io.github.KamaruSama/mcp-sudo
Run sudo commands with a Fernet-encrypted password bound to machine-id + user.
Open source Open in the app JSON README (API)
About
Run sudo commands with a Fernet-encrypted password bound to machine-id + user.
Details
- Kind
- MCP servers
- Topic
- No topic detected
- Publisher
- kamarusama
- Origin
- official
- Category
- ferramentas
- Transport
- local
- Version
- 1.0.1
- Last push
- 2026-04-19T21:07:19Z
- Repository state
- ativo
- Language
- Python
- License
- NOASSERTION
- Added
- 2026-08-29 03:02:00
- Updated
- 2026-08-29 03:02:00
- Origin id
io.github.KamaruSama/mcp-sudo
README
# mcp-sudo <!-- mcp-name: io.github.KamaruSama/mcp-sudo --> **MCP server for running `sudo` commands with encrypted password storage.** Exposes 4 tools to persist a sudo password (encrypted with a machine-bound key) and invoke privileged commands without re-entering credentials. Designed for single-user Linux workstations. 📖 **[อ่านภาษาไทย →](README.th.md)** --- ## Tools | Tool | Purpose | |---|---| | [`store_password`](docs/en/tools/store_password.md) | Store sudo password (encrypted, one-time) | | [`sudo_exec`](docs/en/tools/sudo_exec.md) | Run shell command with sudo | | [`has_password`](docs/en/tools/has_password.md) | Check if password is stored | | [`clear_password`](docs/en/tools/clear_password.md) | Remove stored password | --- ## Security model - Password is encrypted with **Fernet** (AES-128-CBC + HMAC-SHA256). - Encryption key is **derived** from `machine-id` + `USER` — never stored on disk. - Decryption only succeeds on the same machine with the same user. - Encrypted blob lives at `~/.config/claude-sudo-mcp/credential.enc` (chmod 600). This is **not a secrets manager**. Treat this as "remember my sudo password for this session on this box." If your machine-id is copied to another box or another user reads the MCP process, the password can be recovered. --- ## Install ```bash cd /path/to/mcp-sudo uv venv --python 3.12 .venv uv pip install --python .venv/bin/python mcp cryptography claude mcp add sudo -s user -- \ /path/to/mcp-sudo/.venv/bin/python /path/to/mcp-sudo/server.py ``` On first use, call `store_password` once to cache credentials. --- ## Support the project ❤ - **Ko-fi:** https://ko-fi.com/kamaru --- ## Contact - **Portfolio / general:** k.kamarux@gmail.com - **Commercial / licensing:** contact@likezara.com --- Copyright © 2026 **likezara™**. All rights reserved. Developed by **Kamaru** (pen name).