mcp-shell ships with security off by default

sonirico/mcp-shell says it runs shell commands "securely, auditably, and on demand." Three advisories say otherwise.

The bare-binary deploy, the one in the project's own docs, ships with no policy enforcement at all. GHSA-f5pj-2738-996m traces it to config.go, which initializes Security.Enabled to false. Skip the extra config step most users would skip, and every command runs unchecked. That one scores 8.6.

The Docker path, the one meant to fix that, has its own hole. The image ships a security.yaml that allowlists /bin/bash but only validates the first token of the command. /bin/bash -c followed by anything gets through. A second bypass works the same way through git aliases: git -c alias.pwn=!<command> runs arbitrary code because the metacharacter check never accounts for !. That one is 8.4.

So the two paths the docs actually describe both fail open. Skip the config and get no security. Follow the official Docker example and get a security file that doesn't do its job.

All three are fixed in 0.6.0. The advisory doesn't say how long the flaws sat in prior releases or whether any deployments were hit before the fix. If you're running an older tag, the move is checking whether Security.Enabled actually flips true in your config, not trusting that pulling the Docker image did it for you.