@akms/mcp-ssh 0.0.1 → 0.0.3

package/lib/index.d.cts

@@ -1,10 +1,9 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { SFTPWrapper } from 'ssh2';
-import { z } from 'zod';
 
 /**
- * Guard rules applied to every command / file operation on a host.
- * Resolved per profile: config `defaults` merged with the profile's own overrides.
+ * Guard rules applied to every command / file operation on the host.
+ * Resolved at startup: the built-in permissive stance with each `SSH_*` variable applied over it.
  */
 interface SshPolicy {
     /** Blocks write-shaped commands, output redirection, uploads and remote writes. */
@@ -29,9 +28,9 @@ interface SshPolicy {
     /** Remote path prefixes the file tools may touch. Empty means unrestricted. */
     allowedPaths: string[];
 }
-/** One registered host: where to connect, how to authenticate, what is permitted. */
+/** The registered host: where to connect, how to authenticate, what is permitted. */
 interface SshHostProfile {
-    /** Profile alias — the `target` argument of every tool. */
+    /** Alias shown to the model, from `SSH_NAME`; defaults to the hostname. */
     name: string;
     host: string;
     port: number;
@@ -39,8 +38,6 @@ interface SshHostProfile {
     description?: string;
     /** Expanded absolute path to a private key file. */
     privateKeyPath?: string;
-    /** Private key contents, used when `privateKeyPath` is absent. */
-    privateKey?: string;
     passphrase?: string;
     password?: string;
     /**
@@ -52,18 +49,7 @@ interface SshHostProfile {
     defaultCwd?: string;
     policy: SshPolicy;
 }
-/** Loaded profiles, keyed by alias. */
-interface SshMcpConfig {
-    profiles: Map<string, SshHostProfile>;
-    /**
-     * Absolute path the config was read from, or null when it came from inline JSON or
-     * nothing was found. Only a real file needs protecting from the download tool.
-     */
-    sourcePath: string | null;
-    /** Where the config came from, for tool output — a path, "inline", or "none". */
-    sourceLabel: string;
-}
-/** Credential-free view of a profile, safe to hand back to the model. */
+/** Credential-free view of the profile, safe to hand back to the model. */
 interface SshHostSummary {
     name: string;
     host: string;
@@ -325,132 +311,45 @@ declare function uploadFile(connection: SshConnection, localPath: string, remote
  */
 declare function downloadFile(connection: SshConnection, remotePath: string, localPath: string): Promise<number>;
 
-interface SshMcpServerOptions {
-    /** Explicit config path; otherwise `SSH_MCP_CONFIG`, then the home-directory candidates. */
-    configPath?: string;
-}
 interface SshMcpServerInstance {
     server: McpServer;
     sessions: SshSessionManager;
-    /** Always the config currently in force, including after a reload. */
-    readonly config: SshMcpConfig;
-    /**
-     * Re-reads the config source and applies it.
-     *
-     * @throws {Error} If the source is now missing or malformed; the previous config
-     *                 stays in force in that case.
-     */
-    reloadConfig(): SshMcpConfig;
+    /** The host read from the `SSH_*` variables at startup, or null when none is set. */
+    readonly profile: SshHostProfile | null;
     /** Stops the sweeper and closes every open session. Call before the process exits. */
     shutdown(): void;
 }
 /**
- * Builds the MCP server: loads host profiles, wires the session manager, registers tools.
+ * Builds the MCP server: reads the host from the environment, wires the session manager,
+ * registers tools.
  *
  * Transport is deliberately left to the caller — `cli.ts` attaches stdio, tests can attach
  * an in-memory pair.
  *
- * @throws {Error} If a config file exists but is malformed (a bad policy field must not
+ * @throws {Error} If the `SSH_*` variables are malformed (a bad policy value must not
  *                 silently degrade into "no guard").
  */
-declare function createSshMcpServer(options?: SshMcpServerOptions): SshMcpServerInstance;
+declare function createSshMcpServer(): SshMcpServerInstance;
 
