Building a (deliberately unsafe) restricted shell MCP server for local coding agents
ag789 · reddit · 2026-09-22
A Reddit user found that IBM Granite 4.2 8B at Q4KM quant, running under OpenCode's bash tool, attempts to write files with absolute root paths (e.g. /newPythonCode.py) — risky since OpenCode effectively exposes every Unix command the current user can run. The model also hallucinated tool usage, rephrasing shell commands in thinking loops without executing them, likely aggravated by the aggressive 4-bit quantization.
The fix: a small Python shell MCP server, cmdshellmcp, which constrains shell commands, adds checks, and offers dedicated tools like writeFile() so the LLM avoids esoteric cat/echo shell one-liners. It should be run with an explicit --cwd to keep operations in the work directory.
With this MCP server attached via llama.cpp's llama-server, the same Q4KM model generates a working Flask hello-world app (app.py, requirements.txt, templates) in one shot. The author explicitly warns the server is not safe — the LLM can still escape restrictions and write outside --cwd — and recommends running it only in a disposable Docker container.
More from coding & agent
- Redditor Turns Viral Image List of AI Agent GitHub Repos Into Actual Links — alexcovo_eth · 2026-09-22
- vackrooms: an open-source endless backrooms game built entirely with Claude — pablostanley · 2026-09-22
- Give Your LLM a Wiki: demo cuts input tokens by ~50% — kedar5 · 2026-09-22
- Claude Code Projects called the best interface yet for parallel serious work — daniel_mac8 · 2026-09-22
- Open-source QM v0.1.12 ships agent swarms in beta with Modal-backed workers — ycombinator · 2026-09-22
- Category-aware expert RL framework hits 59% on SWE-bench Multilingual — Logics-MLLM · 2026-09-22