@yawlabs/ssh-mcp 0.17.1 → 0.17.3

package/README.md

@@ -326,23 +326,23 @@ for (const check of report.checks) {
 
 ## Runtime selection
 
-The `ssh-mcp` command — what `npx @yawlabs/ssh-mcp` runs — is a small launcher. It prefers the [oam](https://oamjs.org) runtime and otherwise runs the server on Node, so oam is optional. Its minimum is the **latest oam release, currently 0.15.2**, and it never serves on an older oam.
+The `ssh-mcp` command — what `npx @yawlabs/ssh-mcp` runs — is a small launcher. It prefers the [oam](https://oamjs.org) runtime and otherwise runs the server on Node, so oam is optional. Its minimum is the **latest oam release, currently 0.18.0**, and it never serves on an older oam.
 
 Two environment variables control the choice; set them in your MCP client's `env` block:
 
 - `SSH_MCP_RUNTIME` — which runtime to use. Case-insensitive; any value other than `oam` or `node` behaves as `auto`.
-  - `auto` (default) — use the newest oam it can find at 0.15.2 or newer, otherwise run on Node.
+  - `auto` (default) — use the newest oam it can find at 0.18.0 or newer, otherwise run on Node.
   - `oam` — require oam. Fails loudly: if no usable oam is found, the launcher prints what it found and why each one was passed over to stderr, and exits with status 1 instead of starting the server.
   - `node` — always Node. The launcher does not look for oam, and `OAM_BIN` is ignored.
-- `OAM_BIN` — path to an oam binary to use in preference to discovery, when it is 0.15.2 or newer. If it does not exist, is older, or will not run, the launcher says so on stderr and carries on with discovery.
+- `OAM_BIN` — path to an oam binary to use in preference to discovery, when it is 0.18.0 or newer. If it does not exist, is older, or will not run, the launcher says so on stderr and carries on with discovery.
 
-Discovery looks in `%LOCALAPPDATA%\oam\bin` (Windows only), then `~/.oam/bin`, then every directory on `PATH`; asks every oam binary it finds for its version; and uses the newest one at 0.15.2 or newer. On a tie the one found first wins, so an installed copy beats one on `PATH`. On Windows only `oam.exe` counts: an `oam.cmd`/`oam.bat` shim on `PATH` is never run, and is named on stderr when no usable oam is found.
+Discovery looks in `%LOCALAPPDATA%\oam\bin` (Windows only), then `~/.oam/bin`, then every directory on `PATH`; asks every oam binary it finds for its version; and uses the newest one at 0.18.0 or newer. On a tie the one found first wins, so an installed copy beats one on `PATH`. On Windows only `oam.exe` counts: an `oam.cmd`/`oam.bat` shim on `PATH` is never run, and is named on stderr when no usable oam is found.
 
-By default an unusable oam is not an error. When Node starts the launcher (`npx` or a global install, run directly by your MCP client), `auto` mode falls back to Node — silently when there was nothing to find, or with a note on stderr naming each oam (and `OAM_BIN`) it passed over and why: older than 0.15.2, not runnable, or a shim. A chosen oam that then fails to start is named on stderr too. When an older oam starts the launcher, the handoff to Node is always noted on stderr (see below). With `SSH_MCP_RUNTIME=oam`, each of these cases exits with status 1 instead.
+By default an unusable oam is not an error. When Node starts the launcher (`npx` or a global install, run directly by your MCP client), `auto` mode falls back to Node — silently when there was nothing to find, or with a note on stderr naming each oam (and `OAM_BIN`) it passed over and why: older than 0.18.0, not runnable, or a shim. A chosen oam that then fails to start is named on stderr too. When an older oam starts the launcher, the handoff to Node is always noted on stderr (see below). With `SSH_MCP_RUNTIME=oam`, each of these cases exits with status 1 instead.
 
 When the launcher is itself started by oam (`oam run <path>/bin/ssh-mcp.mjs`, which is how Yaw MCP starts an `npx @yawlabs/ssh-mcp` entry when a recent oam is installed):
 
-- On oam 0.15.2 or newer it runs the server on that oam, in the same process. Nothing is discovered or spawned, `OAM_BIN` is not read, and `SSH_MCP_RUNTIME=oam` counts it as the oam it requires.
+- On oam 0.18.0 or newer it runs the server on that oam, in the same process. Nothing is discovered or spawned, `OAM_BIN` is not read, and `SSH_MCP_RUNTIME=oam` counts it as the oam it requires.
 - On an older oam it never runs the server there. It hands the server off to the newest usable oam it can find, or to Node on `PATH`, or exits with status 1 when there is neither (`SSH_MCP_RUNTIME=oam` exits with status 1 rather than handing off to Node).
 - With `SSH_MCP_RUNTIME=node` it hands the server off to Node on `PATH`, whatever the oam version.
 