 /**
- * Loads host profiles from disk.
+ * Builds the host profile from the `SSH_*` variables, or null when `SSH_HOST` is unset.
  *
- * A missing config is not an error — the server still starts and reports "no profiles"
- * through the tools, which is a far clearer signal to the model than a dead server.
- * A config that exists but is malformed *is* an error: silently ignoring it would let a
- * typo in a policy field quietly drop a `readonly` guard.
+ * One MCP server entry fronts one host, so every setting is a plain variable — no JSON
+ * inside JSON, no escaped quotes, and a typo shows up on the line it is on. A malformed
+ * value aborts startup rather than being ignored, because silently dropping `SSH_READONLY`
+ * would leave a host the operator believed was read-only fully writable.
  *
- * @throws {Error} If the resolved path is missing, unreadable, not JSON, or fails validation.
- */
-declare function loadConfig(explicitPath?: string): SshMcpConfig;
-/** Strips every secret so a profile can be described back to the model. */
-declare function toHostSummary(profile: SshHostProfile): SshHostSummary;
-
-/**
- * Policy knobs, all optional — unset fields fall back to `defaults`, then to the built-ins.
+ * Flow:
+ *  1) Guard: no `SSH_HOST` means nothing is registered — the server still starts and says so
+ *  2) Resolve the policy over the built-in permissive stance; each variable is opt-in restriction
+ *  3) Assemble the connection fields
+ *  4) Expand the private key path and check it exists
  *
- * Strict on purpose. A permissive object *strips* unknown keys, so `readOnly: true`
- * (capital O) parsed successfully and silently vanished, leaving a host the operator
- * believed was read-only fully writable. An unknown key must fail startup instead.
+ * @throws {Error} If `SSH_HOST` is set without `SSH_USER`, or a typed value is malformed.
  */
-declare const POLICY_INPUT_SCHEMA: z.ZodObject<{
-    readonly: z.ZodOptional<z.ZodBoolean>;
-    allowSudo: z.ZodOptional<z.ZodBoolean>;
-    execTimeoutMs: z.ZodOptional<z.ZodNumber>;
-    connectTimeoutMs: z.ZodOptional<z.ZodNumber>;
-    maxOutputCharacters: z.ZodOptional<z.ZodNumber>;
-    maxReadFileBytes: z.ZodOptional<z.ZodNumber>;
-    allowCommands: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    denyPatterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    allowedPaths: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strict>;
-/** One `hosts` entry: connection fields plus the same policy knobs as an override. */
-declare const HOST_INPUT_SCHEMA: z.ZodObject<{
-    readonly: z.ZodOptional<z.ZodBoolean>;
-    allowSudo: z.ZodOptional<z.ZodBoolean>;
-    execTimeoutMs: z.ZodOptional<z.ZodNumber>;
-    connectTimeoutMs: z.ZodOptional<z.ZodNumber>;
-    maxOutputCharacters: z.ZodOptional<z.ZodNumber>;
-    maxReadFileBytes: z.ZodOptional<z.ZodNumber>;
-    allowCommands: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    denyPatterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    allowedPaths: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    host: z.ZodString;
-    port: z.ZodOptional<z.ZodNumber>;
-    username: z.ZodString;
-    description: z.ZodOptional<z.ZodString>;
-    privateKeyPath: z.ZodOptional<z.ZodString>;
-    privateKey: z.ZodOptional<z.ZodString>;
-    passphrase: z.ZodOptional<z.ZodString>;
-    passphraseEnv: z.ZodOptional<z.ZodString>;
-    password: z.ZodOptional<z.ZodString>;
-    passwordEnv: z.ZodOptional<z.ZodString>;
-    hostKeyFingerprint: z.ZodOptional<z.ZodString>;
-    defaultCwd: z.ZodOptional<z.ZodString>;
-}, z.core.$strict>;
-declare const CONFIG_INPUT_SCHEMA: z.ZodObject<{
-    $schema: z.ZodOptional<z.ZodString>;
-    defaults: z.ZodOptional<z.ZodObject<{
-        readonly: z.ZodOptional<z.ZodBoolean>;
-        allowSudo: z.ZodOptional<z.ZodBoolean>;
-        execTimeoutMs: z.ZodOptional<z.ZodNumber>;
-        connectTimeoutMs: z.ZodOptional<z.ZodNumber>;
-        maxOutputCharacters: z.ZodOptional<z.ZodNumber>;
-        maxReadFileBytes: z.ZodOptional<z.ZodNumber>;
-        allowCommands: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        denyPatterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        allowedPaths: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    }, z.core.$strict>>;
-    hosts: z.ZodRecord<z.ZodString, z.ZodObject<{
-        readonly: z.ZodOptional<z.ZodBoolean>;
-        allowSudo: z.ZodOptional<z.ZodBoolean>;
-        execTimeoutMs: z.ZodOptional<z.ZodNumber>;
-        connectTimeoutMs: z.ZodOptional<z.ZodNumber>;
-        maxOutputCharacters: z.ZodOptional<z.ZodNumber>;
-        maxReadFileBytes: z.ZodOptional<z.ZodNumber>;
-        allowCommands: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        denyPatterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        allowedPaths: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        host: z.ZodString;
-        port: z.ZodOptional<z.ZodNumber>;
-        username: z.ZodString;
-        description: z.ZodOptional<z.ZodString>;
-        privateKeyPath: z.ZodOptional<z.ZodString>;
-        privateKey: z.ZodOptional<z.ZodString>;
-        passphrase: z.ZodOptional<z.ZodString>;
-        passphraseEnv: z.ZodOptional<z.ZodString>;
-        password: z.ZodOptional<z.ZodString>;
-        passwordEnv: z.ZodOptional<z.ZodString>;
-        hostKeyFingerprint: z.ZodOptional<z.ZodString>;
-        defaultCwd: z.ZodOptional<z.ZodString>;
-    }, z.core.$strict>>;
-}, z.core.$strict>;
-type PolicyInput = z.infer<typeof POLICY_INPUT_SCHEMA>;
-type HostInput = z.infer<typeof HOST_INPUT_SCHEMA>;
-type ConfigInput = z.infer<typeof CONFIG_INPUT_SCHEMA>;
+declare function loadHostProfile(): SshHostProfile | null;
+/** Strips every secret so the profile can be described back to the model. */
+declare function toHostSummary(profile: SshHostProfile): SshHostSummary;
 
