iterm-mcp
Executes commands, reads terminal output, and sends control characters through an iTerm2 session on macOS.
Delv Safety Grade: D
Score 42/100 · assessed 2026-04-28
iterm-mcp grants Claude full shell execution capabilities through iTerm2 on macOS, including the ability to send control characters and read terminal output. This is extraordinarily powerful but carries significant risk. The maintainer (Ferris Lucas) appears to be a solo developer with limited public profile, and the project is relatively new with minimal community vetting. The permissions model is essentially unrestricted shell access - Claude can execute arbitrary commands, interrupt processes, and read all terminal output. Whilst distributed via npm with a straightforward install, the fundamental security posture is weak: any compromise of Claude's decision-making or prompt injection could lead to arbitrary code execution on your machine. The transparency is reasonable (open source, documented), but the lack of sandboxing or permission scoping makes this a high-risk tool suitable only for isolated development environments where you accept full system compromise as a possibility.
Lethal Trifecta (prompt-injection exposure)
ONE OF THREETerminal control. Reads stdout content.
Green flags
- Distributed via npm with standard package management and versioning
- Open source with visible code for security review
- Clear documentation of capabilities and intended use cases
- No environment variables required reduces credential exposure surface
Red flags
- Unrestricted shell execution with no sandboxing or permission boundaries
- Solo maintainer with limited public track record or organizational backing
- Can send control characters (Ctrl-C, Ctrl-D) to interrupt running processes
- Full read access to all terminal output including potential secrets
- Prompt injection could lead to arbitrary command execution on host system
Permissions requested
Install
npx -y iterm-mcp
Review
Install if you're on macOS, use iTerm2, and regularly find yourself babysitting terminal sessions or SSH workflows. Skip if you're on Linux, use a different terminal, or your command-line work is straightforward enough that manual control is faster. This is a power-user tool for offloading repetitive terminal monitoring, not a general-purpose command runner.
Good at
- Reads terminal output in real time, so Claude can monitor build logs or long-running processes without you tabbing back and forth.
- Sends control characters like Ctrl-C and Ctrl-D, enabling interactive workflows that need more than just command execution.
- Fast setup with npx - no complex installation or dependencies beyond iTerm2.
- Handles SSH sessions and remote workflows, which is genuinely useful for debugging or monitoring remote boxes.
Watch out
- macOS and iTerm2 only - no support for Linux, Windows, or other terminal emulators.
- Gives Claude full terminal access, so you need to be careful with prompts on machines with production or sensitive environments.
- Most useful for repetitive monitoring tasks - if you're just running one-off commands, manual control is often faster.
- Requires Claude Desktop or another supported host with MCP support, so it won't work in the web interface.
Use cases
- interactive shell sessions
- build log watching
- remote ssh workflows
- terminal automation
Getting started
Works with
Similar MCPs
- GitHubFull GitHub API access - manage repos, issues, PRs, and code search. One of the most useful MCPs for any developer workflow.
- GrafanaGrafana Labs' official MCP. Read dashboards, datasources, alerts, and run Loki/Prometheus queries from inside your agent.
- SentryPull live errors, issues, and replays from Sentry into Claude. Great for debugging sessions where the model can see what actually broke in prod.
- MCP CLIInteractive CLI inspector for MCP servers supporting OAuth, tool calls, resource reads, and prompt runs.