Shellfirm's MCP server exposes its risk analysis and safety tooling to AI agents and automation platforms. Once running, clients can invoke the MCP endpoints to check whether a given shell command is risky, retrieve suggested safer alternatives, obtain detailed explanations of why a command is dangerous, and fetch the active safety policy for the current project. Tools available via the MCP surface include: check_command (analyzes a command and returns severity, matched rules, and alternatives), suggest_alternative (offers safer replacements), explain_risk (provides a narrative about the risk and impact), and get_policy (reads the current shellfirm configuration and project policy). This enables agents like Claude Code or Cursor to pre-screen or safely modify commands before execution in automated workflows.

Prerequisites:

• Node.js (v14+ recommended) and npm installed on the host
• Access to the MCP server package (either built-in server bundle or source)

Installation steps:

1. Install dependencies for the MCP server package (if distributing as a Node.js project): npm install

2. Build or prepare the server bundle if required (depends on your release process): npm run build

3. Start the MCP server (example using the included node entry): npm run start

   or if you run a built dist: node dist/server.js

4. Verify the server is running and listening (default port may be 3000 or as configured): curl http://localhost:3000/health

5. Configure your MCP client to point at the running server using the provided mcp_config. If you deploy in a container or remote environment, adjust the host/port accordingly.

Notes and tips:

• Ensure your environment variables are set for any required API keys or debugging flags (for example SHFIRM_API_KEY).
• The MCP server may expose multiple endpoints; use get_policy to verify the active configuration for a given project.
• If running behind a reverse proxy or in Kubernetes, ensure appropriate network policies allow the MCP endpoint to be reached by AI agents.
• For CI/CD integrations, consider enabling a minimal risk threshold by adjusting the severity levels (Critical/High/Medium/Low/Info) in your policy file.
• If you encounter authentication or rate-limit issues, confirm that the API keys and quotas for the underlying shellfirm service are correctly configured and that the MCP server is allowed to access them.
• Logging is typically emitted in JSON-lines format for audit trails; ensure log sinks are configured appropriately for your environment.