Toolofficial publisher

shell (OpenAI)

Tool : A precise action the AI can call · requires openai-api

Shell hosted in a Debian container, network off by default.

The replacement for local_shell: safer, but still code execution.

Docs

Overall score

5.6 /10

Security: serious reservations

Utility

7.0

Reliability

6.0

Security

Serious reservations

Ease

5 min · Technical

Security reflects where data goes, requested permissions and incidents on record at the verification date. It is not a guarantee of zero risk: check the deployment mode and the connections you enable.

What it does, concretely

Some tasks require running real system commands: manipulating files, launching scripts, checking software versions, or processing data. OpenAI's shell tool addresses this need by giving the model access to a full terminal environment, without requiring you to manage the infrastructure yourself.

In practice, the model can execute shell commands either in an OpenAI-hosted container (using the container_auto option) or in a local runtime that you host yourself. Access is available through the Responses API only, not through the Chat Completions API. Network access is disabled by default in hosted containers, which limits data exfiltration risks.

This tool is aimed at developers building agents capable of deterministic processing: calculations, file manipulation, running Python or Node.js scripts, or any task requiring a real terminal environment.

It is not suitable for general public use without technical oversight: executing arbitrary shell commands remains a sensitive operation that requires supervision, allowlists or denylists, and activity logging.

What it offers

·Shell command execution in an OpenAI-hosted container, automatically provisioned via the container_auto option (paid).
·Shell command execution in a local runtime that you host and control yourself.
·Access to a full terminal environment with Python and Node.js available in hosted containers.
·Network disabled by default in hosted containers, with the option to enable it as needed.
·Integration via the Responses API, compatible with multiple languages: JavaScript, Python, Go, Java, Ruby.
·tool_choice parameter to control whether the model uses the tool automatically or only on explicit instruction.
·Access to a /mnt/data directory for file manipulation in hosted containers.

Our tips

Use container_auto to let OpenAI provision and manage the container automatically, which simplifies setup for one-off tasks.
Enable network access only if your use case requires it: leaving it disabled by default significantly reduces the attack surface.
Set up command allowlists or denylists and log all tool activity so you can audit the model's actions.
Use the Responses API, not the Chat Completions API: the shell tool is not available on the latter.
For complex deterministic processing (calculations, multimedia, scripts), prefer hosted containers, which provide a richer and more isolated environment.

Watch out

Executing arbitrary commands is inherently risky: without strict sandboxing, control lists, and logging, a misconfigured agent can cause significant damage.
The shell tool is not accessible via the Chat Completions API, which requires migrating to or adopting the Responses API to use it.

In practice

Price: Paid
Commercial use: Commercial use: yes
Available on: api
Host: openai-api
FR interface: No

Security and data

Rating: Security: serious reservations
Capabilities: readswritesexecutesnetwork
Your data: Data with the vendor
Maintenance: Active

Links and repository checked on 25 October 2026 · added on 1 February 2026

How to install shell (OpenAI)

1. Obtain an OpenAI API key and enable access to the Responses API from your dashboard. 2. Install the official SDK in your language of choice (e.g. npm install openai or pip install openai). 3. Configure your API key via the OPENAI_API_KEY environment variable. 4. In your Responses API call, add a tool of type shell with the container_auto environment for a hosted container, or configure your own local runtime. 5. Set tool_choice to auto to let the model decide when to use the shell. 6. Security note: enable network access only if necessary, implement command allowlists, and log all tool activity.

tools=[{"type":"shell"}]

Official documentation ↗

In the same category

Whole category Code →