system_shell

What system_shell does on Claude Mobile

AI agents invoke system_shell to trigger actions in Claude Mobile. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why system_shell is rated High

This tool allows execution of arbitrary shell commands on the target device, giving an AI agent the ability to run any command supported by the device's shell. While not inherently destructive (the agent could theoretically limit itself to safe commands), shell command execution is an Execute category risk: the effects depend entirely on the arguments provided, and a single malicious or misconfigured command can…

From the tool's definition Tool name 'system_shell' and description 'Execute a shell command on the device' with explicit mention of shell metacharacters handling. The tool directly executes arbitrary shell commands on a connected mobile device via ADB or simctl.

Risk signalsAdmin/system-level operation

The rule that runs system_shell safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Claude Mobile, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For system_shell, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "system_shell": {
      "limits": [
        {
          "counter": "system_shell_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about system_shell