@aaarc/handfree-ssh-mcp 1.0.0 → 1.0.2

package/README.md

@@ -8,76 +8,74 @@ A hands-free SSH automation tool via MCP. Fork of [ssh-mcp-server](https://githu
 
 ## 🎯 Philosophy
 
-The original ssh-mcp-server requires passing credentials and options via CLI arguments every time. That's tedious.
-
-**handfree-ssh-mcp** takes a different approach:
-
-1. **Reuse your existing `~/.ssh/config`** automatically, or configure servers once in YAML
-2. **Set your security whitelists** per server through a YAML overlay
-3. **Let the LLM call whatever it needs** - hands-free
+The original ssh-mcp-server requires passing credentials and options via CLI arguments every time. That's tedious.
+
+**handfree-ssh-mcp** takes a different approach:
+
+1. **Reuse your existing `~/.ssh/config`** automatically, or configure servers once in YAML
+2. **Set command policies** per server through a YAML overlay
+3. **Let the LLM call whatever it needs** - hands-free
 
 Less manual interventions. Just autonomous SSH execution with safeguards.
 
 ## ✨ What's New
 
-| Feature | Original | handfree-ssh-mcp |
-|---------|----------|------------------|
-| Configuration | CLI args | **OpenSSH `~/.ssh/config` + optional YAML overlay** |
-| Multi-server | Messy `--ssh` flags | **Clean YAML structure** |
-| Whitelists | Single comma-separated string | **Per-server arrays** |
-| Streaming | Not supported | **Real-time output with `stream` param** |
-| Discoverability | None | **`show-whitelist` tool for LLM** |
+| Feature | Original | handfree-ssh-mcp |
+|---------|----------|------------------|
+| Configuration | CLI args | **OpenSSH `~/.ssh/config` + optional YAML overlay** |
+| Multi-server | Messy `--ssh` flags | **Clean YAML structure** |
+| Command policy | Single comma-separated whitelist | **Blacklist mode by default, optional whitelist mode** |
+| Streaming | Not supported | **Real-time output with `stream` param** |
+| Discoverability | None | **`show-whitelist` tool for LLM** |
 
 ## 🚀 Quick Start
 
-### 1. Use your existing `~/.ssh/config`
-
-If you already have:
-
-```sshconfig
-Host dev
-  HostName 192.168.1.100
-  User root
-  IdentityFile ~/.ssh/id_ed25519
-```
-
-you can start the MCP without a YAML file:
-
-```json
-{
-  "mcpServers": {
-    "ssh": {
-      "command": "npx",
-      "args": ["-y", "handfree-ssh-mcp", "--enable-servers", "dev"]
-    }
-  }
-}
-```
-
-`--enable-servers` is optional. If you omit it, every concrete `Host` entry loaded from `~/.ssh/config` (plus YAML entries, if any) is enabled.
-
-### 2. Optional: create `servers.yaml` for policies or overrides
-
-```yaml
-sshConfig: true  # default; loads ~/.ssh/config before applying this YAML
-
-servers:
-  dev:  # Server name - use this in --enable-servers
-    # host / port / username / privateKey can be omitted when dev exists in ~/.ssh/config.
-    # Values here override the OpenSSH config entry when present.
-    whitelist:
-      - "^ls.*$"
-      - "^cat.*$"
-      - "^pwd$"
-      - "^docker.*$"
-      - "^git.*$"
-      # Add whatever commands you trust the LLM to run
+### 1. Use your existing `~/.ssh/config`
+
+If you already have:
+
+```sshconfig
+Host dev
+  HostName 192.168.1.100
+  User root
+  IdentityFile ~/.ssh/id_ed25519
+```
+
+you can start the MCP without a YAML file:
+
+```json
+{
+  "mcpServers": {
+    "ssh": {
+      "command": "npx",
+      "args": ["-y", "@aaarc/handfree-ssh-mcp", "--enable-servers", "dev"]
+    }
+  }
+}
+```
+
+`--enable-servers` is optional. If you omit it, every concrete `Host` entry loaded from `~/.ssh/config` (plus YAML entries, if any) is enabled.
+
+### 2. Optional: create `servers.yaml` for policies or overrides
+
+```yaml
+sshConfig: true  # default; loads ~/.ssh/config before applying this YAML
+
+servers:
+  dev:  # Server name - use this in --enable-servers
+    # host / port / username / privateKey can be omitted when dev exists in ~/.ssh/config.
+    # Values here override the OpenSSH config entry when present.
+    # commandMode defaults to blacklist: commands are allowed unless they
+    # match the built-in dangerous blacklist or a pattern below.
+    blacklist:
+      - "^docker system prune.*$"
 
