Publish exactly the commands you trust as typed MCP tools. No bespoke server, no blank-check shell access.
Choose the executable and argument template. The model never chooses a program.
Expose typed fields, permitted paths, and resource limits for each tool.
One native stdio server advertises the tools and returns structured results.
This definition exposes cargo fmt as a no-argument tool. The child process is launched directly—there is no shell unless you explicitly configure one.
shell-is-all-you-need \
--tool \
--name format \
--description "Format the Rust workspace." \
--input-schema '{"type":"object","properties":{},"additionalProperties":false}' \
--process-timeout-ms 120000 \
--exec cargo fmt --allDesign principle
Start with the narrowest useful command. Add typed inputs and permissions only when the tool needs them.
| Layer | Controls |
|---|---|
| Model contract | Name, description, closed JSON Schema |
| Invocation | Fixed executable and argument templates |
| Filesystem | Path fields, allowed roots, denied paths |
| Resources | Timeout, output bytes, concurrency, request rate |
| Long-running work | Task store, polling interval, retention TTL |
Download a Reddit post, edit its image with Muse Image, and ask DeepSeek to compare the before and after. A fourth tool generates images from scratch. Credentials stay in the server environment.