command-runner-mcp-server

The server implements comprehensive security measures to prevent common command execution vulnerabilities. This includes robust shell injection prevention (blocking a wide range of dangerous characters in arguments and environment variables), path traversal prevention ('..' blocked), configurable path blocking (via BLOCKED_PATHS environment variable with symlink resolution), flag injection prevention, restrictions on dangerous environment variables (e.g., LD_PRELOAD, PATH), and explicit whitelisting of allowed Git subcommands. Output transformations (grep, sort, head, tail, unique) are implemented natively in Rust using the regex crate, eliminating risks associated with piping to external shell utilities. The use of `std::process::Command::new` and its `arg`/`args` methods further ensures commands are not executed via a shell. Extensive unit tests for security components are also present.