 /**
  * Rewrites shell constructs that change how the text tokenizes but not what it runs,
@@ -546,7 +445,8 @@ declare function inspectRemotePath(remotePath: string, policy: SshPolicy, access
  * define the guards themselves (download).
  *
  * @param resolvedLocalPath Absolute path, already `~`-expanded.
- * @param extraProtectedPaths Runtime-known paths to protect, such as the loaded config file.
+ * @param extraProtectedPaths Runtime-known paths to protect on top of the built-in rules,
+ *                            for a host embedding this server as a library.
  */
 declare function inspectLocalPath(resolvedLocalPath: string, access: RemotePathAccess, extraProtectedPaths?: string[]): GuardVerdict;
 /**
@@ -571,15 +471,11 @@ declare class GuardRejectionError extends Error {
     constructor(verdict: GuardVerdict);
 }
 
-/** Everything the tool handlers share: the loaded profiles and the live sessions. */
+/** Everything the tool handlers share: the configured host and the live sessions. */
 interface ToolContext {
-    config: SshMcpConfig;
+    /** The host from the `SSH_*` variables, or null when none is registered. */
+    profile: SshHostProfile | null;
     sessions: SshSessionManager;
-    /**
-     * Re-reads the config source and swaps it in, so `context.config` is always current.
-     * Implemented by the server, which owns the source path.
-     */
-    reloadConfig(): SshMcpConfig;
 }
 
 /** Registers every tool this server exposes, in the order the model should discover them. */
@@ -596,11 +492,46 @@ interface Logger {
 }
 declare const $logger: Logger;
 