-  prod:
-    host: XXXXX
-    port: 22
+  prod:
+    host: XXXXX
+    port: 22
     username: deploy
     privateKey: ~/.ssh/id_rsa
+    commandMode: whitelist
     whitelist:
       - "^ls.*$"        # Read only
       - "^cat.*$"
@@ -86,26 +84,26 @@ servers:
       - "^rm.*$"        # Never allow delete
       - "^shutdown.*$"
       - "^reboot.*$"
-```
-
-### 3. Add to MCP Config
-
-```json
-{
+```
+
+### 3. Add to MCP Config
+
+```json
+{
   "mcpServers": {
     "ssh": {
       "command": "node",
       "args": [
-        "/path/to/handfree-ssh-mcp/build/index.js",
-        "--config", "/path/to/servers.yaml",
-        "--enable-servers", "dev,prod"
+        "/path/to/handfree-ssh-mcp/build/index.js",
+        "--config", "/path/to/servers.yaml",
+        "--enable-servers", "dev,prod"
       ]
     }
   }
-}
-```
-
-### 4. Done. Let the LLM Work.
+}
+```
+
+### 4. Done. Let the LLM Work.
 
 The AI can now execute commands on your servers. All within your defined security boundaries.
 
@@ -116,16 +114,16 @@ The AI can now execute commands on your servers. All within your defined securit
 | Tool | Description |
 |------|-------------|
 | `execute-command` | Run SSH command (with optional `stream` for real-time output) |
-| `show-whitelist` | Show allowed commands + SFTP policy + output-log path for a server |
+| `show-whitelist` | Show active command policy + SFTP policy + output-log path for a server |
 | `upload` | Upload local file to a remote server (CRLF-fix for shell scripts, skip-if-identical) |
 | `download` | Download remote file to local disk |
 | `transfer` | Unified upload / download / server-to-server relay (`mode`: `upload` / `download` / `relay`, optional `recursive`, optional `skipIfIdentical`) |
-| `list-servers` | List configured (enabled) servers |
+| `list-servers` | List configured (enabled) servers. Lean by default; `verbose:true` adds cached system status, `refresh:true` re-collects it (implies verbose). |
 | `help` | Self-describing help text for the MCP client |
 
 ### show-whitelist
 
-**Use this first!** Let the LLM know what it's allowed to do:
+**Use this first!** Let the LLM inspect the active command policy:
 
 ```json
 {
@@ -136,7 +134,7 @@ The AI can now execute commands on your servers. All within your defined securit
 }
 ```
 
-Returns a formatted list of allowed command patterns with examples.
+Returns command mode, built-in command guards, configured whitelist/blacklist patterns, and examples when whitelist mode is active.
 
 ### execute-command
 
@@ -163,51 +161,55 @@ Returns a formatted list of allowed command patterns with examples.
 - Simple, fast commands (ls, pwd, cat)
 - When you don't need real-time feedback
 
-## 📄 YAML Config Reference
-
-```yaml
-# OpenSSH config loading is enabled by default.
-# true = load ~/.ssh/config, false = use YAML only.
-# You can also provide explicit paths:
-sshConfig:
-  enabled: true
-  paths:
-    - ~/.ssh/config
-    - ~/.ssh/config.d/work
-
-# Eagerly connect to all enabled servers on startup.
-# false (default) = lazy connect on first tool call.
-preConnect: false
+## 📄 YAML Config Reference
+
+```yaml
+# OpenSSH config loading is enabled by default.
+# true = load ~/.ssh/config, false = use YAML only.
+# You can also provide explicit paths:
+sshConfig:
+  enabled: true
+  paths:
+    - ~/.ssh/config
+    - ~/.ssh/config.d/work
+
+# Eagerly connect to all enabled servers on startup.
+# false (default) = lazy connect on first tool call.
+preConnect: false
 
 # Optional: root dir for execute-command full-output logs.
 # Per-call logs land under <outputLogDir>/<server>/<user>/<ts>-<pid>-<rand>.log.
 # Defaults to <cwd>/.handfree-output when unset. Supports ~ and relative paths.
 outputLogDir: ~/handfree-logs
 
