Repository navigation
Don’t use shell=True in mcp dev subprocess on Windows (command injection risk) #1257
Description
Initial Checks
- I confirm that I'm using the latest version of MCP Python SDK
- I confirm that I searched for my issue in https://github.com/modelcontextprotocol/python-sdk/issues before opening this issue
Description
What’s happening:
When you run the mcp dev command on Windows, it starts another program using a method (subprocess.run with shell=True) that lets the Windows command prompt (cmd.exe) handle the command. This is risky because if any part of the command includes special characters (like &, |, %, etc.), Windows might run something you didn’t expect — even another program, if the file path or arguments are weirdly named or crafted.
Why this is a real problem:
- This isn’t just a theory — it’s a well-known risk with
shell=Truein Python. If anyone (or any script) can control part of the file path or arguments, they might be able to run extra commands on your computer. - The Python documentation says to avoid
shell=Truewhen possible for exactly this reason. - The fix is easy: use
shell=Falseand make sure the right Windows executable is picked (likenpx.cmd). - This keeps things safe and works the same on all systems.
What should happen instead:
- The command should be run without
shell=Trueon Windows, just like it is on Linux/Mac. - File paths and arguments should always be passed as a list, not a single string.
How this could be abused:
- If someone manages to sneak a file or argument with a shell special character into your project, running
mcp devcould run extra commands (for example, opening Calculator if the file had&calcin its name).
Please fix:
- Remove
shell=Truefrom thesubprocess.runcall insrc/mcp/cli/cli.py(Windows part). - Make sure the command and its arguments are always passed as a list.
- Make sure it works on Windows by using the right executable (like
npx.cmd).
Thanks!
Example Code
# Example of risky situation on Windows:
# If a file is named "server&calc.py" and you run:
# mcp dev path\to\server&calc.py
# Windows might run Calculator because of the &
# Please see src/mcp/cli/cli.py (mcp dev command) for the subprocess.run([npx_cmd, ...], shell=True, ...)Python & MCP Python SDK
Python 3.11, Windows 11, latest MCP Python SDK (main branch, August 2025)
Activity
Br1an67 commentedon Mar 1, 2026
I'd like to work on this. The fix removes
shell=Truefrom bothsubprocess.runcalls—_get_npx_command()already resolves tonpx.cmd/npx.exeon Windows, so shell dispatch is unnecessary.PR: #$(gh pr view --repo modelcontextprotocol/python-sdk --head Br1an67:fix/issue-1257-shell-injection --json number --jq '.number')
fix(security): remove shell=True to prevent command injection on Windows
xr843 commentedon Mar 26, 2026
I'd like to work on this issue. Submitting a PR that:
subprocess.run(..., shell=True)in_get_npx_command()withshutil.which()— safer and more efficient than spawning a shell just to check if npx existsshell=Truefrom themcp devsubprocess call, since_get_npx_command()already resolves the correct executable (e.g.npx.cmdon Windows)shutil.which()approach