run_terminal_command

Diagnostics & system · macOS · Windows

Effect: execute (strongest supported action). Status: gated.

Gated means the tool requires an installed app, a connected account, permission, or runtime availability. Check those requirements on the listed platform before using it.

macOS

Purpose

Runs a shell command on the user's Mac and returns its output. Always active. Disabled when LMCP is in read-only mode. Three kinds of command are refused, because they cannot be undone: formatting or overwriting a disk (mkfs, newfs, fdisk, diskutil erase/partition, dd to or from a disk device), a recursive delete of a system folder, of the user's home folder or one of its data folders (Documents, Desktop, Downloads, Library, Pictures, Movies, Music), of everything directly inside one of them, or of a target or folder the command's text does not settle (a variable, a command substitution, a cd inside a subshell), and a fork bomb. A command that names a credential location (keychains, ~/.ssh private keys, ~/.aws, ~/.config/gh, browser logins, another user's home) writes a file that runs code later (LaunchAgents, shell startup files, AI clients' folders), drives another app with a script, opens a script or a terminal app, controls a system service or power, pipes a downloaded script into a shell, writes to a device file or changes permissions recursively on a system path is NOT refused: the preview and the result carry a warning that says what it does. Before confirming, tell the user what it will read or change, unless they asked for exactly this. The warnings read only the command's text, so a command that hides a path gets none. Commands run in a macOS sandbox that protects only Local MCP itself: the terminal cannot open or change Local MCP's own files by their path (its settings and token, binaries, activity log, messaging and web sessions, start-up item), cannot talk to its socket, and cannot open the files of an account whose Read or Write box the user turned off. No setting re-opens these. Because of that sandbox, setuid system programs other than ps and top cannot start (sudo, su, crontab, at, traceroute): the warning says so before the command runs, and the `log` command does not run. Inside the sandbox SwiftPM needs --disable-sandbox. Destructive: it previews the command first — pass confirm:true to actually run it. Output and runtime are capped.

Required inputs

command — The shell command to run (a single command line, executed with /bin/zsh -lc).

Permissions and confirmation

Explicit confirmation parameter: inspect the schema and tool description before any real call. The documentation example keeps confirm false. Obtain user authorization before performing the action.

Use only the apps, accounts and resources authorized by the user on this platform. Consult this tool's platform-specific description for its connection and permission requirements; this catalog does not assert additional OAuth scopes or OS entitlements.

Full input schema — macOS

{
  "properties": {
    "command": {
      "description": "The shell command to run (a single command line, executed with /bin/zsh -lc).",
      "type": "string"
    },
    "confirm": {
      "description": "Must be true to actually run. Without it, a preview of the command is returned.",
      "type": "boolean"
    },
    "timeout_seconds": {
      "description": "Max seconds to run before it is terminated (default 20, max 60).",
      "type": "integer"
    },
    "working_dir": {
      "description": "Optional absolute working directory. Defaults to the user's home directory.",
      "type": "string"
    }
  },
  "required": [
    "command"
  ],
  "type": "object"
}

Documentation example

Do not execute this example. These concrete inputs refer to a fictional demonstration dataset. Resolve real handles and obtain user authorization before any real call.

{
  "command": "echo Hello from LMCP",
  "confirm": false
}

Windows