Script Execution¶
Tools for running scripts on the target system. These tools are only available when the server is started with --toolset run-script or --toolset both. See Guarded Command Execution for details.
run_script¶
Call this tool to run a previously validated script. Use this when validate_script returned needs_confirmation: false.
Parameters:
token(string, required): The token returned by the validate_script tool.
run_script_interactive¶
Run a script that modifies the system. The user will be asked for approval interactively.
A bash script should be used for simple operations that can be expressed cleanly
as a few shell commands, but a Python script should be used if complex processing
is needed. Bash scripts are run with strict mode (set -euo pipefail) applied by
the invocation, so handle expected non-zero exit codes in the script (e.g. with
|| true) where needed.
Write short, simple scripts that are easy to review - do not include unnecessary complexity such as elaborate logging or handling unlikely corner cases.
Note
This tool may modify system state.
Note
Only available with clients that support MCP apps (e.g. RHEL Lightspeed).
Parameters:
description(string, required): Description of what the script does - e.g. 'Modify file permissions on nginx.conf to fix startup errors.'script_type("python","bash", required): The type of script to run (python or bash).script(string, required): The script to run.readonly(boolean, required): Should be true if the script does not modify the system.token(string, required): The token returned by the validate_script tool.host(string, required): System to run on: 'localhost' for the system the MCP server runs on, or a remote host to connect to via SSH
Returns:
id(string)status("OK","BAD_DESCRIPTION","POLICY","MODIFIES_SYSTEM","UNCLEAR","DANGEROUS","MALICIOUS")detail(string)
run_script_with_confirmation¶
Call this tool to run a previously validated script that modifies the system. Use this when validate_script returned needs_confirmation: true. The parameters must match those passed to validate_script.
Note
This tool may modify system state.
Note
Not available with clients that support MCP apps; use the interactive variant instead.
Parameters:
description(string, required): Description of what the script does - e.g. 'Modify file permissions on nginx.conf to fix startup errors.'script_type("python","bash", required): The type of script to run (python or bash).script(string, required): The script to run.readonly(boolean, required): Should be true if the script does not modify the system.token(string, required): The token returned by the validate_script tool.host(string, required): System to run on: 'localhost' for the system the MCP server runs on, or a remote host to connect to via SSH
validate_script¶
Request validation of a script from the gatekeeper. The tool will return a unique token that must be included in the run_script tool call.
Parameters:
description(string, required): Description of what the script does - e.g. 'Modify file permissions on nginx.conf to fix startup errors.'script_type("python","bash", required): The type of script to run (python or bash).script(string, required): The script to run.host(string, required): System to run on: 'localhost' for the system the MCP server runs on, or a remote host to connect to via SSHreadonly(boolean, default:true): Should be true if the script does not modify the system.