Power your agent
Cài đặt từ nhà phát hành. Không phải endpoint của PlugMCP.
Host a copy with our keys and logs.
Chưa có bản phát hành đóng gói nào trong registry. Làm theo README của kho mã.
URL từ xa hay một lệnh trên máy của bạn? Hai cách cài đặt khác nhau thế nào
Chạy trên PlugMCP
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
MởTừ nhà phát hành
Stop copy-pasting terminal output into your AI. Let your LLM SSH in and look around.
ShellGuard is an MCP server that gives LLM agents controlled bash access to remote servers over SSH. Connect your AI to production, staging, or dev servers and let it run diagnostics, inspect logs, query databases, and troubleshoot -- hands-free.
MCP server that gives LLM agents read-only shell access over SSH. Powers Fawdy (fawdy.com)
ShellGuard is the open-source security layer built by the team at Fawdy. It powers Fawdy's AI-powered Linux server investigation tool that delivers plain-English root cause analysis.
You can use ShellGuard standalone with any MCP-compatible AI agent, or try the full investigation experience with Fawdy.
AI agents are powerful, but giving them unrestricted shell access to production servers is risky. ShellGuard solves this by enforcing read-only access at the command level. Every command is parsed, validated against an allowlist, and reconstructed before execution. If an agent tries something destructive, ShellGuard blocks it and tells the agent what to do instead.
Commands are restricted to a curated set of observation and diagnostic tools. Destructive operations are blocked with actionable suggestions so the LLM can self-correct and keep investigating:
wget -r -> "Recursive downloading is not allowed"tail -f -> "Follow mode hangs until timeout. Use tail -n 100 for recent lines."sed -> "Stream editing can modify files -- read-only access only. Use grep for searching."$HOME/file -> "Variable expansion will not expand. Use absolute paths."brew install fawdyinc/tap/shellguard
Or download the latest binary:
curl -fsSL https://raw.githubusercontent.com/fawdyinc/shellguard/main/install.sh | sh
Or with Go:
go install github.com/fawdyinc/shellguard/cmd/shellguard@latest
ShellGuard starts as a stdio MCP server -- no arguments needed. Add it to your MCP client of choice:
Go to: Settings -> Cursor Settings -> MCP -> Add new global MCP server
Or paste this into your ~/.cursor/mcp.json file. You can also install per-project by creating .cursor/mcp.json in your project folder. See Cursor MCP docs for more info.
{
"mcpServers": {
"shellguard": {
"command": "shellguard"
}
}
}
Add the following to your Claude Desktop config file. See Claude Desktop MCP docs for more info.
~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.json{
"mcpServers": {
"shellguard": {
"command": "shellguard"
}
}
}
Run this command. See Claude Code MCP docs for more info.
claude mcp add shellguard -- shellguard
Add this to your OpenCode configuration file. See OpenCode MCP docs for more info.
{
"mcp": {
"shellguard": {
"type": "local",
"command": ["shellguard"],
"enabled": true
}
}
}
Add the following to your VS Code settings.json or .vscode/mcp.json. See VS Code MCP docs for more info.
settings.json){
"mcp": {
"servers": {
"shellguard": {
"type": "stdio",
"command": "shellguard"
}
}
}
}
.vscode/mcp.json){
"servers": {
"shellguard": {
"type": "stdio",
"command": "shellguard"
}
}
}
Add the following to your Zed settings file (~/.config/zed/settings.json). See Zed MCP docs for more info.
{
"context_servers": {
"shellguard": {
"command": {
"path": "shellguard",
"args": []
}
}
}
}
Go to: Roo Code Settings -> MCP Servers -> Edit MCP Settings
Or add the following to your Roo Code MCP settings file. See Roo Code MCP docs for more info.
{
"mcpServers": {
"shellguard": {
"command": "shellguard"
}
}
}
ShellGuard exposes 6 tools to the LLM:
provision, download_file, and sleep can be disabled via the disabled_tools config option or SHELLGUARD_DISABLED_TOOLS environment variable.
The LLM connects to a server, runs commands, and reads the output -- the same workflow you'd do manually, but without the context-switching.
Every command goes through a pipeline before reaching the remote host:
For full details, see ARCHITECTURE.md.
ShellGuard tries authentication methods in this order, stopping at the first success:
Passphrase-protected keys are silently skipped during default key discovery. If you specify a passphrase-protected key via identity_file, the connection will fail. Add the key to your agent first: ssh-add ~/.ssh/my_key.