-/** Env var holding an explicit config file path. */
-declare const CONFIG_PATH_ENV = "SSH_MCP_CONFIG";
 /** Env var overriding the stderr log level ("debug" | "info" | "warn" | "error" | "silent"). */
 declare const LOG_LEVEL_ENV = "SSH_MCP_LOG_LEVEL";
-declare const SERVER_NAME = "akms-ssh";
-declare const SERVER_VERSION = "0.0.1";
+declare const SERVER_NAME = "akms-mcp-ssh";
+declare const SERVER_VERSION = "0.0.3";
+
+/**
+ * Environment variables that define the host, one MCP server entry per host.
+ *
+ * This is the only way to configure the server. Each variable is a plain value, so an
+ * MCP client's `env` block reads like a connection form — no JSON inside JSON, no
+ * escaped quotes, and a typo shows up on the line it is on.
+ */
+declare const SINGLE_HOST_ENV: {
+    /** Presence of this variable is what registers a host at all. */
+    readonly HOST: "SSH_HOST";
+    readonly PORT: "SSH_PORT";
+    readonly USER: "SSH_USER";
+    /** Path to a private key file. */
+    readonly KEY: "SSH_KEY";
+    readonly PASSPHRASE: "SSH_PASSPHRASE";
+    readonly PASSWORD: "SSH_PASSWORD";
+    /** Pinned host key, `SHA256:…`. */
+    readonly HOST_KEY: "SSH_HOST_KEY";
+    /** Alias shown to the model; defaults to the hostname. */
+    readonly NAME: "SSH_NAME";
+    readonly DESCRIPTION: "SSH_DESCRIPTION";
+    /** Directory new sessions start in. */
+    readonly CWD: "SSH_CWD";
+    readonly READONLY: "SSH_READONLY";
+    readonly ALLOW_SUDO: "SSH_ALLOW_SUDO";
+    /** Comma-separated binary names. */
+    readonly ALLOW_COMMANDS: "SSH_ALLOW_COMMANDS";
+    /** Comma-separated regex sources. */
+    readonly DENY_PATTERNS: "SSH_DENY_PATTERNS";
+    /** Comma-separated absolute path prefixes. */
+    readonly ALLOWED_PATHS: "SSH_ALLOWED_PATHS";
+    readonly EXEC_TIMEOUT_MS: "SSH_EXEC_TIMEOUT_MS";
+    readonly CONNECT_TIMEOUT_MS: "SSH_CONNECT_TIMEOUT_MS";
+    readonly MAX_OUTPUT_CHARACTERS: "SSH_MAX_OUTPUT";
+    readonly MAX_READ_FILE_BYTES: "SSH_MAX_READ_BYTES";
+};
 
-export { $logger, CONFIG_INPUT_SCHEMA, CONFIG_PATH_ENV, type ConfigInput, GuardRejectionError, type GuardVerdict, HOST_INPUT_SCHEMA, type HostInput, LOG_LEVEL_ENV, type LogLevel, type Logger, POLICY_INPUT_SCHEMA, type PolicyInput, type RemoteDirectoryListing, type RemoteFileContent, type RemotePathAccess, SERVER_NAME, SERVER_VERSION, type SegmentAnalysis, SshConnection, type SshExecOptions, type SshExecResult, type SshHostProfile, type SshHostSummary, type SshMcpConfig, type SshMcpServerInstance, type SshMcpServerOptions, type SshPolicy, type SshRemoteEntry, SshSession, type SshSessionInfo, SshSessionManager, type ToolContext, analyzeSegment, canonicalizeCommand, createSshMcpServer, downloadFile, extractSubstitutions, inspectCommand, inspectLocalPath, inspectRemotePath, inspectWorkingDirectory, listRemoteDirectory, loadConfig, normalizeCommandText, readRemoteFile, registerAllTools, splitCommandSegments, stripQuotedText, toHostSummary, uploadFile, writeRemoteFile };
+export { $logger, GuardRejectionError, type GuardVerdict, LOG_LEVEL_ENV, type LogLevel, type Logger, type RemoteDirectoryListing, type RemoteFileContent, type RemotePathAccess, SERVER_NAME, SERVER_VERSION, SINGLE_HOST_ENV, type SegmentAnalysis, SshConnection, type SshExecOptions, type SshExecResult, type SshHostProfile, type SshHostSummary, type SshMcpServerInstance, type SshPolicy, type SshRemoteEntry, SshSession, type SshSessionInfo, SshSessionManager, type ToolContext, analyzeSegment, canonicalizeCommand, createSshMcpServer, downloadFile, extractSubstitutions, inspectCommand, inspectLocalPath, inspectRemotePath, inspectWorkingDirectory, listRemoteDirectory, loadHostProfile, normalizeCommandText, readRemoteFile, registerAllTools, splitCommandSegments, stripQuotedText, toHostSummary, uploadFile, writeRemoteFile };

package/lib/index.d.ts

@@ -1,10 +1,9 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { SFTPWrapper } from 'ssh2';
-import { z } from 'zod';
 
