Borrowing it
Nothing to install: this file belongs to YC-CLT/cmd-exec-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/YC-CLT/cmd-exec-mcp/main/AGENTS.mdgit clone --depth 1 https://github.com/YC-CLT/cmd-exec-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/yc-clt/cmd-exec-mcp/agents-md)<a href="https://agentmods.dev/instructions/yc-clt/cmd-exec-mcp/agents-md"><img src="https://agentmods.dev/badge/instructions/yc-clt/cmd-exec-mcp/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/yc-clt/cmd-exec-mcp/agents-md"><img src="https://agentmods.dev/badge/instructions/yc-clt/cmd-exec-mcp/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.05155 | $0.05155 |
| Opus 5.5 | $0.02062 | $0.02062 |
| Sonnet 5.5 | $0.01031 | $0.01031 |
| Haiku 4.5 | $0.00515 | $0.00515 |
Grade E, and why
cmd-exec-mcp AGENTS.md scanned grade E with 4 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Harvests environment variableshighData exfiltration
Enumerating or grepping the environment for keys collects credentials unrelated to what the mod says it does.
- **subprocess 三大坑**：① `env=` 替换整个环境，先 `os.environ.copy()` 再 `.update()`；② `shell=True` + `cmd /c` 双层引号转义断裂；③ `timeout=` 只杀父进程，用 `Popen` + `taskkill /F /T /PID` Reaches for credential fileshighPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
- **`os.path.expanduser` 跨平台**：`~/.ssh/id_rsa` 在 Windows 上展开为 `C:\Users\xxx/.ssh/id_rsa`，asyncssh 认 Windows 路径，无需平台判断 Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **Windows 系统代理陷阱**：`urllib.request.urlopen()` 和 `httpx.AsyncClient()` 在 Windows 上会自动读取系统代理设置，访问 `localhost` 时走代理返回 502。`urllib` 用 `ProxyHandler({})` 绕过，`httpx` 用 `proxy=None` 或直接用 SDK 内置 API 避免手搓 HTTP Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
- **Windows 管道句柄继承**：`asyncio.create_subprocess_shell` 管道可被孙子进程继承，改用 `loop.run_in_executor` + `subprocess.run(stdin=DEVNULL, capture_output=True)` How it starts
The opening of the file, as written. The whole thing — 157 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AGENTS.md
环境
- Python 3.11，uv 管理依赖
- config.py 集中配置所有常量，pyproject.toml 管理依赖
- 命令：用
cmd-exec-mcp
关键文件
| 文件 | 作用 |
|---|---|
config.py |
所有配置常量（安全、沙箱、SSH、后端切换） |
main.py |
MCP 服务入口，工具注册、安全校验、进程检测单例 |
executors/base.py |
执行器抽象基类 |
executors/local.py |
本地命令执行器 |
executors/sandbox.py |
Docker 沙箱执行器 |
executors/opensandbox.py |
OpenSandbox 沙箱执行器 |
executors/remote.py |
SSH 远程执行器（asyncssh） |
executors/session.py |
SessionManager + ProcessSession 会话管理 |
models.py |
ExecResult 数据模型 |
tests/ |
测试目录 |
关键常量
| 常量 | 位置 | 说明 |
|---|---|---|
SECURITY_MODE |
config.py | 安全模式 restricted/full |
COMMAND_WHITELIST / BLACKLIST |
config.py | 本地/远程命令黑白名单 |
SANDBOX_BACKEND |
config.py | 沙箱后端 docker/opensandbox |
SANDBOX_ENABLED |
config.py | 沙箱总开关，False 禁用所有沙箱功能 |
SANDBOX_SECURITY_MODE |
config.py | 沙箱安全模式（仅 Docker 后端） |
SANDBOX_COMMAND_WHITELIST / BLACKLIST |
config.py | 沙箱命令黑白名单 |
SANDBOX_DEFAULT_IMAGE |
