidden program action. Isolation needs a separate environment with its own controls.
Does it need a separate model key?
No. shellfirm runs locally; MCP uses stdio without a server key. Code uses Apache-2.0.
Discussion
No questions or reviews yet.
Related
MCP serversAgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
Security scanner for coding agents: checks code, MCP servers, prompts and model-invented packages, and gives an A to F grade.
A CLI that scans your machine for skills and MCP configs, finds poisoned tool descriptions and runs a system prompt through 225 attacks
Security scanner for MCP servers that looks for hardcoded keys, tool poisoning and injection flaws in repository code.
CLI mediator scans agent network requests and MCP calls for secret leaks, unsafe destinations and injected instructions
An MCP memory server for agents plus a free gate that stops dangerous commands before they run
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| shellfirm (this card) | no | not required | 953 | |
| Agent Safehouse | no | 2,136 | isolates an agent environment; shellfirm checks command text against rules before execution | |
| Destructive Command Guard | no | 6,259 | dcg checks agent commands before execution, blocks matches against configured rules and explains the action behind each denial. |
README in short
The rule catalog and audit log help explain why a command triggered a warning. Custom checks add project-specific conditions.