 /**
- * Guard rules applied to every command / file operation on a host.
- * Resolved per profile: config `defaults` merged with the profile's own overrides.
+ * Guard rules applied to every command / file operation on the host.
+ * Resolved at startup: the built-in permissive stance with each `SSH_*` variable applied over it.
  */
 interface SshPolicy {
     /** Blocks write-shaped commands, output redirection, uploads and remote writes. */
@@ -29,9 +28,9 @@ interface SshPolicy {
     /** Remote path prefixes the file tools may touch. Empty means unrestricted. */
     allowedPaths: string[];
 }
-/** One registered host: where to connect, how to authenticate, what is permitted. */
+/** The registered host: where to connect, how to authenticate, what is permitted. */
 interface SshHostProfile {
-    /** Profile alias — the `target` argument of every tool. */
+    /** Alias shown to the model, from `SSH_NAME`; defaults to the hostname. */
     name: string;
     host: string;
     port: number;
@@ -39,8 +38,6 @@ interface SshHostProfile {
     description?: string;
     /** Expanded absolute path to a private key file. */
     privateKeyPath?: string;
-    /** Private key contents, used when `privateKeyPath` is absent. */
-    privateKey?: string;
     passphrase?: string;
     password?: string;
     /**
@@ -52,18 +49,7 @@ interface SshHostProfile {
     defaultCwd?: string;
     policy: SshPolicy;
 }
-/** Loaded profiles, keyed by alias. */
-interface SshMcpConfig {
-    profiles: Map<string, SshHostProfile>;
-    /**
-     * Absolute path the config was read from, or null when it came from inline JSON or
-     * nothing was found. Only a real file needs protecting from the download tool.
-     */
-    sourcePath: string | null;
-    /** Where the config came from, for tool output — a path, "inline", or "none". */
-    sourceLabel: string;
-}
-/** Credential-free view of a profile, safe to hand back to the model. */
+/** Credential-free view of the profile, safe to hand back to the model. */
 interface SshHostSummary {
     name: string;
     host: string;
@@ -325,132 +311,45 @@ declare function uploadFile(connection: SshConnection, localPath: string, remote
  */
 declare function downloadFile(connection: SshConnection, remotePath: string, localPath: string): Promise<number>;
 
-interface SshMcpServerOptions {
-    /** Explicit config path; otherwise `SSH_MCP_CONFIG`, then the home-directory candidates. */
-    configPath?: string;
-}
 interface SshMcpServerInstance {
     server: McpServer;
     sessions: SshSessionManager;
-    /** Always the config currently in force, including after a reload. */
-    readonly config: SshMcpConfig;
-    /**
-     * Re-reads the config source and applies it.
-     *
-     * @throws {Error} If the source is now missing or malformed; the previous config
-     *                 stays in force in that case.
-     */
-    reloadConfig(): SshMcpConfig;
+    /** The host read from the `SSH_*` variables at startup, or null when none is set. */
+    readonly profile: SshHostProfile | null;
     /** Stops the sweeper and closes every open session. Call before the process exits. */
     shutdown(): void;
 }
 /**
- * Builds the MCP server: loads host profiles, wires the session manager, registers tools.
+ * Builds the MCP server: reads the host from the environment, wires the session manager,
+ * registers tools.
  *
  * Transport is deliberately left to the caller — `cli.ts` attaches stdio, tests can attach
  * an in-memory pair.
  *
- * @throws {Error} If a config file exists but is malformed (a bad policy field must not
+ * @throws {Error} If the `SSH_*` variables are malformed (a bad policy value must not
  *                 silently degrade into "no guard").
  */
-declare function createSshMcpServer(options?: SshMcpServerOptions): SshMcpServerInstance;
+declare function createSshMcpServer(): SshMcpServerInstance;
 