config.py | Docker 沙箱默认镜像 |
SANDBOX_OPEN_* |
config.py | OpenSandbox 连接配置组 |
SANDBOX_CONFIG_PATH |
config.py | OpenSandbox server 配置文件路径，默认项目根目录，回退 ~/.sandbox.toml |
DEFAULT_TIMEOUT |
config.py | 默认超时 30s，-1 无限 |
FORCE_SHELL |
config.py | 强制指定 Shell pwsh/cmd/bash/wsl |
ENV_SOURCE |
config.py | 本地执行环境来源: "registry"（注册表重建）/"inherit"（父进程继承） |
ENV_STRIP_NAMES |
config.py | 要剥离的环境变量名列表（精确匹配，双模式生效） |
ENV_DEFAULTS |
config.py | 默认注入到子进程的环境变量 dict（优先级低于 AI env 参数） |
SSH_DEFAULT_TARGET |
config.py | SSH 默认目标 [user@]host[:port] |
SSH_DEFAULT_USER |
config.py | SSH 默认用户名 |
SSH_DEFAULT_PORT |
config.py | SSH 默认端口 22 |
SSH_PERSISTENT |
config.py | SSH 长连接复用 |
WSL_DISTRO / WSL_USER |
config.py | WSL 发行版/用户名 |
OUTPUT_TRUNCATE_LENGTH |
config.py | output_file 截断长度 |
SESSION_DEFAULT_ALIVE_TIMEOUT |
config.py | session 默认 alive 超时 |
SESSION_MAX_OUTPUT_LINES |
config.py | session 输出最大行数 |
SESSION_MAX_OUTPUT_BYTES |
config.py | session 输出最大字节 |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago Changed · +5 lines · +328 tokens per session 17b926c78c00
- 21d ago Changed · +2 lines · +54 tokens per session dbfc84766212
- 29d ago Changed · +3 lines · +237 tokens per session d79e32dde00a
- 1mo ago Changed · +1 lines · +122 tokens per session 8000f273f232
- 1mo ago Changed · +1 lines · +25 tokens per session 5abf9b0f5fa8
- 2mo ago Changed · +3 lines · +194 tokens per session d9202cd4d723
- 2mo ago Changed · +9 lines · +472 tokens per session 212ed08ded72
- 2mo ago First seen · 133 lines · 3,723 tokens per session scan E dbe07940573e
cmd-exec-mcp AGENTS.md is an instructions file published in the GitHub repository YC-CLT/cmd-exec-mcp (0 stars, last pushed 5d ago), licensed MIT. It adds 5,155 tokens to every session, about $0.0206 per session on Opus 5.5. A static security scan graded it E with 4 findings (harvests environment variables, reaches for credential files, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
cmd-exec-mcp AGENTS.md compared with instructions from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| cmd-exec-mcp AGENTS.mdYC-CLT/cmd-exec-mcp | Instructions file | 0 | 5d ago | MIT | E | 5,155 | Codex, OpenCode |
| vscode buildNext.instructions.mdmicrosoft/vscode | Instructions file | 195k | today | MIT | A | 9,719 | GitHub Copilot |
| next.js AGENTS.mdvercel/next.js | Instructions file | 143k | today | MIT | A | 7,461 | Codex, OpenCode |
| vscode oss-third-party-notices.instructions.mdmicrosoft/vscode | Instructions file | 195k | today | MIT | A | 5,685 | GitHub Copilot |
| langchain AGENTS.mdlangchain-ai/langchain | Instructions file | 149k | yesterday | MIT | A | 4,680 | Codex, OpenCode |
| vscode copilot-instructions.mdmicrosoft/vscode | Instructions file | 195k | today | MIT | A | 3,093 | GitHub Copilot |
| vscode model-prompts.instructions.mdmicrosoft/vscode | Instructions file | 195k | today | MIT | A | 2,022 | GitHub Copilot |