-servers:
-  server_name:
-    # Required only for YAML-only servers. If a same-named Host exists in
-    # ~/.ssh/config, these fields are optional overrides.
-    host: 192.168.1.1
-    port: 22
-    username: root
+servers:
+  server_name:
+    # Required only for YAML-only servers. If a same-named Host exists in
+    # ~/.ssh/config, these fields are optional overrides.
+    host: 192.168.1.1
+    port: 22
+    username: root
     
-    # Auth: use ONE of these. Omit agent to use SSH_AUTH_SOCK when present;
-    # set agent only when you need a specific socket path.
-    password: xxx
-    privateKey: ~/.ssh/id_rsa
-    agent: /path/to/ssh-agent.sock
-    passphrase: key_password    # If privateKey is encrypted
+    # Auth: use ONE of these. Omit agent to use SSH_AUTH_SOCK when present;
+    # set agent only when you need a specific socket path.
+    password: xxx
+    privateKey: ~/.ssh/id_rsa
+    agent: /path/to/ssh-agent.sock
+    passphrase: key_password    # If privateKey is encrypted
     
-    # Network
-    socksProxy: socks5://host:port
+    # Network — at most ONE of `socksProxy` or `jumpHost`. See "Jump host" below.
+    # socksProxy: socks5://host:port
+    # jumpHost: bastion
+
     
-    # Security (regex patterns)
-    whitelist:                  # Only allow matching commands
+    # Command policy (regex patterns)
+    # Default is blacklist. Set commandMode: whitelist to require a whitelist.
+    commandMode: blacklist
+    whitelist:                  # Active only in whitelist mode
       - "^ls.*$"
       - "^cat.*$"
     blacklist:                  # Block matching commands
-      - "^rm -rf.*$"
+      - "^docker system prune.*$"
     
     # Safe directory for destructive commands (rm, etc.)
     safeDirectory: /home/user   # rm allowed only within this path
@@ -224,9 +226,9 @@ servers:
       - /path/to/extra/local/dir
 ```
 
-### Security note: command whitelist
+### Security note: command policy
 
-If a server's YAML omits `whitelist:` (or sets it to an empty list), `execute-command` falls back to a built-in default whitelist. That default covers common read-mostly tools like `git .*`, `curl .*`, `find .*`, `awk .*`, `sed .*` — broad enough that a determined LLM could write to disk via `awk 'BEGIN{system(...)}'` or similar. It is **strongly recommended to provide an explicit per-server `whitelist:`** narrowed to the commands you actually need. Startup logs a warning whenever a server is running on the default whitelist. See `show-whitelist` to inspect the effective whitelist at runtime.
+`execute-command` defaults to `commandMode: blacklist`. In that mode commands are allowed unless they match built-in destructive guards, the built-in dangerous-command blacklist, or a server's configured `blacklist:` patterns. Built-in blocked operations include hidden/chained destructive file operations, risky absolute-path output redirection, system power commands (`reboot`, `shutdown`, `halt`, `poweroff`), recursive force delete (`rm -rf`), destructive disk writes (`dd ... of=`), and filesystem formatting commands. Set `commandMode: whitelist` to require every command to match `whitelist:` after blacklist checks. For compatibility, a YAML server that contains `whitelist:` without `commandMode:` is treated as whitelist mode.
 
 ### SFTP path policy
 
@@ -237,6 +239,37 @@ If a server's YAML omits `whitelist:` (or sets it to an empty list), `execute-co
 
 Path matching is exact-equal or `dir + separator` prefix. `..` segments and null bytes are rejected. Use `show-whitelist` to inspect a server's current SFTP policy.
 
+### Jump host (ProxyJump-style)
+
+Tunnel a target's SSH connection through another server defined in the same YAML. Useful when the target isn't directly reachable from your machine but a bastion is.
+
+```yaml
+servers:
+  bastion:
+    host: 1.2.3.4
+    username: gate
+    privateKey: ~/.ssh/id_rsa
+
+  target:                       # NOT directly reachable
+    host: 10.0.0.5
+    username: app
+    password: <target-password>
+    jumpHost: bastion           # <- tunnel through `bastion`
+    whitelist:                  # target's own policy
+      - "^ls( .*)?$"
+      - "^pwd$"
+```
+
+Rules (enforced at config load — bad configs fail fast):
+
+- **Chaining to any depth.** The referenced jump host may itself set `jumpHost`, forming a chain `target -> J1 -> J2 -> ...`. The chain is built innermost-first (the deepest, directly-reachable hop connects first). Only **cycles** are rejected.
+- **Mutually exclusive with `socksProxy`** on the same target.
+- **Self-reference is rejected.** `target.jumpHost: target` is invalid.
+- **Independent policy.** The target authenticates with its OWN `username` / `password` / `privateKey`, and its own `whitelist` / `blacklist` / `safeDirectory` / `allowed*Directories` apply. The jump host is purely transport.
+- **Jump host is still a normal server.** You can run tools against `bastion` directly; its connection is separate from the tunneling one.
+
+**Hot-reload note:** `jumpHost` is connection-level, not policy-level. Editing it in `servers.yaml` while the server is running will NOT take effect — the hot-reloader only refreshes whitelist / blacklist / `safeDirectory` / `allowed*Directories`. Restart the MCP server to pick up `jumpHost` changes.
+
 ### Connection lifecycle (connect / reconnect)
 
 - **Lazy by default.** A server's SSH client is created on its first tool call via `ensureConnected()`. Set `preConnect: true` (or pass `--pre-connect`) to open all enabled servers at startup in parallel; failures are logged but don't block startup.
@@ -269,27 +302,27 @@ servers:
   dev: { ... }
 ```
 