 /**
- * Loads host profiles from disk.
+ * Builds the host profile from the `SSH_*` variables, or null when `SSH_HOST` is unset.
  *
- * A missing config is not an error — the server still starts and reports "no profiles"
- * through the tools, which is a far clearer signal to the model than a dead server.
- * A config that exists but is malformed *is* an error: silently ignoring it would let a
- * typo in a policy field quietly drop a `readonly` guard.
+ * One MCP server entry fronts one host, so every setting is a plain variable — no JSON
+ * inside JSON, no escaped quotes, and a typo shows up on the line it is on. A malformed
+ * value aborts startup rather than being ignored, because silently dropping `SSH_READONLY`
+ * would leave a host the operator believed was read-only fully writable.
  *
- * @throws {Error} If the resolved path is missing, unreadable, not JSON, or fails validation.
- */
-declare function loadConfig(explicitPath?: string): SshMcpConfig;
-/** Strips every secret so a profile can be described back to the model. */
-declare function toHostSummary(profile: SshHostProfile): SshHostSummary;
-
-/**
- * Policy knobs, all optional — unset fields fall back to `defaults`, then to the built-ins.
+ * Flow:
+ *  1) Guard: no `SSH_HOST` means nothing is registered — the server still starts and says so
+ *  2) Resolve the policy over the built-in permissive stance; each variable is opt-in restriction
+ *  3) Assemble the connection fields
+ *  4) Expand the private key path and check it exists
  *
- * Strict on purpose. A permissive object *strips* unknown keys, so `readOnly: true`
- * (capital O) parsed successfully and silently vanished, leaving a host the operator
- * believed was read-only fully writable. An unknown key must fail startup instead.
+ * @throws {Error} If `SSH_HOST` is set without `SSH_USER`, or a typed value is malformed.
  */
-declare const POLICY_INPUT_SCHEMA: z.ZodObject<{
-    readonly: z.ZodOptional<z.ZodBoolean>;
-    allowSudo: z.ZodOptional<z.ZodBoolean>;
-    execTimeoutMs: z.ZodOptional<z.ZodNumber>;
-    connectTimeoutMs: z.ZodOptional<z.ZodNumber>;
-    maxOutputCharacters: z.ZodOptional<z.ZodNumber>;
-    maxReadFileBytes: z.ZodOptional<z.ZodNumber>;
-    allowCommands: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    denyPatterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    allowedPaths: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strict>;
-/** One `hosts` entry: connection fields plus the same policy knobs as an override. */
-declare const HOST_INPUT_SCHEMA: z.ZodObject<{
-    readonly: z.ZodOptional<z.ZodBoolean>;
-    allowSudo: z.ZodOptional<z.ZodBoolean>;
-    execTimeoutMs: z.ZodOptional<z.ZodNumber>;
-    connectTimeoutMs: z.ZodOptional<z.ZodNumber>;
-    maxOutputCharacters: z.ZodOptional<z.ZodNumber>;
-    maxReadFileBytes: z.ZodOptional<z.ZodNumber>;
-    allowCommands: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    denyPatterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    allowedPaths: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    host: z.ZodString;
-    port: z.ZodOptional<z.ZodNumber>;
-    username: z.ZodString;
-    description: z.ZodOptional<z.ZodString>;
-    privateKeyPath: z.ZodOptional<z.ZodString>;
-    privateKey: z.ZodOptional<z.ZodString>;
-    passphrase: z.ZodOptional<z.ZodString>;
-    passphraseEnv: z.ZodOptional<z.ZodString>;
-    password: z.ZodOptional<z.ZodString>;
-    passwordEnv: z.ZodOptional<z.ZodString>;
-    hostKeyFingerprint: z.ZodOptional<z.ZodString>;
-    defaultCwd: z.ZodOptional<z.ZodString>;
-}, z.core.$strict>;
-declare const CONFIG_INPUT_SCHEMA: z.ZodObject<{
-    $schema: z.ZodOptional<z.ZodString>;
-    defaults: z.ZodOptional<z.ZodObject<{
-        readonly: z.ZodOptional<z.ZodBoolean>;
-        allowSudo: z.ZodOptional<z.ZodBoolean>;
-        execTimeoutMs: z.ZodOptional<z.ZodNumber>;
-        connectTimeoutMs: z.ZodOptional<z.ZodNumber>;
-        maxOutputCharacters: z.ZodOptional<z.ZodNumber>;
-        maxReadFileBytes: z.ZodOptional<z.ZodNumber>;
-        allowCommands: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        denyPatterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        allowedPaths: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    }, z.core.$strict>>;
-    hosts: z.ZodRecord<z.ZodString, z.ZodObject<{
-        readonly: z.ZodOptional<z.ZodBoolean>;
-        allowSudo: z.ZodOptional<z.ZodBoolean>;
-        execTimeoutMs: z.ZodOptional<z.ZodNumber>;
-        connectTimeoutMs: z.ZodOptional<z.ZodNumber>;
-        maxOutputCharacters: z.ZodOptional<z.ZodNumber>;
-        maxReadFileBytes: z.ZodOptional<z.ZodNumber>;
-        allowCommands: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        denyPatterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        allowedPaths: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        host: z.ZodString;
-        port: z.ZodOptional<z.ZodNumber>;
-        username: z.ZodString;
-        description: z.ZodOptional<z.ZodString>;
-        privateKeyPath: z.ZodOptional<z.ZodString>;
-        privateKey: z.ZodOptional<z.ZodString>;
-        passphrase: z.ZodOptional<z.ZodString>;
-        passphraseEnv: z.ZodOptional<z.ZodString>;
-        password: z.ZodOptional<z.ZodString>;
-        passwordEnv: z.ZodOptional<z.ZodString>;
-        hostKeyFingerprint: z.ZodOptional<z.ZodString>;
-        defaultCwd: z.ZodOptional<z.ZodString>;
-    }, z.core.$strict>>;
-}, z.core.$strict>;
-type PolicyInput = z.infer<typeof POLICY_INPUT_SCHEMA>;
-type HostInput = z.infer<typeof HOST_INPUT_SCHEMA>;
-type ConfigInput = z.infer<typeof CONFIG_INPUT_SCHEMA>;
+declare function loadHostProfile(): SshHostProfile | null;
+/** Strips every secret so the profile can be described back to the model. */
+declare function toHostSummary(profile: SshHostProfile): SshHostSummary;
 
