Windows CLI MCP Server
MCP server for secure command-line interactions on Windows systems, enabling controlled access to PowerShell, CMD, Git Bash shells, and remote systems via SSH. It allows MCP clients (like Claude Desktop) to perform operations on your system, similar to Open Interpreter.
[!IMPORTANT] This MCP server provides direct access to your system's command line interface and remote systems via SSH. When enabled, it grants access to your files, environment variables, command execution capabilities, and remote server management.See Configuration for more details.
- Features
- Usage with Claude Desktop
- Configuration
- API
- Security Considerations
- License
Features
- Multi-Shell Support: Execute commands in PowerShell, Command Prompt (CMD), and Git Bash
- SSH Support: Execute commands on remote systems via SSH
- Resource Exposure: View SSH connections, current directory, and configuration as MCP resources
- Security Controls:
- Configurable:
See the API section for more details on the tools and resources the server provides to MCP clients.
Note: The server will only allow operations within configured directories, with allowed commands, and on configured SSH connections.
Usage with Claude Desktop
Add this to your
claude_desktop_config.json:For use with a specific config file, add the
--config flag:After configuring, you can:
- Execute commands directly using the available tools
- View configured SSH connections and server configuration in the Resources section
- Manage SSH connections through the provided tools
Configuration
The server uses a JSON configuration file to customize its behavior. You can specify settings for security controls, shell configurations, and SSH connections.
- To create a default config file, either:
a) copy
config.json.example to config.json, orb) run:
- Then set the
--configflag to point to your config file as described in the Usage with Claude Desktop section.
Configuration Locations
The server looks for configuration in the following locations (in order):
- Path specified by
--configflag
- ./config.json in current directory
- ~/.win-cli-mcp/config.json in user's home directory
If no configuration file is found, the server will use a default (restricted) configuration:
Default Configuration
Note: The default configuration is designed to be restrictive and secure. Find more details on each setting in the Configuration Settings section.
Configuration Settings
The configuration file is divided into three main sections:
security, shells, and ssh.Security Settings
Note: Code block was split into 2 parts due to size limits.
Shell Configuration
SSH Configuration
API
Tools
- execute_command
- get_command_history
- ssh_execute
- ssh_disconnect
- create_ssh_connection
- read_ssh_connections
- update_ssh_connection
- delete_ssh_connection
- get_current_directory
Resources
- SSH Connections
- SSH Configuration
- Current Directory
- CLI Configuration
Security Considerations
Built-in Security Features (Always Active)
The following security features are hard-coded into the server and cannot be disabled:
- Case-insensitive command blocking: All command blocking is case-insensitive (e.g., "DEL.EXE", "del.cmd", etc. are all blocked if "del" is in blockedCommands)
- Smart path parsing: The server parses full command paths to prevent bypass attempts (blocking "C:\Windows\System32\rm.exe" if "rm" is blocked)
- Command parsing intelligence: False positives are avoided (e.g., "warm_dir" is not blocked just because "rm" is in blockedCommands)
- Input validation: All user inputs are validated before execution
- Shell process management: Processes are properly terminated after execution or timeout
- Sensitive data masking: Passwords are automatically masked in resources (replaced with ********)
Configurable Security Features (Active by Default)
These security features are configurable through the config.json file:
- Command blocking: Commands specified in
blockedCommandsarray are blocked (default includes dangerous commands like rm, del, format)
- Argument blocking: Arguments specified in
blockedArgumentsarray are blocked (default includes potentially dangerous flags)
- Command injection protection: Prevents command chaining (enabled by default through
enableInjectionProtection: true)
- Working directory restriction: Limits command execution to specified directories (enabled by default through
restrictWorkingDirectory: true)
- Command length limit: Restricts maximum command length (default: 2000 characters)
- Command timeout: Terminates commands that run too long (default: 30 seconds)
- Command logging: Records command history (enabled by default through
logCommands: true)
Important Security Warnings
These are not features but important security considerations to be aware of:
- Environment access: Commands may have access to environment variables, which could contain sensitive information
- File system access: Commands can read/write files within allowed paths - carefully configure
allowedPathsto prevent access to sensitive data
License
This project is licensed under the MIT License - see the LICENSE file for details.
