Windows CLI MCP Server

The security block controls the safety boundaries of command execution. Key settings include:

• maxCommandLength: Maximum allowed length for any command.
• blockedCommands: A list of commands to block (e.g., rm, del, shutdown). This is case-insensitive and blocks both direct names and full paths.
• blockedArguments: Arguments that will be blocked when used with any command (e.g., --exec, -e, -enc).
• allowedPaths: A list of directories where commands are permitted to run.
• restrictWorkingDirectory: If true, commands can only run within the allowedPaths.
• logCommands: If true, saves command history.
• maxHistorySize: Maximum number of commands to keep in history.
• commandTimeout: Timeout for command execution in seconds.
• enableInjectionProtection: Enables protection against command injection (e.g., blocking ;, &, |, `).

{
  "security": {
    "maxCommandLength": 1000,
    "blockedCommands": [
      "rm",
      "del",
      "rmdir",
      "format",
      "shutdown",
      "restart",
      "reg",
      "regedit",
      "net",
      "netsh",
      "takeown",
      "icacls"
    ],
    "blockedArguments": [
      "--exec",
      "-e",
      "/c",
      "-enc",
      "-encodedcommand",
      "-command",
      "--interactive",
      "-i",
      "--login",
      "--system"
    ],
    "allowedPaths": ["C:\\Users\\YourUsername", "C:\\Projects"],
    "restrictWorkingDirectory": true,
    "logCommands": true,
    "maxHistorySize": 1000,
    "commandTimeout": 30,
    "enableInjectionProtection": true
  }
}

The ssh block enables remote command execution. To use it, set enabled: true. You can define multiple connection profiles in the connections object.

Global SSH Settings:

• defaultTimeout: Timeout for SSH commands in seconds.
• maxConcurrentSessions: Maximum number of simultaneous SSH sessions.
• keepaliveInterval: Interval for keepalive packets in milliseconds.
• keepaliveCountMax: Max failed keepalive attempts before disconnecting.
• readyTimeout: Timeout for establishing connections in milliseconds.

Connection Profiles: Each profile (e.g., raspberry-pi) can specify:

• host: Hostname or IP.
• port: SSH port.
• username: SSH username.
• password: Password authentication.
• privateKeyPath: Path to a private key for key-based authentication.
• Overrides for keepaliveInterval, keepaliveCountMax, and readyTimeout can be applied per connection.

{
  "ssh": {
    "enabled": false,
    "defaultTimeout": 30,
    "maxConcurrentSessions": 5,
    "keepaliveInterval": 10000,
    "keepaliveCountMax": 3,
    "readyTimeout": 20000,
    "connections": {
      "raspberry-pi": {
        "host": "raspberrypi.local",
        "port": 22,
        "username": "pi",
        "password": "raspberry",
        "keepaliveInterval": 10000,
        "keepaliveCountMax": 3,
        "readyTimeout": 20000
      },
      "dev-server": {
        "host": "dev.example.com",
        "port": 22,
        "username": "admin",
        "privateKeyPath": "C:\\Users\\YourUsername\\.ssh\\id_rsa",
        "keepaliveInterval": 10000,
        "keepaliveCountMax": 3,
        "readyTimeout": 20000
      }
    }
  }
}

The shells block allows you to enable or disable specific command-line interfaces and define how they are invoked. Each shell configuration includes:

• enabled: Boolean to turn the shell on or off.
• command: The path to the shell executable.
• args: Default arguments passed to the shell.
• blockedOperators: An optional list of command operators to block (e.g., &, |, ;, `) to prevent command chaining.

{
  "shells": {
    "powershell": {
      "enabled": true,
      "command": "powershell.exe",
      "args": ["-NoProfile", "-NonInteractive", "-Command"],
      "blockedOperators": ["&", "|", ";", "`"]
    },
    "cmd": {
      "enabled": true,
      "command": "cmd.exe",
      "args": ["/c"],
      "blockedOperators": ["&", "|", ";", "`"]
    },
    "gitbash": {
      "enabled": true,
      "command": "C:\\Program Files\\Git\\bin\\bash.exe",
      "args": ["-c"],
      "blockedOperators": ["&", "|", ";", "`"]
    }
  }
}

The server provides a suite of tools to manage SSH connections and execute commands on remote systems.

Remote Execution

• ssh_execute: Executes a command on a remote system using a specific connectionId and a command string.

Connection Management

• create_ssh_connection: Establishes a new connection. Requires a connectionId and a connectionConfig object containing host, port, username, and either password or privateKeyPath.
• update_ssh_connection: Updates an existing connection's configuration.
• delete_ssh_connection: Removes a connection by its connectionId.
• read_ssh_connections: Retrieves a list of all configured SSH connections.
• ssh_disconnect: Terminates an active SSH connection using its connectionId.

// Example: Creating an SSH connection
{
  "name": "create_ssh_connection",
  "arguments": {
    "connectionId": "raspberry-pi",
    "connectionConfig": {
      "host": "192.168.1.50",
      "port": 22,
      "username": "pi",
      "privateKeyPath": "C:\\Users\\me\\.ssh\\id_rsa"
    }
  }
}