-## ⚙️ CLI Options
-
-```text
---config          Optional path to YAML config/policy overlay
---ssh-config      Optional OpenSSH config path(s), comma-separated or repeated
---no-ssh-config   Disable automatic ~/.ssh/config loading
---enable-servers  Optional comma-separated list of servers to enable
---pre-connect     Eagerly connect to all enabled servers on startup
-                  (overrides `preConnect` in YAML). Default: lazy connect.
-```
-
-> **Note**: `--enable-servers` controls which servers are available. The first server listed becomes the default when `connectionName` is not specified.
-> If `--enable-servers` is omitted, all loaded servers are enabled; when more than one server is enabled, tools require `connectionName`.
-
-### OpenSSH config support
-
-The loader understands concrete `Host` entries and applies normal OpenSSH-style first-value matching against wildcard defaults. It supports `HostName`, `User`, `Port`, `IdentityFile`, `IdentityAgent`, `Include`, and common tokens such as `%h`, `%n`, `%p`, `%r`, `%u`, `%d`, and `%%`. Wildcard-only `Host *` blocks are used as defaults but are not exposed as runnable server names. `Match` blocks are ignored.
-
-Connection settings are hot-reloaded when the loaded YAML/OpenSSH config files change. If host, user, port, identity, agent, passphrase, or proxy settings change, the existing SSH client for that server is closed and the next tool call reconnects with the new values. Whitelist, blacklist, SFTP policy, and output log settings also update live.
-
-Example with selective servers:
+## ⚙️ CLI Options
+
+```text
+--config          Optional path to YAML config/policy overlay
+--ssh-config      Optional OpenSSH config path(s), comma-separated or repeated
+--no-ssh-config   Disable automatic ~/.ssh/config loading
+--enable-servers  Optional comma-separated list of servers to enable
+--pre-connect     Eagerly connect to all enabled servers on startup
+                  (overrides `preConnect` in YAML). Default: lazy connect.
+```
+
+> **Note**: `--enable-servers` controls which servers are available. The first server listed becomes the default when `connectionName` is not specified.
+> If `--enable-servers` is omitted, all loaded servers are enabled; when more than one server is enabled, tools require `connectionName`.
+
+### OpenSSH config support
+
+The loader understands concrete `Host` entries and applies normal OpenSSH-style first-value matching against wildcard defaults. It supports `HostName`, `User`, `Port`, `IdentityFile`, `IdentityAgent`, `Include`, and common tokens such as `%h`, `%n`, `%p`, `%r`, `%u`, `%d`, and `%%`. Wildcard-only `Host *` blocks are used as defaults but are not exposed as runnable server names. `Match` blocks are ignored.
+
+Connection settings are hot-reloaded when the loaded YAML/OpenSSH config files change. If host, user, port, identity, agent, passphrase, or proxy settings change, the existing SSH client for that server is closed and the next tool call reconnects with the new values. Whitelist, blacklist, SFTP policy, and output log settings also update live.
+
+Example with selective servers:
 
 ```json
 {
@@ -302,7 +335,7 @@ Example with selective servers:
 
 ## 🛡️ Security
 
-- **Whitelist everything**: Define exactly what commands are allowed
+- **Pick the right command policy**: use default blacklist mode for flexible automation, or `commandMode: whitelist` for locked-down hosts
 - **Keep secrets safe**: Add `servers.yaml` to `.gitignore`
 - **Per-server control**: Prod can be locked down, dev can be permissive
 

package/build/config/config-loader.js

@@ -76,6 +76,9 @@ function loadYamlConfig(configPath, options) {
     if (options.requireServers && Object.keys(configMap).length === 0) {
         throw new Error("No servers defined in config file");
     }
+    if (options.requireServers) {
+        validateMergedConfigs(configMap);
+    }
     Logger.log(`Total YAML servers loaded: ${Object.keys(configMap).length}`, "info");
