[OSPP] Implement a mcp server to run any scripts or commands securely by yexuanyang · Pull Request #3547 · apache/hertzbeat

yexuanyang · 2025-07-04T04:22:59Z

What's changed?

Hello, everyone! Currently, we are looking at monitoring data or alarm data on hertzbeat platform, but we can't make the next step such as automatic recovery, automatic repair, etc. for alarm data or collected data. Now with AI's capabilities, we can automate monitoring and alerting with the help of AI, which generates and decides on its own the repair scripts or tasks for abnormal services on the other end based on the alert information, monitoring information, etc., and then calls the mcp server deployed on the other end to execute them. So I wrote a mcp server and put it under the mcp-servers folder, other mcp servers can be put into this same directory, so that it is easy to add new mcp servers to hertzbeat.

This mcp server currently accomplishes the following:

Execute scripts through the mcp server. Scripts are currently executed from unix-like os using the shibang #! ASCII text executable file in unix-like os using shibang #! in the header, windows bat format is not tested.
There are preset tools that combine a series of common commands to accomplish some information gathering tasks. For example, getting the current disk usage.
Record logs of command and script execution. There may be omissions in the logging of some operations, but this is only the first version.
Command blacklist and operator blacklist. Me. Commands and operators in the blacklist cannot be executed; the blacklist is now configured in config.yaml.

Some things that need to be done in the future:

Command whitelisting. Some commands may have dangerous operators and commands, but administrators still want to allow such commands to be executed, these commands are put into a whitelist, and the program prioritizes checking to see if the command matches one of the whitelisted items, and executes it directly if it matches, and only checks with the blacklist if it doesn't exist.
documentation. Current The documentation is incomplete in the current code, and needs to be filled in later.

Sorry, this pr might be a bit big, I'll try to work with reviewer to ease the pain of review.

Checklist

I have read the Contributing Guide
I have written the necessary doc or comment.
I have added the necessary unit tests and all cases have passed.

1. Add a tool to get the available shell in unix-like machine. 2. Support powershell and script execution

tools

Dev: version 0.1

…6707daac4ad4c1f87f2' git-subtree-dir: mcp-servers/mcp-bash-server git-subtree-mainline: b6b1a48 git-subtree-split: 0f410e5

Validator will check the whitelist firstly and then check the blacklist. Add some comment in config.toml. Whitelist have 'commands' and 'regex' settings, validator full matches the commands and uses the rust crate `regex` to match strings in 'regex'

yexuanyang · 2025-07-22T14:00:40Z

Latest developments:

Command whitelisting. Validator supports the whitelist verification now.
Documentation. Add many documentation comments now.

Unit tests will be added soon.

**Summary** Added 67 unit tests covering all core modules with 100% pass rate. **Test Coverage** - **Config (6 tests)**: TOML parsing, validation, error handling - **Validator (13 tests)**: Command security, whitelist/blacklist, regex patterns - **OAuth (17 tests)**: Authentication flow, token management, security validation - **Bash Server (17 tests)**: Command execution, timeout handling, serialization - **Main (9 tests)**: HTTP handlers, middleware, OAuth mock tests - **Additional OAuth Mock (5 tests)**: Store functionality, authorization flow, token exchange, middleware, error handling

mcp-servers/mcp-bash-server/src/common/validator.rs

mcp-servers/mcp-bash-server/src/common/bash_server.rs

mcp-servers/mcp-bash-server/src/common/validator.rs

Co-authored-by: Yang Yexuan <yyxrust@bupt.edu.cn> Signed-off-by: aias00 <liuhongyu@apache.org>

mcp-servers/mcp-bash-server/src/common/bash_server.rs

Aias00 · 2025-08-31T13:16:46Z

add ci test for ur code, pls

yexuanyang · 2025-09-01T09:13:18Z

I have added CI tests

Aias00 · 2025-09-01T13:04:02Z

hi, codecov is no needed, remove this for fixing ci

yexuanyang · 2025-09-01T14:11:25Z

I didn't add the backend-build workflow which has codecov action and I don't know why these code can not pass the check.

yexuanyang · 2025-09-01T14:15:54Z

It seems to be the bug in action codecov@v4, read this codecov/codecov-action#1280 . Retry the check maybe ok.

yexuanyang · 2025-09-01T14:18:55Z

Maybe try changing the codecov-action to 4.4.0?

