MCP Stdio Shellguard
Defense-in-depth bundle for MCP stdio servers
Drop-in guardExec / guardSpawn wrappers, AST audit CLI, reference MCP server. Closes the OX Security 200k-server stdio-RCE class (CVE-2025-69256). Unicode-bypass-hardened, allowlist-based, replay-window protected. MIT, TypeScript, Node 20+.
What it solves
In May 2026 the stdio remote-code-execution class in MCP servers was disclosed, and the count of vulnerable servers ran to roughly two hundred thousand. The shape is always the same: a tool takes an argument and hands it to a shell without sanitising it. This closes that class in three ways you can adopt one at a time.
How it works
The first layer is a library: drop-in replacements for exec and spawn that you call from your own server, with a default-deny allowlist, sandbox profiles and a replay window. The second is an audit command that walks the abstract syntax tree of your sources and reports every unsanitised shell call it finds, which you can run with npx without installing anything. The third is the normalisation the two share: NFKC folding, zero-width stripping and blocking of bidirectional marks, the same pass used in mcp-rce-guard.
When to use it
If you maintain an MCP server that shells out at all, run the audit command against your sources first. It costs one npx line and it tells you whether you are in the affected class before you decide how much of the library to adopt.
When not to use it
It guards the calls you route through it. A shell call somewhere else in your process is untouched, which is exactly why the audit command exists: the library alone gives you a false sense of coverage if you never checked where else you shell out. It targets the MCP spec of 2025-06-18 and needs Node 20 or newer.
Stars
★ 0
installs
↓ 1,142
Clones (14d)
⊟ 209
Language
TypeScript
Updated
2026-08-21
Install
npx -y mcp-stdio-shellguard