Skip to content

fix(cli): avoid Windows shell for mcp dev#2524

Open
Genmin wants to merge 1 commit intomodelcontextprotocol:mainfrom
Genmin:codex/fix-mcp-dev-windows-shell
Open

fix(cli): avoid Windows shell for mcp dev#2524
Genmin wants to merge 1 commit intomodelcontextprotocol:mainfrom
Genmin:codex/fix-mcp-dev-windows-shell

Conversation

@Genmin
Copy link
Copy Markdown

@Genmin Genmin commented May 1, 2026

Summary

  • remove Windows shell=True from the mcp dev inspector subprocess path
  • resolve the Windows npx executable with shutil.which() instead of probing through a shell
  • add a regression test that exercises a path containing & and verifies the subprocess receives an argument list without shell dispatch

Fixes #1257.

Validation

  • uv run pytest tests/cli -q
  • uv run ruff check src/mcp/cli/cli.py tests/cli/test_utils.py
  • uv run pyright src/mcp/cli/cli.py tests/cli/test_utils.py
  • git diff --check

@Genmin Genmin force-pushed the codex/fix-mcp-dev-windows-shell branch 2 times, most recently from de8aa19 to f351681 Compare May 1, 2026 01:37
@Genmin Genmin force-pushed the codex/fix-mcp-dev-windows-shell branch from f351681 to a176ccc Compare May 1, 2026 01:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Don’t use shell=True in mcp dev subprocess on Windows (command injection risk)

1 participant