@@ -366,7 +366,7 @@ On Windows, add the same `env` block to the `cmd /c` form from [Quick start](#qu
 
 - Node.js 18+
 - SSH client installed (for diagnostics and environment management)
-- Optional: [oam](https://oamjs.org) 0.15.2+ — see [Runtime selection](#runtime-selection)
+- Optional: [oam](https://oamjs.org) 0.18.0+ — see [Runtime selection](#runtime-selection)
 
 ## License
 

package/bin/ssh-mcp.mjs

@@ -40,7 +40,7 @@
  * named on stderr, and discovery carries on. It used to stop everything: a typo
  * in OAM_BIN meant Node, with no hint why. The discovered binaries that were
  * passed over, and any .cmd/.bat shim on PATH, are named only when NO usable
- * oam is found -- with 0.9.0 installed and 0.15.2 on PATH, stderr stays empty.
+ * oam is found -- with 0.9.0 installed and 0.18.0 on PATH, stderr stays empty.
  *
  * ALREADY RUNNING ON OAM
  * A host can resolve this package's `bin` and launch `oam run <this file>`
@@ -77,7 +77,7 @@
  * wired up here.
  *
  * MINIMUM OAM VERSION
- * The latest oam release, 0.15.2 -- bump OAM_MIN when oam ships a newer one.
+ * The latest oam release, 0.18.0 -- bump OAM_MIN when oam ships a newer one.
  * Only the current oam is used and verified; an older one is passed over.
  * The floor is not cosmetic: before 0.9.0 `child_process.execFile` ran its
  * arguments through a SHELL, `exec` accepted `timeout` and ignored it,
@@ -104,7 +104,7 @@ import { delimiter, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
 /** Oldest oam whose `child_process` matches Node. See MINIMUM OAM VERSION above. */
-const OAM_MIN = [0, 15, 2];
+const OAM_MIN = [0, 18, 0];
 
 /**
  * Bound on each `oam --version` probe. A healthy oam answers in milliseconds;

package/dist/index.js

@@ -11,7 +11,16 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 
 // src/env.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { appendFileSync, existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync3, statSync } from "fs";
+import {
+  appendFileSync,
+  closeSync,
+  existsSync as existsSync2,
+  constants as fsConstants,
+  fstatSync,
+  openSync,
+  readdirSync as readdirSync2,
+  readFileSync as readFileSync3
+} from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join3 } from "path";
 
@@ -1083,7 +1092,7 @@ function ensureAgent() {
     message: 'Could not start ssh-agent. Run manually: eval "$(ssh-agent -s)"'
   };
 }
-function detectKeyType(filePath, fileName) {
+function detectKeyType(filePath, fileName, content) {
   const pubPath = `${filePath}.pub`;
   if (existsSync2(pubPath)) {
     try {
@@ -1100,7 +1109,6 @@ function detectKeyType(filePath, fileName) {
   if (fileName.includes("ecdsa")) return "ecdsa";
   if (fileName.includes("dsa")) return "dsa";
   try {
-    const content = readFileSync3(filePath, "utf8");
     if (content.includes("RSA PRIVATE KEY")) return "rsa";
     if (content.includes("EC PRIVATE KEY")) return "ecdsa";
     if (content.includes("DSA PRIVATE KEY")) return "dsa";
@@ -1136,12 +1144,13 @@ function listSshKeysDetailed() {
   for (const file of files) {
     if (file.endsWith(".pub") || file.startsWith(".") || SSH_NON_KEY_FILES.has(file)) continue;
     const filePath = join3(sshDir, file);
+    let fd;
     try {
-      const stat = statSync(filePath);
-      if (!stat.isFile()) continue;
-      const content = readFileSync3(filePath, "utf8");
+      fd = openSync(filePath, fsConstants.O_RDONLY | (fsConstants.O_NONBLOCK ?? 0) | (fsConstants.O_NOCTTY ?? 0));
+      if (!fstatSync(fd).isFile()) continue;
+      const content = readFileSync3(fd, "utf8");
       if (!content.includes("PRIVATE KEY")) continue;
-      const type = detectKeyType(filePath, file);
+      const type = detectKeyType(filePath, file, content);
       let fingerprint;
       const { stdout: fpOut, ok: fpOk } = runArgs("ssh-keygen", ["-lf", filePath]);
       if (fpOk) {
@@ -1151,6 +1160,8 @@ function listSshKeysDetailed() {
       const loadedInAgent = fingerprint ? loadedFingerprints.has(fingerprint) : false;
       keys.push({ name: file, path: filePath, type, fingerprint, loadedInAgent });
     } catch {
+    } finally {
+      if (fd !== void 0) closeSync(fd);
     }
   }
   return { status: "ok", dir: sshDir, keys };
@@ -1306,7 +1317,7 @@ function testConnection(host, port = 22) {
 }
 