     // Resolve outputLogDir if provided. Default applied later (in ssh-connection-manager)
     // so it always tracks the current cwd at execution time.
@@ -130,8 +133,17 @@ function buildYamlServerConfig(name, serverConfig, options = {}) {
     }
     if (serverConfig.socksProxy !== undefined)
         merged.socksProxy = serverConfig.socksProxy ?? undefined;
+    if (serverConfig.jumpHost !== undefined)
+        merged.jumpHost = serverConfig.jumpHost ?? undefined;
+    if (serverConfig.commandMode !== undefined) {
+        if (serverConfig.commandMode !== "blacklist" && serverConfig.commandMode !== "whitelist") {
+            throw new Error(`Server '${name}': 'commandMode' must be 'blacklist' or 'whitelist'`);
+        }
+        merged.commandMode = serverConfig.commandMode;
+    }
     if (serverConfig.whitelist !== undefined) {
         merged.commandWhitelist = serverConfig.whitelist ?? undefined;
+        merged.commandMode ??= "whitelist";
     }
     if (serverConfig.blacklist !== undefined) {
         merged.commandBlacklist = serverConfig.blacklist ?? undefined;
@@ -159,6 +171,8 @@ function mergeConfigMaps(sshConfigs, yamlConfigs) {
             name,
             allowedRemoteDirectories: yamlConfig.allowedRemoteDirectories ?? merged[name]?.allowedRemoteDirectories,
             allowedLocalDirectories: yamlConfig.allowedLocalDirectories ?? merged[name]?.allowedLocalDirectories,
+            jumpHost: yamlConfig.jumpHost ?? merged[name]?.jumpHost,
+            commandMode: yamlConfig.commandMode ?? merged[name]?.commandMode,
             commandWhitelist: yamlConfig.commandWhitelist ?? merged[name]?.commandWhitelist,
             commandBlacklist: yamlConfig.commandBlacklist ?? merged[name]?.commandBlacklist,
             safeDirectory: yamlConfig.safeDirectory ?? merged[name]?.safeDirectory,
@@ -186,6 +200,7 @@ function validateMergedConfigs(configs) {
             throw new Error(`Server '${name}': either 'password', 'privateKey', 'agent', or OpenSSH/default authentication is required`);
         }
     }
+    validateJumpHosts(configs);
 }
 function resolveSshConfigEnabled(options, yamlParsed) {
     if (options.loadUserSshConfig !== undefined) {
@@ -269,6 +284,51 @@ export function getLoadUserSshConfigFlag(args) {
 export function getPreConnectFlag(args) {
     return args.includes("--pre-connect");
 }
+/**
+ * Validate every server's `jumpHost` reference.
+ *
+ * Rules:
+ *  - target with `jumpHost` must not also set `socksProxy` (mutually exclusive).
+ *  - referenced jump host must exist in the same config.
+ *  - self-reference is rejected.
+ *  - chained jumps are allowed to any depth (target -> J1 -> J2 -> ...), but the
+ *    chain must be acyclic — a cycle is rejected to prevent infinite recursion.
+ */
+function validateJumpHosts(configMap) {
+    for (const [name, cfg] of Object.entries(configMap)) {
+        if (cfg.jumpHost === undefined) {
+            continue;
+        }
+        if (typeof cfg.jumpHost !== "string" || cfg.jumpHost.length === 0) {
+            throw new Error(`Server '${name}': 'jumpHost' must be a non-empty string`);
+        }
+        if (cfg.socksProxy) {
+            throw new Error(`Server '${name}': 'jumpHost' and 'socksProxy' are mutually exclusive`);
+        }
+        if (cfg.jumpHost === name) {
+            throw new Error(`Server '${name}': 'jumpHost' must not reference itself`);
+        }
+        if (!configMap[cfg.jumpHost]) {
+            throw new Error(`Server '${name}': 'jumpHost' references unknown server '${cfg.jumpHost}'`);
+        }
+        // Walk the jump chain and detect cycles. Every intermediate hop is itself a
+        // server entry, so its own socksProxy / existence rules are enforced when it
+        // is visited by the outer loop — here we only need to guard against a loop.
+        const seen = [name];
+        let hop = cfg.jumpHost;
+        while (hop !== undefined) {
+            if (seen.includes(hop)) {
