LibreChat with cmdshellmcp in a Docker sandbox makes it a fairly usable coding agent

[ag88]

I built the cmdshellmcp server, which is a Unix shell command and filesystem MCP server for LLMs and AI agents.

cmdshellmcp is a constrained command-shell MCP server for AI agents. It exposes a small allowlisted set of Unix commands, relatively safe file operations, patch application, and URL fetching so an MCP client can perform limited local tasks without unrestricted shell access.

The server is implemented in Python and runs as an MCP server using the fastmcp package. By default, it listens on 127.0.0.1:8003 using the streamable HTTP transport unless --sse is selected.

I’ve added setup files for a full-featured Docker-based Debian sandbox container with cmdshellmcp (including setup scripts, guides in DOCKER.md, a Dockerfile, and a cmdshellmcp.service unit file that runs cmdshellmcp inside the container).

---

Currently, I’ve been using LibreChat with my cmdshellmcp server in its Docker container as a coding agent. In LibreChat, you can connect an LLM model — any model, such as a local model via Ollama or llama.cpp, or an online model such as from OpenRouter, etc.

One thing to be a little wary of is the MCP Settings: you need to add the server IP address and port under allowedAddresses in librechat.yaml, or you will get access errors when trying to connect LibreChat to the MCP server on your LAN.

Once this is done, you can add that MCP server in LibreChat’s web UI at:
https://www.librechat.ai/docs/features/mcp#adding-mcp-servers-in-the-ui

By connecting LibreChat to an LLM model and connecting the cmdshellmcp server in its Docker container, I have so far built a fairly capable coding agent setup. For example, I can prompt the LLM to generate complete code and files, and those files are created in the Docker container under the user codeagent.

In this way, I have a pretty capable coding agent with the protection of a disposable Docker container for the LLM/agent to work in. This helps prevent situations where things can go wrong — for example, I’ve seen in OpenCode that some models write to the root directory using absolute paths.

https://www.reddit.com/r/LocalLLaMA/comments/1wmw4bq/an_unsafe_command_shell_mcp_server/