 // src/pool.ts
-import { createHash } from "crypto";
+import { createHmac, randomBytes, scryptSync } from "crypto";
 var POOL_FULL_ERROR_CODE = "ERR_SSH_MCP_POOL_FULL";
 var PoolFullError = class extends Error {
   code = POOL_FULL_ERROR_CODE;
@@ -1336,21 +1347,24 @@ function defaultMaxPoolSize() {
   const parsed = Number.parseInt(raw, 10);
   return Number.isFinite(parsed) && parsed > 0 ? parsed : 100;
 }
+var AUTH_FINGERPRINT_SECRET = randomBytes(32);
+var PASSWORD_SCRYPT_COST = 1024;
+function updateField(h, tag, value) {
+  const bytes = typeof value === "string" ? Buffer.from(value, "utf8") : value;
+  const len = Buffer.alloc(4);
+  len.writeUInt32BE(bytes.length);
+  h.update(tag);
+  h.update(len);
+  h.update(bytes);
+}
 function authFingerprint(cc) {
-  const h = createHash("sha256");
-  if (cc.privateKey) {
-    h.update("k");
-    h.update(cc.privateKey);
-  }
+  const h = createHmac("sha256", AUTH_FINGERPRINT_SECRET);
+  if (cc.privateKey) updateField(h, "k", cc.privateKey);
   if (cc.password !== void 0) {
-    h.update("p");
-    h.update(cc.password);
-  }
-  if (typeof cc.agent === "string") {
-    h.update("a");
-    h.update(cc.agent);
+    updateField(h, "p", scryptSync(cc.password, AUTH_FINGERPRINT_SECRET, 32, { N: PASSWORD_SCRYPT_COST }));
   }
-  return h.digest("hex").slice(0, 16);
+  if (typeof cc.agent === "string") updateField(h, "a", cc.agent);
+  return h.digest("hex").slice(0, 32);
 }
 function resolveOrDiagnose(config) {
   try {
@@ -1510,7 +1524,7 @@ var ConnectionPool = class {
       return client;
     }
     throw new Error(
-      `Failed to acquire SSH connection for ${key} after ${MAX_ACQUIRE_ATTEMPTS} attempts: ${lastErr instanceof Error ? lastErr.message : String(lastErr)}`
+      `Failed to acquire SSH connection for ${cc.username}@${cc.host}:${cc.port} after ${MAX_ACQUIRE_ATTEMPTS} attempts: ${lastErr instanceof Error ? lastErr.message : String(lastErr)}`
     );
   }
   release(client) {
@@ -1743,7 +1757,23 @@ async function multiExec(pool, hosts, command, timeoutMs = 3e4) {
 }
 var VALID_FIND_SIZE = /^\d+[cwbkMG]?$/;
 var FIND_EXPRESSION_TOKENS = /* @__PURE__ */ new Set(["(", ")", "!", ","]);
+var VALID_FIND_TYPES = /* @__PURE__ */ new Set(["f", "d", "l"]);
+function isNonNegativeInteger(n) {
+  return typeof n === "number" && Number.isSafeInteger(n) && n >= 0;
+}
 async function find(client, options, timeoutMs = 3e4) {
+  if (options.type !== void 0 && !VALID_FIND_TYPES.has(options.type)) {
+    throw new Error(`Invalid type: "${String(options.type)}". Expected one of: f (file), d (directory), l (symlink)`);
+  }
+  if (options.maxdepth !== void 0 && !isNonNegativeInteger(options.maxdepth)) {
+    throw new Error(`Invalid maxdepth: ${String(options.maxdepth)}. Expected a non-negative integer`);
+  }
+  if (options.minsize !== void 0 && typeof options.minsize !== "string") {
+    throw new Error('Invalid minsize: expected a string such as "1M" or "100k"');
+  }
+  if (options.maxsize !== void 0 && typeof options.maxsize !== "string") {
+    throw new Error('Invalid maxsize: expected a string such as "10M" or "500k"');
+  }
   if (options.minsize && !VALID_FIND_SIZE.test(options.minsize)) {
     throw new Error(
       `Invalid minsize format: "${options.minsize}". Expected: digits followed by optional c/w/b/k/M/G (e.g. "1M", "100k")`
@@ -1756,11 +1786,11 @@ async function find(client, options, timeoutMs = 3e4) {
   }
   const pathOperand = options.path.startsWith("-") || FIND_EXPRESSION_TOKENS.has(options.path) ? `./${options.path}` : options.path;
   const args = [shellQuote(pathOperand)];
-  if (options.maxdepth !== void 0) args.push("-maxdepth", String(options.maxdepth));
-  if (options.type) args.push("-type", options.type);
+  if (options.maxdepth !== void 0) args.push("-maxdepth", shellQuote(String(options.maxdepth)));
+  if (options.type) args.push("-type", shellQuote(options.type));
   if (options.name) args.push("-name", shellQuote(options.name));
-  if (options.minsize) args.push("-size", `+${options.minsize}`);
-  if (options.maxsize) args.push("-size", `-${options.maxsize}`);
+  if (options.minsize) args.push("-size", shellQuote(`+${options.minsize}`));
+  if (options.maxsize) args.push("-size", shellQuote(`-${options.maxsize}`));
   if (options.newer) args.push("-newer", shellQuote(options.newer));
   const command = `find ${args.join(" ")}`;
   const result = await exec(client, command, timeoutMs);
@@ -1770,6 +1800,9 @@ async function find(client, options, timeoutMs = 3e4) {
   return result.stdout.split("\n").filter(Boolean);
 }
 async function tail(client, path, lines = 100, grep, timeoutMs = 3e4) {
+  if (!isNonNegativeInteger(lines) || lines === 0) {
+    throw new Error(`Invalid lines: ${String(lines)}. Expected a positive integer`);
+  }
   let command = `tail -n ${lines} -- ${shellQuote(path)}`;
   if (grep) {
     command += ` | grep -i -e ${shellQuote(grep)}`;
@@ -2314,7 +2347,7 @@ ${result.stderr}`);
       path: z.string().describe("Directory to search in (e.g. /var/log, /home/user)"),
       name: z.string().optional().describe("Filename pattern with wildcards (e.g. '*.log', 'config.*')"),
       type: z.enum(["f", "d", "l"]).optional().describe("File type: f=file, d=directory, l=symlink"),
-      maxdepth: z.number().optional().describe("Maximum directory depth to search"),
+      maxdepth: z.number().int().nonnegative().optional().describe("Maximum directory depth to search (0 = the path itself only)"),
       minsize: z.string().optional().describe("Minimum file size (e.g. '1M', '100k')"),
       maxsize: z.string().optional().describe("Maximum file size (e.g. '10M', '500k')"),
       newer: z.string().optional().describe("Reference file path -- find matches files modified more recently than this file"),