+                throw new Error(`Server '${name}': 'jumpHost' chain forms a cycle (${[...seen, hop].join(" -> ")})`);
+            }
+            seen.push(hop);
+            const next = configMap[hop];
+            if (!next) {
+                throw new Error(`Server '${hop}': 'jumpHost' references unknown server`);
+            }
+            hop = next.jumpHost;
+        }
+    }
+}
 /**
  * Normalize and validate allowedRemoteDirectories.
  * Each entry must be an absolute POSIX path. Trailing slashes are stripped

package/build/config/server.js

@@ -1,25 +1,25 @@
 export const SERVER_CONFIG = {
     name: "ssh-mcp-server",
-    version: "1.4.0",
+    version: "1.0.2",
 };
 export const SERVER_INSTRUCTIONS = `This server provides SSH access to servers loaded from OpenSSH config (~/.ssh/config by default) and optional YAML config/policy overlays.
 
 Recommended workflow:
 1. Call list-servers first to discover which server names are available, enabled, and currently connected.
-2. Use show-whitelist before execute-command when you are unsure whether a command is allowed.
-3. Use execute-command for remote shell commands. Prefer a single command per call. Compound commands such as "cmd1 && cmd2" may be rejected by whitelist rules even if each subcommand is individually safe.
-4. Use stream=false for short commands that should finish quickly, such as pwd, ls, cat, head, tail, git status, or docker ps.
-5. Use stream=true for commands that may take longer or where incremental output is useful.
-6. Use upload and download for single-file SFTP transfers. Use transfer for recursive directory transfers or cross-server relay.
-7. Call help or help { tool: "<name>" } for detailed per-tool parameter docs and examples.
-
-Server targeting:
-- When only one server is enabled, connectionName can be omitted and the server is auto-selected.
-- When multiple servers are enabled, connectionName is REQUIRED on execute-command, upload, download, show-whitelist, and transfer (upload/download mode). Omitting it returns an error listing the available names.
-
+2. Use show-whitelist before execute-command when you are unsure which command policy is active.
+3. Use execute-command for remote shell commands. Prefer a single command per call. Compound commands may be rejected by command policy even if each subcommand is individually safe.
+4. Use stream=false for short commands that should finish quickly, such as pwd, ls, cat, head, tail, git status, or docker ps.
+5. Use stream=true for commands that may take longer or where incremental output is useful.
+6. Use upload and download for single-file SFTP transfers. Use transfer for recursive directory transfers or cross-server relay.
+7. Call help or help { tool: "<name>" } for detailed per-tool parameter docs and examples.
+
+Server targeting:
+- When only one server is enabled, connectionName can be omitted and the server is auto-selected.
+- When multiple servers are enabled, connectionName is REQUIRED on execute-command, upload, download, show-whitelist, and transfer (upload/download mode). Omitting it returns an error listing the available names.
+
 Behavior notes:
 - A tool may automatically establish the SSH connection on first use.
-- Command execution is restricted by the configured whitelist and blacklist. If a command is rejected, inspect the whitelist rather than retrying the same command repeatedly.
+- Command execution uses blacklist mode by default, with a built-in dangerous-command blacklist. Servers can opt into whitelist mode through YAML. If a command is rejected, inspect the command policy rather than retrying the same command repeatedly.
 - Some commands return no output on success; this is normal.
 - File transfer tools use SFTP and can fail if the remote path is missing or permissions are insufficient.
 - OpenSSH/YAML config changes are hot-reloaded without restarting the server. Connection-field changes close the old client so the next tool call reconnects with fresh settings.`;

