AISH brings on-demand MCP tools into the Linux shell

AISH’s first 1.0 release candidate adds MCP tools without putting every server’s full tool catalog into each model request. The Linux shell’s November 2 release announces a gateway that lets the model discover a server’s tools when it needs them, alongside approvals bound to the precise arguments being executed.

AISH is a standalone shell for operations and troubleshooting, rather than a plugin for Pi, OpenCode or Codex. Its existing workflow mixes ordinary interactive terminal programs with natural-language requests beginning with ;. The new MCP client extends that workflow to tools provided by configured local or remote servers.

Discover first, call second

According to the English release notes, each server exposes a single mcp__<server> gateway by default. The model can list tools, inspect a tool’s schema and then call it. An optional expose: tools setting additionally supplies individual remote-tool schemas for direct calling. The announcement describes a context-management choice; it does not establish a measured token saving or performance gain.

Servers are configured under mcp.servers in ~/.config/aish/config.yaml, using stdio or Streamable HTTP. The /mcp menu offers server addition, connection tests, tool inspection and trust settings. The project says changes apply immediately to the affected server, with no need to restart the shell or manually edit YAML.

Approval follows the actual call

The release says automatic approval requires both an explicit user trust: allow declaration and effective read-only side effects. Write, network and undeclared tools ask for confirmation; trust: block refuses execution. Server annotations can tighten the declared policy. Approval is bound to an argument digest, so changing the arguments requires another approval.

Calls also have a default 30-second request deadline and bounded output, according to the announcement. These are documented controls, not an independent security audit or a guarantee that an external server is safe.

A release candidate with a specific installation caveat

GitHub marks this version as a prerelease. At review time, its attached binary bundle was Linux ARM64, accompanied by a checksum file. The English README’s one-line installer explicitly resolves the latest stable version, so it should not be assumed to select this candidate. The README also documents running from source; users need a compatible Rust environment and must select the intended revision.

AISH’s Apache 2.0 license covers the shell code. Cloud model access still needs configured credentials and may incur provider charges; MCP servers can have their own credentials and permissions. The README documents local-model support, but this review did not test a local endpoint or install the candidate. Its optional sandbox pre-run remains disabled by default and is separate from the newly announced MCP approval flow.