package/dist/server.js

@@ -299,7 +299,16 @@ function diagnose(host, port = 22) {
 
 // src/env.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { appendFileSync, existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync3, statSync } from "fs";
+import {
+  appendFileSync,
+  closeSync,
+  existsSync as existsSync2,
+  constants as fsConstants,
+  fstatSync,
+  openSync,
+  readdirSync as readdirSync2,
+  readFileSync as readFileSync3
+} from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join3 } from "path";
 
@@ -1092,7 +1101,7 @@ function ensureAgent() {
     message: 'Could not start ssh-agent. Run manually: eval "$(ssh-agent -s)"'
   };
 }
-function detectKeyType(filePath, fileName) {
+function detectKeyType(filePath, fileName, content) {
   const pubPath = `${filePath}.pub`;
   if (existsSync2(pubPath)) {
     try {
@@ -1109,7 +1118,6 @@ function detectKeyType(filePath, fileName) {
   if (fileName.includes("ecdsa")) return "ecdsa";
   if (fileName.includes("dsa")) return "dsa";
   try {
-    const content = readFileSync3(filePath, "utf8");
     if (content.includes("RSA PRIVATE KEY")) return "rsa";
     if (content.includes("EC PRIVATE KEY")) return "ecdsa";
     if (content.includes("DSA PRIVATE KEY")) return "dsa";
@@ -1148,12 +1156,13 @@ function listSshKeysDetailed() {
   for (const file of files) {
     if (file.endsWith(".pub") || file.startsWith(".") || SSH_NON_KEY_FILES.has(file)) continue;
     const filePath = join3(sshDir, file);
+    let fd;
     try {
-      const stat = statSync(filePath);
-      if (!stat.isFile()) continue;
-      const content = readFileSync3(filePath, "utf8");
+      fd = openSync(filePath, fsConstants.O_RDONLY | (fsConstants.O_NONBLOCK ?? 0) | (fsConstants.O_NOCTTY ?? 0));
+      if (!fstatSync(fd).isFile()) continue;
+      const content = readFileSync3(fd, "utf8");
       if (!content.includes("PRIVATE KEY")) continue;
-      const type = detectKeyType(filePath, file);
+      const type = detectKeyType(filePath, file, content);
       let fingerprint;
       const { stdout: fpOut, ok: fpOk } = runArgs("ssh-keygen", ["-lf", filePath]);
       if (fpOk) {
@@ -1163,6 +1172,8 @@ function listSshKeysDetailed() {
       const loadedInAgent = fingerprint ? loadedFingerprints.has(fingerprint) : false;
       keys.push({ name: file, path: filePath, type, fingerprint, loadedInAgent });
     } catch {
+    } finally {
+      if (fd !== void 0) closeSync(fd);
     }
   }
   return { status: "ok", dir: sshDir, keys };
@@ -1318,7 +1329,7 @@ function testConnection(host, port = 22) {
 }
 
