fix(server): convert command list to string

[MR2011]

As discussed in #46 the MCP server throws the following error:

kali-server-mcp --debug
2026-04-04 08:47:43,445 [INFO] Starting Kali Linux Tools API Server on 127.0.0.1:5000
 * Serving Flask app 'server'
 * Debug mode: on
2026-04-04 08:47:43,468 [INFO] WARNING: This is a development server. Do not use it in a production deployment. Use a production WSGI server instead.                               
 * Running on http://127.0.0.1:5000
2026-04-04 08:47:43,468 [INFO] Press CTRL+C to quit
2026-04-04 08:47:43,482 [INFO]  * Restarting with watchdog (inotify)
2026-04-04 08:47:43,609 [INFO] Starting Kali Linux Tools API Server on 127.0.0.1:5000
2026-04-04 08:47:43,616 [WARNING]  * Debugger is active!
2026-04-04 08:47:43,622 [INFO]  * Debugger PIN: 162-153-112
2026-04-04 08:48:40,628 [INFO] Executing command: ['nmap', '-sV', '-p', '80', '10.129.228.217']
2026-04-04 08:48:40,629 [ERROR] Error in nmap endpoint: CommandExecutor expects a string, but got list
2026-04-04 08:48:40,633 [ERROR] Traceback (most recent call last):
  File "/usr/share/mcp-kali-server/server.py", line 200, in nmap
    result = execute_command(command)
  File "/usr/share/mcp-kali-server/server.py", line 149, in execute_command
    return executor.execute()
           ~~~~~~~~~~~~~~~~^^
  File "/usr/share/mcp-kali-server/server.py", line 68, in execute
    raise ValueError(f"CommandExecutor expects a string, but got {type(self.command).__name__}")
ValueError: CommandExecutor expects a string, but got list

2026-04-04 08:48:40,636 [INFO] 127.0.0.1 - - [04/Apr/2026 08:48:40] "POST /api/tools/nmap HTTP/1.1" 500 -

I confirmed that the solution provided by @0liwer in #46 (comment) is working:

Add type conversion in execute_command() — this fixes ALL
endpoints at once without changing every individual endpoint:

def execute_command(command) -> Dict[str, Any]:
    if isinstance(command, list):
        command = " ".join(command)
    executor = CommandExecutor(command)
    return executor.execute()

[kevinmcruzp]

Great fix! This resolves the issue effectively for most cases.

One small suggestion worth considering: using shlex.quote when joining
the list would make it more robust against arguments that contain spaces,
such as passwords with spaces in the Hydra endpoint or file paths with
spaces in the John endpoint.

For example, with the current fix:

["hydra", "-t", "4", "-l", "admin", "-p", "my secret pass", "192.168.1.1", "ssh"]
# becomes → "hydra -t 4 -l admin -p my secret pass 192.168.1.1 ssh"
# shell splits "my secret pass" into 3 separate arguments ❌

With shlex.quote:

command = " ".join(shlex.quote(c) for c in command)
# becomes → "hydra -t 4 -l admin -p 'my secret pass' 192.168.1.1 ssh"
# shell treats 'my secret pass' as a single argument ✅

The suggested change would be:

def execute_command(command) -> Dict[str, Any]:
    if isinstance(command, list):
        command = " ".join(shlex.quote(c) for c in command)  # shlex.quote instead of just join
    executor = CommandExecutor(command)
    return executor.execute()

I tested both versions locally and confirmed the difference in the server logs:

# join only
Executing command: hydra -t 4 -l admin -p minha senha secreta 127.0.0.1 ssh

# shlex.quote
Executing command: hydra -t 4 -l admin -p 'minha senha secreta' 127.0.0.1 ssh

Since shlex is already imported in the file, it would be a one-word change.
That said, for typical pentesting targets (IPs, domains) this PR works perfectly as-is. 👍

Tested on: Kali Linux 2026.1 (ARM64) — MacBook M4 Pro Apple Silicon

[MR2011]

Added shlex.quote @kevinmcruzp @Wh0am123

[M-iilk]

This bug has been officially tracked in the Kali Linux Bug Tracker as #0009610, confirming it affects users of the mcp-kali-server apt package. Since the apt package is built from this repo's main branch, merging this PR would resolve the issue for all Kali users installing via sudo apt install mcp-kali-server .