Safe shell argument escaping (bash/cmd.exe/PowerShell) via @mukundakatta/shellquote-mcp (npx) — 4 tools, stops injection in LLM-generated commands
When an LLM constructs a shell command from user input or tool output, unescaped metacharacters (;, &&, $, |, quotes, backslashes, spaces) can cause command injection or silent breakage. This MCP server provides 4 tools to produce safe quoted strings for bash, cmd.exe, and PowerShell — with zero config and sub-millisecond latency.
@mukundakatta/shellquote-mcp — safe shell argument escaping
Install: npm install @mukundakatta/shellquote-mcp Launch: node node_modules/@mukundakatta/shellquote-mcp/src/index.js (stdio) Tools: 4 — quote_bash, quote_bash_argv, quote_cmd, quote_powershell
Tool schemas
- quote_bash
{arg: string}→{quoted: string}— single-quote wraps for bash/sh/zsh - quote_bash_argv
{args: string[]}→{command: string}— joins multiple args into one safe command string - quote_cmd
{arg: string}→{quoted: string}— double-quote wraps for Windows cmd.exe - quote_powershell
{arg: string}→{quoted: string}— single-quote wraps for PowerShell (doubles embedded quotes)
Traces
1. Bash — injection attempt neutralized
// request
{"name": "quote_bash", "arguments": {"arg": "hello world; rm -rf / && echo $HOME"}}
// response (1ms)
{"quoted": "'hello world; rm -rf / && echo $HOME'"}The semicolons, &&, and $HOME are all safely trapped inside single quotes — no expansion or execution.
2. Bash argv — mixed quotes and spaces
// request
{"name": "quote_bash_argv", "arguments": {"args": ["grep", "-r", "it's a \"test\"", "--include=*.ts", "/path/with spaces/dir"]}}
// response (1ms)
{"command": "grep -r 'it'\\''s a \"test\"' '--include=*.ts' '/path/with spaces/dir'"}The embedded single quote in it's is correctly handled with the '\'' escape pattern.
3. PowerShell — pipeline and variable neutralized
// request
{"name": "quote_powershell", "arguments": {"arg": "Get-Process | Where {$_.Name -eq 'chrome'} ; Remove-Item C:\\Users\\*"}}
// response (1ms)
{"quoted": "'Get-Process | Where {$_.Name -eq ''chrome''} ; Remove-Item C:\\Users\\*'"}4. cmd.exe — ampersand and embedded quotes
// request
{"name": "quote_cmd", "arguments": {"arg": "hello \"world\" & del /q *.*"}}
// response (1ms)
{"quoted": "\"hello \"\"world\"\" & del /q *.*\""}When to use
Any agent workflow that constructs shell commands from untrusted input — file paths with spaces, user-supplied search terms, or tool output containing metacharacters. Prevents command injection without the agent needing to know shell quoting rules.
{ "server": "@mukundakatta/shellquote-mcp", "version": "0.1.0", "transport": "stdio", "launch": "node node_modules/@mukundakatta/shellquote-mcp/src/index.js", "tools_count": 4, "tools": ["quote_bash", "quote_bash_argv", "quote_cmd", "quote_powershell"], "trace": { "tool": "quote_bash", "input": { "arg": "hello world; rm -rf / && echo $HOME" }, "output": { "quoted": "'hello world; rm -rf / && echo $HOME'" }, "latency_ms": 1 }, "trace_2": { "tool": "quote_bash_argv", "input": { "args": ["grep", "-r", "it's a "test"", "--include=*.ts", "/path/with spaces/dir"] }, "output": { "command": "grep -r 'it'\''s a "test"' '--include=*.ts' '/path/with spaces/dir'" }, "latency_ms": 1 }, "trace_3": { "tool": "quote_powershell", "input": { "arg": "Get-Process | Where {$_.Name -eq 'chrome'} ; Remove-Item C:\Users\*" }, "output": { "quoted": "'Get-Process | Where {$_.Name -eq ''chrome''} ; Remove-Item C:\Users\*'" }, "latency_ms": 1 }, "trace_4": { "tool": "quote_cmd", "input": { "arg": "hello "world" & del /q *.*" }, "output": { "quoted": ""hello ""world"" & del /q *.*"" }, "latency_ms": 1 } }