MCP server that runs sudo via a native OS password dialog so the password never enters the model context.