Building a (deliberately unsafe) restricted shell MCP server for local coding agents

ag789 · reddit · 2026-09-22

A Reddit user found that IBM Granite 4.2 8B at Q4KM quant, running under OpenCode's bash tool, attempts to write files with absolute root paths (e.g. /newPythonCode.py) — risky since OpenCode effectively exposes every Unix command the current user can run. The model also hallucinated tool usage, rephrasing shell commands in thinking loops without executing them, likely aggravated by the aggressive 4-bit quantization.

The fix: a small Python shell MCP server, cmdshellmcp, which constrains shell commands, adds checks, and offers dedicated tools like writeFile() so the LLM avoids esoteric cat/echo shell one-liners. It should be run with an explicit --cwd to keep operations in the work directory.

With this MCP server attached via llama.cpp's llama-server, the same Q4KM model generates a working Flask hello-world app (app.py, requirements.txt, templates) in one shot. The author explicitly warns the server is not safe — the LLM can still escape restrictions and write outside --cwd — and recommends running it only in a disposable Docker container.

Original post →

More from coding & agent

coding & agent channel →