package/build/config/ssh-config-loader.js

@@ -9,6 +9,7 @@ const SUPPORTED_KEYS = new Set([
     "identityfile",
     "identityagent",
     "identitiesonly",
+    "proxyjump",
 ]);
 export function getDefaultUserSshConfigPath() {
     return path.join(os.homedir(), ".ssh", "config");
@@ -21,9 +22,10 @@ export function loadSshConfigFiles(configPaths = [getDefaultUserSshConfigPath()]
         parseConfigFile(resolveLocalPath(configPath, process.cwd()), ["*"], directives, loadedFiles, visitedFiles);
     }
     const rawHosts = buildRawHostConfigs(directives);
+    const aliases = new Map(rawHosts.map((raw) => [raw.alias.toLowerCase(), raw.alias]));
     const configs = {};
     for (const raw of rawHosts) {
-        configs[raw.alias] = toSshConfig(raw);
+        configs[raw.alias] = toSshConfig(raw, aliases);
     }
     const configCount = Object.keys(configs).length;
     if (configCount > 0) {
@@ -126,7 +128,7 @@ function buildRawHostConfigs(directives) {
     }
     return rawHosts;
 }
-function toSshConfig(raw) {
+function toSshConfig(raw, aliases) {
     const rawHost = raw.options.get("hostname") ?? raw.alias;
     const rawUser = raw.options.get("user") ?? os.userInfo().username;
     const rawPort = raw.options.get("port") ?? "22";
@@ -174,8 +176,49 @@ function toSshConfig(raw) {
     else if (identityAgent) {
         config.agent = resolveLocalPath(expandTokens(identityAgent, resolvedContext), process.cwd());
     }
+    const jumpHost = resolveProxyJumpAlias(raw.alias, raw.options.get("proxyjump"), aliases);
+    if (jumpHost) {
+        config.jumpHost = jumpHost;
+    }
     return config;
 }
+function resolveProxyJumpAlias(alias, proxyJump, aliases) {
+    if (!proxyJump)
+        return undefined;
+    if (proxyJump.toLowerCase() === "none")
+        return undefined;
+    if (proxyJump.includes(",")) {
+        Logger.log(`SSH config Host '${alias}': ProxyJump chains are not supported by native jumpHost; ignoring '${proxyJump}'`, "info");
+        return undefined;
+    }
+    const jumpAlias = extractProxyJumpHost(proxyJump);
+    if (!jumpAlias)
+        return undefined;
+    const canonical = aliases.get(jumpAlias.toLowerCase());
+    if (!canonical) {
+        Logger.log(`SSH config Host '${alias}': ProxyJump '${proxyJump}' does not reference a loaded Host alias; ignoring`, "info");
+        return undefined;
+    }
+    return canonical;
+}
+function extractProxyJumpHost(proxyJump) {
+    let endpoint = proxyJump.trim();
+    if (!endpoint)
+        return undefined;
+    const atIndex = endpoint.lastIndexOf("@");
+    if (atIndex >= 0) {
+        endpoint = endpoint.slice(atIndex + 1);
+    }
+    if (endpoint.startsWith("[")) {
+        const closeIndex = endpoint.indexOf("]");
+        return closeIndex > 1 ? endpoint.slice(1, closeIndex) : undefined;
+    }
+    const colonIndex = endpoint.lastIndexOf(":");
+    if (colonIndex > 0 && endpoint.indexOf(":") === colonIndex) {
+        endpoint = endpoint.slice(0, colonIndex);
+    }
+    return endpoint || undefined;
+}
 function findDefaultIdentityFile() {
     const sshDir = path.join(os.homedir(), ".ssh");
     const candidates = [

package/build/core/mcp-server.js

@@ -148,11 +148,6 @@ export class SshMcpServer {
         const parsedArgs = this.loadConfig();
         this.sshManager.setConfig(parsedArgs.configs, parsedArgs.enabledServers);
         this.sshManager.setOutputLogRoot(parsedArgs.outputLogDir);
-        // Security warning
-        const allConfigs = Object.values(parsedArgs.configs);
-        if (allConfigs.some((c) => !c.commandWhitelist || c.commandWhitelist.length === 0)) {
-            Logger.log("WARNING: Running without a command whitelist is strongly discouraged. Please configure a whitelist to restrict the commands that can be executed.", "info");
-        }
         // Pre-connect to enabled servers if flag is set
         if (parsedArgs.preConnect) {
             Logger.log("Pre-connecting to enabled SSH servers...", "info");