From bda779380ee35ef3cd99126b42fa39aedf4beecb Mon Sep 17 00:00:00 2001 From: Levi Neely Date: Fri, 6 Mar 2026 15:03:26 +0100 Subject: [PATCH] anvilmcp: use single quotes for bash arg escaping Prevents shell variable expansion in tool args. $VAR now stays literal instead of expanding to empty string. --- cmd/anvilmcp/main.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/cmd/anvilmcp/main.go b/cmd/anvilmcp/main.go index cbfb053..64abd4f 100644 --- a/cmd/anvilmcp/main.go +++ b/cmd/anvilmcp/main.go @@ -185,10 +185,11 @@ func handleToolCall(req MCPRequest) { code = toolCode // For bash with args, wrap script to receive positional params if len(toolArgs) > 0 { - // Escape args for bash array + // Escape args for bash using single quotes (prevents all expansion) var escaped []string for _, arg := range toolArgs { - escaped = append(escaped, fmt.Sprintf("%q", arg)) + // Replace ' with '\'' (end quote, escaped quote, start quote) + escaped = append(escaped, "'"+strings.ReplaceAll(arg, "'", "'\\''")+"'") } code = fmt.Sprintf("set -- %s\n%s", strings.Join(escaped, " "), code) }