 /**
  * Rewrites shell constructs that change how the text tokenizes but not what it runs,
@@ -546,7 +445,8 @@ declare function inspectRemotePath(remotePath: string, policy: SshPolicy, access
  * define the guards themselves (download).
  *
  * @param resolvedLocalPath Absolute path, already `~`-expanded.
- * @param extraProtectedPaths Runtime-known paths to protect, such as the loaded config file.
+ * @param extraProtectedPaths Runtime-known paths to protect on top of the built-in rules,
+ *                            for a host embedding this server as a library.
  */
 declare function inspectLocalPath(resolvedLocalPath: string, access: RemotePathAccess, extraProtectedPaths?: string[]): GuardVerdict;
 /**
@@ -571,15 +471,11 @@ declare class GuardRejectionError extends Error {
     constructor(verdict: GuardVerdict);
 }
 
-/** Everything the tool handlers share: the loaded profiles and the live sessions. */
+/** Everything the tool handlers share: the configured host and the live sessions. */
 interface ToolContext {
-    config: SshMcpConfig;
+    /** The host from the `SSH_*` variables, or null when none is registered. */
+    profile: SshHostProfile | null;
     sessions: SshSessionManager;
-    /**
-     * Re-reads the config source and swaps it in, so `context.config` is always current.
-     * Implemented by the server, which owns the source path.
-     */
-    reloadConfig(): SshMcpConfig;
 }
 
 /** Registers every tool this server exposes, in the order the model should discover them. */
@@ -596,11 +492,46 @@ interface Logger {
 }
 declare const $logger: Logger;
 