 // src/pool.ts
-import { createHash } from "crypto";
+import { createHmac, randomBytes, scryptSync } from "crypto";
 var POOL_FULL_ERROR_CODE = "ERR_SSH_MCP_POOL_FULL";
 var PoolFullError = class extends Error {
   code = POOL_FULL_ERROR_CODE;
@@ -1348,21 +1359,24 @@ function defaultMaxPoolSize() {
   const parsed = Number.parseInt(raw, 10);
   return Number.isFinite(parsed) && parsed > 0 ? parsed : 100;
 }
+var AUTH_FINGERPRINT_SECRET = randomBytes(32);
+var PASSWORD_SCRYPT_COST = 1024;
+function updateField(h, tag, value) {
+  const bytes = typeof value === "string" ? Buffer.from(value, "utf8") : value;
+  const len = Buffer.alloc(4);
+  len.writeUInt32BE(bytes.length);
+  h.update(tag);
+  h.update(len);
+  h.update(bytes);
+}
 function authFingerprint(cc) {
-  const h = createHash("sha256");
-  if (cc.privateKey) {
-    h.update("k");
-    h.update(cc.privateKey);
-  }
+  const h = createHmac("sha256", AUTH_FINGERPRINT_SECRET);
+  if (cc.privateKey) updateField(h, "k", cc.privateKey);
   if (cc.password !== void 0) {
-    h.update("p");
-    h.update(cc.password);
-  }
-  if (typeof cc.agent === "string") {
-    h.update("a");
-    h.update(cc.agent);
+    updateField(h, "p", scryptSync(cc.password, AUTH_FINGERPRINT_SECRET, 32, { N: PASSWORD_SCRYPT_COST }));
   }
-  return h.digest("hex").slice(0, 16);
+  if (typeof cc.agent === "string") updateField(h, "a", cc.agent);
+  return h.digest("hex").slice(0, 32);
 }
 function resolveOrDiagnose(config) {
   try {
@@ -1522,7 +1536,7 @@ var ConnectionPool = class {
       return client;
     }
     throw new Error(
-      `Failed to acquire SSH connection for ${key} after ${MAX_ACQUIRE_ATTEMPTS} attempts: ${lastErr instanceof Error ? lastErr.message : String(lastErr)}`
+      `Failed to acquire SSH connection for ${cc.username}@${cc.host}:${cc.port} after ${MAX_ACQUIRE_ATTEMPTS} attempts: ${lastErr instanceof Error ? lastErr.message : String(lastErr)}`
     );
   }
   release(client) {
@@ -1746,7 +1760,23 @@ async function multiExec(pool, hosts, command, timeoutMs = 3e4) {
 }
 var VALID_FIND_SIZE = /^\d+[cwbkMG]?$/;
 var FIND_EXPRESSION_TOKENS = /* @__PURE__ */ new Set(["(", ")", "!", ","]);
+var VALID_FIND_TYPES = /* @__PURE__ */ new Set(["f", "d", "l"]);
+function isNonNegativeInteger(n) {
+  return typeof n === "number" && Number.isSafeInteger(n) && n >= 0;
+}
 async function find(client, options, timeoutMs = 3e4) {
+  if (options.type !== void 0 && !VALID_FIND_TYPES.has(options.type)) {
+    throw new Error(`Invalid type: "${String(options.type)}". Expected one of: f (file), d (directory), l (symlink)`);
+  }
+  if (options.maxdepth !== void 0 && !isNonNegativeInteger(options.maxdepth)) {
+    throw new Error(`Invalid maxdepth: ${String(options.maxdepth)}. Expected a non-negative integer`);
+  }
+  if (options.minsize !== void 0 && typeof options.minsize !== "string") {
+    throw new Error('Invalid minsize: expected a string such as "1M" or "100k"');
+  }
+  if (options.maxsize !== void 0 && typeof options.maxsize !== "string") {
+    throw new Error('Invalid maxsize: expected a string such as "10M" or "500k"');
+  }