Windows CLI MCP Server
MCP server for secure command-line interactions on Windows systems, enabling controlled access to PowerShell, CMD, Git Bash shells, and remote systems via SSH. It allows MCP clients (like Claude Desktop) to perform operations on your system, similar to Open Interpreter.
[!IMPORTANT] This MCP server provides direct access to your system's command line interface and remote systems via SSH. When enabled, it grants access to your files, environment variables, command execution capabilities, and remote server management.See Configuration for more details.
- Features
- Usage with Claude Desktop
- Configuration
- API
- Security Considerations
- License
Features
- Multi-Shell Support: Execute commands in PowerShell, Command Prompt (CMD), and Git Bash
- SSH Support: Execute commands on remote systems via SSH
- Resource Exposure: View SSH connections, current directory, and configuration as MCP resources
- Security Controls:
- Configurable:
See the API section for more details on the tools and resources the server provides to MCP clients.
Note: The server will only allow operations within configured directories, with allowed commands, and on configured SSH connections.
Usage with Claude Desktop
Add this to your
claude_desktop_config.json:For use with a specific config file, add the
--config flag:After configuring, you can:
- Execute commands directly using the available tools
- View configured SSH connections and server configuration in the Resources section
- Manage SSH connections through the provided tools
Configuration
The server uses a JSON configuration file to customize its behavior. You can specify settings for security controls, shell configurations, and SSH connections.
- To create a default config file, either:
a) copy
config.json.example to config.json, orb) run:
- Then set the
--configflag to point to your config file as described in the Usage with Claude Desktop section.
Configuration Locations
The server looks for configuration in the following locations (in order):
- Path specified by
--configflag
- ./config.json in current directory
- ~/.win-cli-mcp/config.json in user's home directory
If no configuration file is found, the server will use a default (restricted) configuration:
Default Configuration
Note: The default configuration is designed to be restrictive and secure. Find more details on each setting in the Configuration Settings section.
Configuration Settings
The configuration file is divided into three main sections:
security, shells, and ssh.Security Settings
Note: Code block was split into 2 parts due to size limits.
Shell Configuration
SSH Configuration
API
Tools
- execute_command
- get_command_history
- ssh_execute
- ssh_disconnect
- create_ssh_connection
- read_ssh_connections
- update_ssh_connection
- delete_ssh_connection
- get_current_directory
Resources
- SSH Connections
- SSH Configuration
- Current Directory
- CLI Configuration
Security Considerations
Built-in Security Features (Always Active)
The following security features are hard-coded into the server and cannot be disabled:
- Case-insensitive command blocking: All command blocking is case-insensitive (e.g., "DEL.EXE", "del.cmd", etc. are all blocked if "del" is in blockedCommands)
- Smart path parsing: The server parses full command paths to prevent bypass attempts (blocking "C:\Windows\System32\rm.exe" if "rm" is blocked)
- Command parsing intelligence: False positives are avoided (e.g., "warm_dir" is not blocked just because "rm" is in blockedCommands)
- Input validation: All user inputs are validated before execution
- Shell process management: Processes are properly terminated after execution or timeout
- Sensitive data masking: Passwords are automatically masked in resources (replaced with ********)
Configurable Security Features (Active by Default)
These security features are configurable through the config.json file:
- Command blocking: Commands specified in
blockedCommandsarray are blocked (default includes dangerous commands like rm, del, format)
- Argument blocking: Arguments specified in
blockedArgumentsarray are blocked (default includes potentially dangerous flags)
- Command injection protection: Prevents command chaining (enabled by default through
enableInjectionProtection: true)
- Working directory restriction: Limits command execution to specified directories (enabled by default through
restrictWorkingDirectory: true)
- Command length limit: Restricts maximum command length (default: 2000 characters)
- Command timeout: Terminates commands that run too long (default: 30 seconds)
- Command logging: Records command history (enabled by default through
logCommands: true)
Important Security Warnings
These are not features but important security considerations to be aware of:
- Environment access: Commands may have access to environment variables, which could contain sensitive information
- File system access: Commands can read/write files within allowed paths - carefully configure
allowedPathsto prevent access to sensitive data
License
This project is licensed under the MIT License - see the LICENSE file for details.