mcp-server-bash-sdk

Least-privilege permissions

• Run the MCP server under a dedicated, non-root user account with no shell login (/usr/sbin/nologin) and minimal file access (e.g., chmod 750 on script directories).
• Use sudo with specific command whitelists in /etc/sudoers if elevated permissions are necessary; never grant blanket sudo access.
• Restrict environment variable inheritance by explicitly unsetting sensitive vars (unset AWS_SECRET_ACCESS_KEY, etc.) before spawning the bash process.
• Apply filesystem ACLs to config files containing credentials; store them in ~/.ssh or dedicated directories with chmod 600.

Network isolation

• Run the MCP server on 127.0.0.1:PORT only (localhost binding); never expose the socket or HTTP endpoint to untrusted networks without mTLS.
• Use a firewall rule (iptables, pf) to restrict outbound connections from the MCP process to only required services (e.g., allow curl to specific API endpoints only).
• Disable unnecessary bash features (e.g., set +H to disable history expansion) and avoid eval, source, or dynamic command construction from Claude prompts.
• If Claude invokes external tools, validate and allowlist command names and argument patterns before shell execution.

Monitoring

• Log all MCP server invocations (command, args, exit code) to a dedicated file with restricted read access; use syslog or auditd for non-bypassable audit trails.
• Monitor the bash process with strace or auditctl in production to detect unexpected syscalls (file writes, network connects, credential reads).
• Set up alerts for failed authentication attempts, unusual environment variable access, or commands containing shell metacharacters ($, |, ;, &).
• Regularly rotate logs and use file integrity monitoring (e.g., AIDE, Tripwire) on the MCP script directory.

Red flags to watch for

• Bash errors silently ignored or swallowed (e.g., unquoted variables, pipefail disabled); always use set -euo pipefail and explicit error handling.
• Credentials visible in ps aux output or inherited by child processes; check environment with env | grep -i secret before each invocation.
• Claude prompts or user inputs concatenated directly into shell commands without quoting (cmd="echo $user_input") — use arrays or printf %q for escaping.
• Supply-chain drift: verify bash dependencies (curl, jq, grep) via checksum or package manager pinning; audit for unexpected updates or path hijacking.