ShellGuard supports two SSH modes:
If you connect through bastion hosts, use ProxyJump, or rely on Match blocks in your SSH config, enable system mode:
ssh:
mode: system
export SHELLGUARD_SSH_MODE=system
If mode is set to system but the ssh binary is not found, ShellGuard logs a warning and falls back to native mode.
Native mode limitations: Match directives, ProxyJump, ProxyCommand, and ForwardAgent are not supported. Use system mode if your infrastructure requires these features.
System mode notes:
host_key_checking and known_hosts_file settings only apply in native mode.ControlMaster, so only the first connection per host pays the SSH handshake cost.ShellGuard verifies SSH host keys using ~/.ssh/known_hosts. Three modes are available:
If a host key has changed, remove the old entry from your known_hosts file.
Settings can be specified in a YAML config file or via environment variables. Environment variables take precedence.
Config file location: $XDG_CONFIG_HOME/shellguard/config.yaml (default: ~/.config/shellguard/config.yaml)
ssh:
mode: "native" # native | system
connect_timeout: "10s" # default 10s
retries: 2 # default 2
retry_backoff: "250ms" # default 250ms
host_key_checking: "accept-new" # accept-new | strict | off (native mode only)
known_hosts_file: "~/.ssh/known_hosts" # native mode only
Remote servers don't always have the tools you want. On connect, ShellGuard probes for rg, jq, and yq. If any are missing, the LLM can call provision to deploy them:
Binaries are downloaded from GitHub Releases with SHA-256 verification, cached locally, and deployed to ~/.shellguard/bin/ on the remote host.
ShellGuard can be used as a Go library:
package main
import (
"context"
"log/slog"
"os"
"github.com/fawdyinc/shellguard"
)
func main() {
ctx := context.Background()
logger := slog.New(slog.NewTextHandler(os.Stderr, nil))
err := shellguard.RunStdio(ctx, shellguard.Config{Logger: logger})
if err != nil {
os.Exit(1)
}
}
See the Custom Configuration and Custom Executor sections below for advanced usage.
import (
"github.com/fawdyinc/shellguard"
"github.com/fawdyinc/shellguard/manifest"
"github.com/fawdyinc/shellguard/server"
)
manifests, _ := manifest.LoadEmbedded()
// Add or remove commands as needed
core, err := shellguard.New(shellguard.Config{
Manifests: manifests, // Custom registry (nil = embedded defaults)
Executor: myCustomExecutor, // Custom backend (nil = SSH)
Name: "my-server", // MCP server name
Version: "1.0.0", // MCP server version
})
Implement the server.Executor interface to use non-SSH backends:
type Executor interface {
Connect(ctx context.Context, params ssh.ConnectionParams) error
Execute(ctx context.Context, host, command string, timeout time.Duration) (ssh.ExecResult, error)
ExecuteRaw(ctx context.Context, host, command string, timeout time.Duration) (ssh.ExecResult, error)
SFTPSession(host string) (ssh.SFTPClient, error)
Disconnect(host string) error
}
make test # Run all tests
make test-race # Run with race detector
make lint # Run go vet
shellguard/
shellguard.go # Top-level constructor (New, RunStdio)
cmd/shellguard/ # CLI entrypoint
server/ # MCP server core, tool registration, Executor interface
parser/ # Shell AST parser (mvdan.cc/sh/v3)
validator/ # Command/flag/SQL validation engine
manifest/ # YAML command registry (embed.FS)
manifests/ # allowed command manifests
manifests/denied/ # denied command manifests
ssh/ # SSH manager, ShellQuote, ReconstructCommand
output/ # Output truncation (64KB cap)
toolkit/ # Diagnostic tool provisioning (rg, jq, yq)
ShellGuard is great on its own, but if you want automated incident investigation with plain-English root cause reports, check out Fawdy. It connects to your Linux servers via ShellGuard and investigates incidents automatically. 10-minute setup.
Apache License 2.0. See LICENSE for details.
MCP server that gives LLM agents read-only shell access over SSH. Powers Fawdy (fawdy.com)
Công cụ
Chưa có danh sách công cụ. Máy chủ từ xa sẽ có danh sách sau lần kiểm tra tình trạng đầu tiên.
Câu hỏi thường gặp
Sao chép cấu hình stdio cho Cursor, Claude Desktop, Claude Code hoặc VS Code trên trang này. Cấu hình dùng bản cài đặt của nhà phát hành, không phải proxy của PlugMCP.
Bản ghi này không liệt kê biến môi trường bắt buộc nào.
Shellguard chạy cục bộ qua stdio.
Kiểm tra lần cuối: 2026-10-27. MCP server that gives LLM agents read-only shell access over SSH. Powers Fawdy (fawdy.com)