Aias00 · 2025-09-02T01:39:04Z

Maybe try changing the codecov-action to 4.4.0?

rerun it, and ci passed 😂

Aias00

LGTM, thx

yexuanyang and others added 16 commits July 3, 2025 21:26

Initial commit

4ad5ab8

WIP: BashServer using Streamable Http connection with MCP Authorization

9730357

WIP: Streamable http and oauth bash_server

8fb7a3e

Change endpoints from /oauth/xx to /xx and use new StreamableHttpService

1e34034

WIP: Add powershell and script execution capability

c93a091

1. Add a tool to get the available shell in unix-like machine. 2. Support powershell and script execution

Set the BIND_ADDRESS from environment variable

7065185

Change the description of bash server

66d4794

Use config.toml to set the host and port

032c1fe

Clippy fix

cd8f0c6

Separate development and production environments and add some preset

3b740fd

tools

Add all preset tools in unix os observation

f0daf56

Add blacklist for commands and symbols

c42f085

Add logs to trace the execution of script or command

a3bc720

Merge pull request apache#2 from yexuanyang/dev

0f410e5

Dev: version 0.1

Add 'mcp-servers/mcp-bash-server/' from commit '0f410e5fad6f5b37f9d16…

dc4af38

…6707daac4ad4c1f87f2' git-subtree-dir: mcp-servers/mcp-bash-server git-subtree-mainline: b6b1a48 git-subtree-split: 0f410e5

Add README.md in mcp-servers directory

05273cb

github-actions bot added the doc Improvements or additions to documentation label Jul 4, 2025

tomsun28 added the OSPP label Jul 4, 2025

tomsun28 changed the title ~~[feature] Implement a mcp server to run any scripts or commands securely~~ [OSPP] Implement a mcp server to run any scripts or commands securely Jul 4, 2025

Merge branch 'master' into master

77eb3e3

tomsun28 requested a review from Aias00 July 5, 2025 09:00

Aias00 and others added 6 commits July 10, 2025 09:29

Merge branch 'master' into master

e68e5be

Merge branch 'master' into master

6756b44

Update doc comments and use the new version of rust-sdk

114fe4c

Merge branch 'apache:master' into master

98b66c4

Merge branch 'master' of github.com:yexuanyang/hertzbeat

3d7b20e

yexuanyang added 2 commits July 24, 2025 17:09

Update README.md

58e7588

Aias00 requested changes Aug 18, 2025

View reviewed changes

mcp-servers/mcp-bash-server/src/common/validator.rs Outdated Show resolved Hide resolved

mcp-servers/mcp-bash-server/src/common/bash_server.rs Show resolved Hide resolved

yexuanyang commented Aug 19, 2025

View reviewed changes

mcp-servers/mcp-bash-server/src/common/bash_server.rs Show resolved Hide resolved

mcp-servers/mcp-bash-server/src/common/bash_server.rs Show resolved Hide resolved

yexuanyang commented Aug 19, 2025

View reviewed changes

Aias00 and others added 5 commits August 19, 2025 18:39

Apply suggestion from @yexuanyang

0da243b

Co-authored-by: Yang Yexuan <yyxrust@bupt.edu.cn> Signed-off-by: aias00 <liuhongyu@apache.org>

Apply suggestion from @yexuanyang

abd2fab

Co-authored-by: Yang Yexuan <yyxrust@bupt.edu.cn> Signed-off-by: aias00 <liuhongyu@apache.org>

[refactor] Validate &str instead of Vec<&OsStr>

33b36aa

Merge branch 'master' into master

e505e4e

Merge branch 'master' into master

ab13da7

Aias00 requested changes Aug 31, 2025

View reviewed changes

mcp-servers/mcp-bash-server/src/common/bash_server.rs Show resolved Hide resolved

[ci] Add ci test for mcp bashserver

d597f86

github-actions bot added the infra label Sep 1, 2025

yexuanyang added 4 commits September 1, 2025 11:25

[fix] Fix error in unix_execute_script

33944db

[feature] Use shlex to split and build a command from string

78fffb4

[format] pass cargo clippy --all-targets

88db929

[fix] Add header license in mcp-bashserver-test.yml

f058fc8

Aias00 marked this pull request as ready for review September 1, 2025 13:03

Merge branch 'master' into master

08d96a1

Merge branch 'master' into master

9a3b6d6

tomsun28 added this to the 1.8.0 milestone Sep 16, 2025

Merge branch 'master' into master

7b235a2

Aias00 approved these changes Sep 22, 2025

View reviewed changes

Aias00 merged commit 586aa53 into apache:master Sep 22, 2025
5 checks passed

github-project-automation bot moved this from To do to Done in Apache HertzBeat Sep 22, 2025

Conversation

yexuanyang commented Jul 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What's changed?

Checklist

Uh oh!

yexuanyang commented Jul 22, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Aias00 commented Aug 31, 2025

Uh oh!

yexuanyang commented Sep 1, 2025

Uh oh!

Aias00 commented Sep 1, 2025

Uh oh!

yexuanyang commented Sep 1, 2025

Uh oh!

yexuanyang commented Sep 1, 2025

Uh oh!

yexuanyang commented Sep 1, 2025

Uh oh!

Aias00 commented Sep 2, 2025

Uh oh!

Aias00 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

yexuanyang commented Jul 4, 2025 •

edited

Loading