-/** Env var holding an explicit config file path. */
-declare const CONFIG_PATH_ENV = "SSH_MCP_CONFIG";
 /** Env var overriding the stderr log level ("debug" | "info" | "warn" | "error" | "silent"). */
 declare const LOG_LEVEL_ENV = "SSH_MCP_LOG_LEVEL";
-declare const SERVER_NAME = "akms-ssh";
-declare const SERVER_VERSION = "0.0.1";
+declare const SERVER_NAME = "akms-mcp-ssh";
+declare const SERVER_VERSION = "0.0.3";
+
+/**
+ * Environment variables that define the host, one MCP server entry per host.
+ *
+ * This is the only way to configure the server. Each variable is a plain value, so an
+ * MCP client's `env` block reads like a connection form — no JSON inside JSON, no
+ * escaped quotes, and a typo shows up on the line it is on.
+ */
+declare const SINGLE_HOST_ENV: {
+    /** Presence of this variable is what registers a host at all. */
+    readonly HOST: "SSH_HOST";
+    readonly PORT: "SSH_PORT";
+    readonly USER: "SSH_USER";
+    /** Path to a private key file. */
+    readonly KEY: "SSH_KEY";
+    readonly PASSPHRASE: "SSH_PASSPHRASE";
+    readonly PASSWORD: "SSH_PASSWORD";
+    /** Pinned host key, `SHA256:…`. */
+    readonly HOST_KEY: "SSH_HOST_KEY";
+    /** Alias shown to the model; defaults to the hostname. */
+    readonly NAME: "SSH_NAME";
+    readonly DESCRIPTION: "SSH_DESCRIPTION";
+    /** Directory new sessions start in. */
+    readonly CWD: "SSH_CWD";
+    readonly READONLY: "SSH_READONLY";
+    readonly ALLOW_SUDO: "SSH_ALLOW_SUDO";
+    /** Comma-separated binary names. */
+    readonly ALLOW_COMMANDS: "SSH_ALLOW_COMMANDS";
+    /** Comma-separated regex sources. */
+    readonly DENY_PATTERNS: "SSH_DENY_PATTERNS";
+    /** Comma-separated absolute path prefixes. */
+    readonly ALLOWED_PATHS: "SSH_ALLOWED_PATHS";
+    readonly EXEC_TIMEOUT_MS: "SSH_EXEC_TIMEOUT_MS";
+    readonly CONNECT_TIMEOUT_MS: "SSH_CONNECT_TIMEOUT_MS";
+    readonly MAX_OUTPUT_CHARACTERS: "SSH_MAX_OUTPUT";
+    readonly MAX_READ_FILE_BYTES: "SSH_MAX_READ_BYTES";
+};
 
-export { $logger, CONFIG_INPUT_SCHEMA, CONFIG_PATH_ENV, type ConfigInput, GuardRejectionError, type GuardVerdict, HOST_INPUT_SCHEMA, type HostInput, LOG_LEVEL_ENV, type LogLevel, type Logger, POLICY_INPUT_SCHEMA, type PolicyInput, type RemoteDirectoryListing, type RemoteFileContent, type RemotePathAccess, SERVER_NAME, SERVER_VERSION, type SegmentAnalysis, SshConnection, type SshExecOptions, type SshExecResult, type SshHostProfile, type SshHostSummary, type SshMcpConfig, type SshMcpServerInstance, type SshMcpServerOptions, type SshPolicy, type SshRemoteEntry, SshSession, type SshSessionInfo, SshSessionManager, type ToolContext, analyzeSegment, canonicalizeCommand, createSshMcpServer, downloadFile, extractSubstitutions, inspectCommand, inspectLocalPath, inspectRemotePath, inspectWorkingDirectory, listRemoteDirectory, loadConfig, normalizeCommandText, readRemoteFile, registerAllTools, splitCommandSegments, stripQuotedText, toHostSummary, uploadFile, writeRemoteFile };
+export { $logger, GuardRejectionError, type GuardVerdict, LOG_LEVEL_ENV, type LogLevel, type Logger, type RemoteDirectoryListing, type RemoteFileContent, type RemotePathAccess, SERVER_NAME, SERVER_VERSION, SINGLE_HOST_ENV, type SegmentAnalysis, SshConnection, type SshExecOptions, type SshExecResult, type SshHostProfile, type SshHostSummary, type SshMcpServerInstance, type SshPolicy, type SshRemoteEntry, SshSession, type SshSessionInfo, SshSessionManager, type ToolContext, analyzeSegment, canonicalizeCommand, createSshMcpServer, downloadFile, extractSubstitutions, inspectCommand, inspectLocalPath, inspectRemotePath, inspectWorkingDirectory, listRemoteDirectory, loadHostProfile, normalizeCommandText, readRemoteFile, registerAllTools, splitCommandSegments, stripQuotedText, toHostSummary, uploadFile, writeRemoteFile };