mcpField
M
mcp-sudo

mcp-sudo

Local
github.com/KamaruSamaDeveloper Tools0Updated 28w ago
Repository

About mcp-sudo

mcp-sudo is an MCP server for single-user Linux workstations that runs privileged commands without repeatedly entering a sudo password. It stores the credential encrypted with a key derived from the machine ID and user.

Key features

  1. 01Store an encrypted sudo password
  2. 02Run shell commands with sudo
  3. 03Check whether a password is stored
  4. 04Clear the stored password

Use cases

  1. 01Run privileged commands through an MCP client
  2. 02Avoid re-entering sudo credentials during a session
  3. 03Check or remove cached sudo credentials

MCP support

The server exposes four tools for storing and checking a sudo password, executing privileged shell commands, and clearing the stored password.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "kamarusama-mcp-sudo": {
      "command": "uvx",
      "args": [
        "mcp-sudo"
      ]
    }
  }
}
Run commanduvx mcp-sudo

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
pypimcp-sudo1.0.1

Tools

No tool list yet

Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.

Details

From the project README

mcp-sudo

MCP server for running sudo commands with encrypted password storage.

Exposes 4 tools to persist a sudo password (encrypted with a machine-bound key) and invoke privileged commands without re-entering credentials. Designed for single-user Linux workstations.

📖 อ่านภาษาไทย →

Tools

ToolPurpose
store_passwordStore sudo password (encrypted, one-time)
sudo_execRun shell command with sudo
has_passwordCheck if password is stored
clear_passwordRemove stored password

Security model

  • Password is encrypted with Fernet (AES-128-CBC + HMAC-SHA256).
  • Encryption key is derived from machine-id + USER — never stored on disk.
  • Decryption only succeeds on the same machine with the same user.
  • Encrypted blob lives at ~/.config/claude-sudo-mcp/credential.enc (chmod 600).

This is not a secrets manager. Treat this as "remember my sudo password for this session on this box." If your machine-id is copied to another box or another user reads the MCP process, the password can be recovered.

Install

cd /path/to/mcp-sudo
uv venv --python 3.12 .venv
uv pip install --python .venv/bin/python mcp cryptography

claude mcp add sudo -s user -- \
  /path/to/mcp-sudo/.venv/bin/python /path/to/mcp-sudo/server.py

On first use, call store_password once to cache credentials.

Support the project ❤

Contact

Copyright © 2026 likezara™. All rights reserved. Developed by Kamaru (pen name).

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.