Key principle: prefer a reviewed executable plus fixed argument array. Avoid invoking a general-purpose shell unless it is strictly necessary and fully understood.
High-signal patterns
bash -c,sh -c,cmd.exe /c, or PowerShell entrypoints- Command separators such as
;,&&, or|| - Command substitution using backticks or
$(...) - Downloads piped directly to a shell
sudoordoasprivilege escalation- Encoded PowerShell payloads that conceal the executed text
Why argument arrays are not always safe
An array is safer only when the client launches the executable directly. If the executable is itself a shell, its later arguments become code. Review the complete launch path and do not assume JSON quoting neutralizes a shell command.
Safer setup pattern
{
"mcpServers": {
"example": {
"command": "/opt/reviewed/bin/example-mcp",
"args": ["--workspace", "/projects/example"]
}
}
}Pin and verify the executable separately, avoid downloading at every launch, use a dedicated low-privilege account where practical, and scope accessible directories.
What static analysis misses
A clean launcher may still execute unsafe code internally. A package can change ownership, a server can expose dangerous tools, and tool output can carry indirect prompt injection. Follow config scanning with publisher verification, source review, runtime tool inspection, and sandboxing.
Check command and args now
Find shell and execution patterns without running the server.
Open the MCP command checker →