Writes input to a terminal session. To press Enter, include a real newline character in the data value (not a literal backslash-n). Real newlines are converted to \\r (carriage return) for PTY compatibility. Omit data to poll for new output (returns buffered output). Use terminal-read to see full...
AI agents invoke terminal-write to trigger actions in Mcp Terminal. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.
Writing input to a terminal session allows execution of arbitrary shell commands. Any text sent with a newline is submitted as a command to the terminal, enabling the full range of system operations including destructive, financial, or other high-impact actions. This is effectively arbitrary code/command execution, making it critical severity due to the unrestricted blast radius.
From the tool's definition Writes input to a terminal session... Real newlines are converted to \r (carriage return) for PTY compatibility
Attacks that exploit this kind of access
Writes input to a terminal session. To press Enter, include a real newline character in the data value (not a literal backslash-n). Real newlines are converted to \\r (carriage return) for PTY compatibility. Omit data to poll for new output (returns buffered output). Use terminal-read to see full terminal history. It is categorised as a Execute tool in the Mcp Terminal MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.
Register the Mcp Terminal MCP server in PolicyLayer and add a rule for terminal-write: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Mcp Terminal. Nothing to install.
terminal-write is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.
Yes. Add a rate_limit block to the terminal-write rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for terminal-write. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
terminal-write is provided by the Mcp Terminal MCP server (unfathomable-siren38/mcp-terminal-server). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Every MCP server has a record like this.
Type a name, get the same breakdown: verified identity, auth posture, risk grade, capabilities, recommended policy.
Teams ship this data inside their own products. See what a licence covers →