Super Windows CLI MCP Server
An enhanced fork of the Windows CLI MCP Server providing unrestricted system access to Windows environments via a command-line interface (MCP).
Based on: win-cli-mcp-server by SimonB97.
⚠️ CRITICAL SECURITY WARNING ⚠️
This server is designed to run with SYSTEM-level privileges on Windows. This grants it complete and unrestricted access to the entire operating system, including all files, processes, and configuration settings.
- DO NOT install or run this server unless you fully understand the implications of granting SYSTEM-level access.
- ONLY use this server in highly trusted environments where you have full control over network access.
- NETWORK SECURITY IS PARAMOUNT: Since application-level restrictions are minimal by design, rely heavily on firewalls, network segmentation, and strict access control lists (ACLs) to protect the machine running this server.
- REVIEW THE CONFIGURATION CAREFULLY: Pay close attention to
allowedPaths,blockedCommands, and other security settings inconfig.json. A misconfiguration can easily expose your system.
Use this software responsibly and at your own risk. The maintainers assume no liability for misuse or security breaches resulting from its use.
Features
- Complete access to Windows shell environments (PowerShell, CMD, Git Bash - configurable).
- Unrestricted command execution (configurable via
config.json). - Full file system access (configurable via
config.json). - SYSTEM-level service installation via NSSM for persistence and auto-recovery.
- Automatic service recovery features provided by NSSM.
- Network binding controls (intended, but primarily managed at the network/firewall level).
- Disabled PowerShell telemetry for enhanced privacy.
- Process reuse for performance (for shells).
- Extended timeouts for long-running operations (configurable).
Prerequisites
Before you begin, ensure you have the following installed:
- Node.js: Version 18.0.0 or later. Download from nodejs.org. (Includes npm).
- NSSM (Non-Sucking Service Manager): Required for reliable service installation. Download the latest version from nssm.cc.
Installation (Using NSSM - Recommended)
This method installs the server as a persistent Windows service that runs with SYSTEM privileges and starts automatically.
-
Clone or Download:
- Clone this repository:
git clone <repository-url> - Or download the source code
.zipand extract it to a suitable location (e.g.,C:\Servers\SuperWinCLIServer). Avoid user profile folders.
- Clone this repository:
-
Place NSSM:
- Download NSSM from nssm.cc.
- Extract the zip file.
- Copy the
nssm.exefile from the appropriate architecture folder (win32orwin64) into the root directory of this project (the same folder asinstall-service.ps1).
-
Install Dependencies & Build:
- Open a terminal (PowerShell or CMD) in the project's root directory.
- Run:
npm install - This command installs necessary Node.js packages and automatically runs
npm run buildto compile the TypeScript code into thedistfolder.
-
Configure
config.json:- Copy: Make a copy of
config.sample.jsonand name itconfig.jsonin the project's root directory. - Edit: Open
config.jsonand carefully review and modify the settings:security.allowedPaths: CRITICAL! Change this from the sample paths to the actual directories the server needs access to. For security, be as specific as possible. Start with the project directory itself if unsure (e.g.,"C:\\Servers\\SuperWinCLIServer"- remember double backslashes\\). The service runs as SYSTEM, so paths must be valid for that account.security.blockedCommands/blockedArguments: Review the default lists. Add or remove commands/arguments based on your security policy.shells: Enable/disable shells (PowerShell, CMD, Git Bash) and verify thecommandpath (especially for Git Bash).ssh: Configure if you intend to use the SSH execution feature (disabled by default).
- Save the
config.jsonfile.
- Copy: Make a copy of
-
Run Installation Script:
- Open PowerShell as Administrator.
- Navigate to the project's root directory (
cd C:\Servers\SuperWinCLIServer). - Execute the installation script:
.\install-service.ps1 - This script uses NSSM to install and configure the
MCPServerservice to runnode.exe dist/index.jsasLocalSystem, starting automatically.
-
Verify Service Status:
- In the same administrative PowerShell window, run:
Get-Service MCPServer - The status should be
Running. If it'sStopped, check the NSSM logs or Windows Event Viewer (Application and System logs) for errors.
- In the same administrative PowerShell window, run:
Configuration (config.json) Details
security:maxCommandLength: Max characters allowed in a command string.blockedCommands: Array of command names (without extension) to block (case-insensitive).blockedArguments: Array of exact arguments to block (case-insensitive).allowedPaths: Crucial setting. Array of absolute paths. IfrestrictWorkingDirectoryis true, commands can only be executed if their working directory starts with one of these paths. Paths are compared case-insensitively after normalization. Use double backslashes (e.g.,"C:\\Tools\\Scripts").restrictWorkingDirectory: Boolean. If true, enforce theallowedPathscheck for the working directory. Highly recommended to keeptrue.logCommands: Boolean. If true, executed commands and their output (truncated) are stored in memory (up tomaxHistorySize).maxHistorySize: Max number of commands to keep in the in-memory history.commandTimeout: Seconds before a running command is killed automatically.enableInjectionProtection: Boolean. If true, attempts to block shell operators (&,|,;, etc. defined per shell) in commands.
shells: Configure available local shells (powershell, cmd, gitbash).enabled: Boolean. Allow use of this shell.command: Path to the shell executable.args: Array of default arguments passed to the shell before the user's command.blockedOperators: Array of strings/characters to block within commands for this specific shell (used ifenableInjectionProtectionis true).
ssh: Configure remote command execution via SSH.enabled: Boolean. Enable thessh_executeandssh_disconnecttools.connections: Object containing named connection configurations (host, port, username, password/privateKeyPath).
- Configuration Merging: When
config.jsonis loaded, if it contains asecurityorshellssection, that entire section replaces the default configuration for that section. It does not merge individual fields withinsecurityorshells. Thesshsection is merged more granularly. Ensure yourconfig.jsonincludes all necessary fields for these sections if you customize them.
Service Management (NSSM)
Once installed via install-service.ps1, you can manage the service using standard Windows tools or NSSM commands from an administrative PowerShell/CMD in the project directory:
- Start:
Start-Service MCPServeror.\nssm.exe start MCPServer - Stop:
Stop-Service MCPServeror.\nssm.exe stop MCPServer - Restart:
Restart-Service MCPServeror.\nssm.exe restart MCPServer - Status:
Get-Service MCPServeror.\nssm.exe status MCPServer - Edit Configuration (Advanced):
.\nssm.exe edit MCPServer(Opens the NSSM GUI editor) - View Configuration:
.\nssm.exe dump MCPServer
Uninstallation (NSSM)
- Open PowerShell as Administrator.
- Navigate to the project's root directory.
- Execute the uninstallation script:
.\uninstall-service.ps1 - This uses NSSM to stop and remove the
MCPServerservice.
Alternative Execution (Manual/Debug)
You can run the server directly without installing it as a service for testing or debugging purposes:
- Ensure you have run
npm install. - Ensure
config.jsonexists and is configured. - Open a normal terminal (PowerShell/CMD) in the project root.
- Run:
npm run start - The server will run in the foreground. Press
Ctrl + Cto stop it.
License
This project is licensed under the MIT License - see the LICENSE file for details.