Mcp Sudo
Lets Claude run privileged Linux commands without prompting for your sudo password every time. You call store_password once to encrypt and cache your credentials using Fernet with a key derived from your machine ID and username, then use sudo_exec to run any shell command as root. The encrypted blob lives in your config directory with restrictive permissions. The security model assumes you trust the machine and user account. It's designed for single-user workstations where you want Claude to install packages, modify system files, or restart services without breaking flow. Also includes has_password and clear_password for credential lifecycle management.
- tools
- 4
- transport
- STDIO
- last updated
- Apr 19, 2026
Tools
4 toolsPublic tool metadata for what this MCP can expose to an agent.
store_passwordStore sudo password (encrypted, one-time)
Store sudo password (encrypted, one-time)
No parameter schema in public metadata yet.
sudo_execRun shell command with sudo
Run shell command with sudo
No parameter schema in public metadata yet.
has_passwordCheck if password is stored
Check if password is stored
No parameter schema in public metadata yet.
clear_passwordRemove stored password
Remove stored password
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageReadme
mcp-sudo
MCP server for running sudo commands with encrypted password storage.
Exposes 4 tools to persist a sudo password (encrypted with a machine-bound key) and invoke privileged commands without re-entering credentials. Designed for single-user Linux workstations.
Tools
| Tool | Purpose |
|---|---|
store_password | Store sudo password (encrypted, one-time) |
sudo_exec | Run shell command with sudo |
has_password | Check if password is stored |
clear_password | Remove stored password |
Security model
- Password is encrypted with Fernet (AES-128-CBC + HMAC-SHA256).
- Encryption key is derived from
machine-id+USER— never stored on disk. - Decryption only succeeds on the same machine with the same user.
- Encrypted blob lives at
~/.config/claude-sudo-mcp/credential.enc(chmod 600).
Details
- Repository
- github.com/kamarusama/mcp-sudo
- Package
mcp-sudo- Transport
- STDIO
- Registry
- MCP registry, active