Shell quoting for bash, PowerShell and cmd.exe with a parse-back check

$0.005 USDC per call · Developer and security · POST /api/v1/shell-quote · Id shell-quote

Turns up to 50 literal strings into a safely quoted argument for bash/sh (POSIX single-quote method), PowerShell (single-quoted literal) and cmd.exe, for agents that build a command line from untrusted or free-form text, and parses each result back with a model of that shell's rules to prove it yields the original string. It returns `unsupported` for strings cmd.exe cannot carry safely (line breaks and control characters, any %, any double quote) instead of guessing. It does not run a shell, quote a whole command (only one argument at a time), choose an interpreter, or protect against programs that re-interpret their own arguments (eval, sh -c, ssh, cmd /c inside quotes).

What you get

Quoting bugs are command injection; this removes hand-written escaping and shows exactly which strings a Windows cmd.exe line cannot hold.

Call it

Send the JSON body below to https://agents.writerslogic.com/api/v1/shell-quote. An unpaid request answers 402 with the price and how to pay; a request that fails with a 5xx status is not charged.

curl -i -X POST https://agents.writerslogic.com/api/v1/shell-quote \
  -H 'content-type: application/json' \
  -d '{"values":["it'\''s a $HOME; rm -rf /","C:\\Program Files\\app\\","50% off","plain-text.txt"]}'

Input

Field	Type	Required	Description
`values`	array<string; length 0..4096>; max 50 items	yes	Literal argument values; at most 100000 characters in total.
`targets`	array<string; one of "bash", "powershell", "cmd">; max 3 items	no	Shells to quote for; default all three. Status is unsupported when any requested target cannot carry a value.

Example request body

{
  "values": [
    "it's a $HOME; rm -rf /",
    "C:\\Program Files\\app\\",
    "50% off",
    "plain-text.txt"
  ]
}

Result

The response is { "data": ..., "_provenance": ... }. data carries these fields; _provenance is a signed W3C Verifiable Credential with a C2PA-style manifest, checked free at POST /api/v1/verify-provenance.

Field	Type	Required	Description
`status`	string; one of "pass", "fail", "unknown", "unsupported"	no	pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass.
`items`	array<object>	no
`witnesses`	array<object>	no
`versions`	object	no	Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile).
`limits`	array<string>	no
`deterministic`	boolean	no	Always true: pure code, no model.

Pay and connect

Available through: x402 (USDC on Base), MCP. MCP clients reach it through the infra-preflight-kit package.

Machine-readable

This agent as JSON (schemas, example, OpenAPI operation)
Free signed sample response
OpenAPI 3.1 · Catalog · Index of every agent