Module executable_ban 

MCP command validation — deny-list, permit-list, metacharacter scan.

Spec §6.4 step 2: reject executable content in .muragent packages.

Functions

check_extension

Validate a file path inside the tarball for executable content.

check_mcp_command

Validate an MCP server command string.

check_mode_bits

Check tar entry mode bits: regular files with execute bit are rejected. Directories with execute bit are fine.