   if (options.minsize && !VALID_FIND_SIZE.test(options.minsize)) {
     throw new Error(
       `Invalid minsize format: "${options.minsize}". Expected: digits followed by optional c/w/b/k/M/G (e.g. "1M", "100k")`
@@ -1759,11 +1789,11 @@ async function find(client, options, timeoutMs = 3e4) {
   }
   const pathOperand = options.path.startsWith("-") || FIND_EXPRESSION_TOKENS.has(options.path) ? `./${options.path}` : options.path;
   const args = [shellQuote(pathOperand)];
-  if (options.maxdepth !== void 0) args.push("-maxdepth", String(options.maxdepth));
-  if (options.type) args.push("-type", options.type);
+  if (options.maxdepth !== void 0) args.push("-maxdepth", shellQuote(String(options.maxdepth)));
+  if (options.type) args.push("-type", shellQuote(options.type));
   if (options.name) args.push("-name", shellQuote(options.name));
-  if (options.minsize) args.push("-size", `+${options.minsize}`);
-  if (options.maxsize) args.push("-size", `-${options.maxsize}`);
+  if (options.minsize) args.push("-size", shellQuote(`+${options.minsize}`));
+  if (options.maxsize) args.push("-size", shellQuote(`-${options.maxsize}`));
   if (options.newer) args.push("-newer", shellQuote(options.newer));
   const command = `find ${args.join(" ")}`;
   const result = await exec(client, command, timeoutMs);
@@ -1773,6 +1803,9 @@ async function find(client, options, timeoutMs = 3e4) {
   return result.stdout.split("\n").filter(Boolean);
 }
 async function tail(client, path, lines = 100, grep, timeoutMs = 3e4) {
+  if (!isNonNegativeInteger(lines) || lines === 0) {
+    throw new Error(`Invalid lines: ${String(lines)}. Expected a positive integer`);
+  }
   let command = `tail -n ${lines} -- ${shellQuote(path)}`;
   if (grep) {
     command += ` | grep -i -e ${shellQuote(grep)}`;
@@ -2320,7 +2353,7 @@ ${result.stderr}`);
       path: z.string().describe("Directory to search in (e.g. /var/log, /home/user)"),
       name: z.string().optional().describe("Filename pattern with wildcards (e.g. '*.log', 'config.*')"),
       type: z.enum(["f", "d", "l"]).optional().describe("File type: f=file, d=directory, l=symlink"),
-      maxdepth: z.number().optional().describe("Maximum directory depth to search"),
+      maxdepth: z.number().int().nonnegative().optional().describe("Maximum directory depth to search (0 = the path itself only)"),
       minsize: z.string().optional().describe("Minimum file size (e.g. '1M', '100k')"),
       maxsize: z.string().optional().describe("Maximum file size (e.g. '10M', '500k')"),
       newer: z.string().optional().describe("Reference file path -- find matches files modified more recently than this file"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/ssh-mcp",
-  "version": "0.17.1",
+  "version": "0.17.3",
   "mcpName": "io.github.YawLabs/ssh-mcp",
   "description": "SSH MCP server: run remote commands, transfer files over SFTP, manage ssh-agent keys and known_hosts, and auto-diagnose SSH failures.",
   "type": "module",
@@ -63,7 +63,7 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@modelcontextprotocol/sdk": "^1.32.1",
     "ssh2": "^1.17.0",
     "zod": "^4.4.3"
   },