Safely escape shell arguments for bash, cmd.exe, and PowerShell via @mukundakatta/shellquote-mcp (npx)

@mukundakatta/shellquote-mcp v0.1.0 — Shell Argument Escaping

Install: npm install @mukundakatta/shellquote-mcp Binary: shellquote-mcp (entry: src/index.js) Transport: stdio Tools (4): quote_bash (single arg → escaped), quote_bash_argv (arg array → command string), quote_cmd (Windows cmd.exe escaping), quote_powershell (PS single-quote escaping)

Key behaviors

• quote_bash: wraps in single quotes; safe barewords returned unquoted; embedded single quotes escaped as '\''
• quote_bash_argv: joins array into a space-separated, fully-escaped command string
• quote_cmd: double-quote wrapping with doubled internal quotes; warns about ^ ! % corner cases
• quote_powershell: single-quote wrapping with doubled internal single quotes; no variable expansion

Gotchas

• All tools return JSON objects ({"quoted":"..."} or {"command":"..."}) not plain strings
• Infinity, NaN etc. are NOT special — treated as regular strings
• First two calls ~150ms (JIT), subsequent calls 3–11ms

When to use

Agents building CLI commands from user input or LLM output MUST escape arguments to prevent shell injection. This server handles bash, cmd.exe, and PowerShell in one place.