@yawlabs/ssh-mcp 0.17.2 → 0.17.3

package/dist/index.js

@@ -11,7 +11,16 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 
 // src/env.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { appendFileSync, existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync3, statSync } from "fs";
+import {
+  appendFileSync,
+  closeSync,
+  existsSync as existsSync2,
+  constants as fsConstants,
+  fstatSync,
+  openSync,
+  readdirSync as readdirSync2,
+  readFileSync as readFileSync3
+} from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join3 } from "path";
 
@@ -1083,7 +1092,7 @@ function ensureAgent() {
     message: 'Could not start ssh-agent. Run manually: eval "$(ssh-agent -s)"'
   };
 }
-function detectKeyType(filePath, fileName) {
+function detectKeyType(filePath, fileName, content) {
   const pubPath = `${filePath}.pub`;
   if (existsSync2(pubPath)) {
     try {
@@ -1100,7 +1109,6 @@ function detectKeyType(filePath, fileName) {
   if (fileName.includes("ecdsa")) return "ecdsa";
   if (fileName.includes("dsa")) return "dsa";
   try {
-    const content = readFileSync3(filePath, "utf8");
     if (content.includes("RSA PRIVATE KEY")) return "rsa";
     if (content.includes("EC PRIVATE KEY")) return "ecdsa";
     if (content.includes("DSA PRIVATE KEY")) return "dsa";
@@ -1136,12 +1144,13 @@ function listSshKeysDetailed() {
   for (const file of files) {
     if (file.endsWith(".pub") || file.startsWith(".") || SSH_NON_KEY_FILES.has(file)) continue;
     const filePath = join3(sshDir, file);
+    let fd;
     try {
-      const stat = statSync(filePath);
-      if (!stat.isFile()) continue;
-      const content = readFileSync3(filePath, "utf8");
+      fd = openSync(filePath, fsConstants.O_RDONLY | (fsConstants.O_NONBLOCK ?? 0) | (fsConstants.O_NOCTTY ?? 0));
+      if (!fstatSync(fd).isFile()) continue;
+      const content = readFileSync3(fd, "utf8");
       if (!content.includes("PRIVATE KEY")) continue;
-      const type = detectKeyType(filePath, file);
+      const type = detectKeyType(filePath, file, content);
       let fingerprint;
       const { stdout: fpOut, ok: fpOk } = runArgs("ssh-keygen", ["-lf", filePath]);
       if (fpOk) {
@@ -1151,6 +1160,8 @@ function listSshKeysDetailed() {
       const loadedInAgent = fingerprint ? loadedFingerprints.has(fingerprint) : false;
       keys.push({ name: file, path: filePath, type, fingerprint, loadedInAgent });
     } catch {
+    } finally {
+      if (fd !== void 0) closeSync(fd);
     }
   }
   return { status: "ok", dir: sshDir, keys };
@@ -1306,7 +1317,7 @@ function testConnection(host, port = 22) {
 }
 
 // src/pool.ts
-import { createHash } from "crypto";
+import { createHmac, randomBytes, scryptSync } from "crypto";
 var POOL_FULL_ERROR_CODE = "ERR_SSH_MCP_POOL_FULL";
 var PoolFullError = class extends Error {
   code = POOL_FULL_ERROR_CODE;
@@ -1336,21 +1347,24 @@ function defaultMaxPoolSize() {
   const parsed = Number.parseInt(raw, 10);
   return Number.isFinite(parsed) && parsed > 0 ? parsed : 100;
 }
+var AUTH_FINGERPRINT_SECRET = randomBytes(32);
+var PASSWORD_SCRYPT_COST = 1024;
+function updateField(h, tag, value) {
+  const bytes = typeof value === "string" ? Buffer.from(value, "utf8") : value;
+  const len = Buffer.alloc(4);
+  len.writeUInt32BE(bytes.length);
+  h.update(tag);
+  h.update(len);
+  h.update(bytes);
+}
 function authFingerprint(cc) {
-  const h = createHash("sha256");
-  if (cc.privateKey) {
-    h.update("k");
-    h.update(cc.privateKey);
-  }
+  const h = createHmac("sha256", AUTH_FINGERPRINT_SECRET);
+  if (cc.privateKey) updateField(h, "k", cc.privateKey);
   if (cc.password !== void 0) {
-    h.update("p");
-    h.update(cc.password);
-  }
-  if (typeof cc.agent === "string") {
-    h.update("a");
-    h.update(cc.agent);
+    updateField(h, "p", scryptSync(cc.password, AUTH_FINGERPRINT_SECRET, 32, { N: PASSWORD_SCRYPT_COST }));
   }
-  return h.digest("hex").slice(0, 16);
+  if (typeof cc.agent === "string") updateField(h, "a", cc.agent);
+  return h.digest("hex").slice(0, 32);
 }
 function resolveOrDiagnose(config) {
   try {
@@ -1510,7 +1524,7 @@ var ConnectionPool = class {
       return client;
     }
     throw new Error(
-      `Failed to acquire SSH connection for ${key} after ${MAX_ACQUIRE_ATTEMPTS} attempts: ${lastErr instanceof Error ? lastErr.message : String(lastErr)}`
+      `Failed to acquire SSH connection for ${cc.username}@${cc.host}:${cc.port} after ${MAX_ACQUIRE_ATTEMPTS} attempts: ${lastErr instanceof Error ? lastErr.message : String(lastErr)}`
     );
   }
   release(client) {
@@ -1743,7 +1757,23 @@ async function multiExec(pool, hosts, command, timeoutMs = 3e4) {
 }
 var VALID_FIND_SIZE = /^\d+[cwbkMG]?$/;
 var FIND_EXPRESSION_TOKENS = /* @__PURE__ */ new Set(["(", ")", "!", ","]);
+var VALID_FIND_TYPES = /* @__PURE__ */ new Set(["f", "d", "l"]);
+function isNonNegativeInteger(n) {
+  return typeof n === "number" && Number.isSafeInteger(n) && n >= 0;
+}
 async function find(client, options, timeoutMs = 3e4) {
+  if (options.type !== void 0 && !VALID_FIND_TYPES.has(options.type)) {
+    throw new Error(`Invalid type: "${String(options.type)}". Expected one of: f (file), d (directory), l (symlink)`);
+  }
+  if (options.maxdepth !== void 0 && !isNonNegativeInteger(options.maxdepth)) {
+    throw new Error(`Invalid maxdepth: ${String(options.maxdepth)}. Expected a non-negative integer`);
+  }
+  if (options.minsize !== void 0 && typeof options.minsize !== "string") {
+    throw new Error('Invalid minsize: expected a string such as "1M" or "100k"');
+  }
+  if (options.maxsize !== void 0 && typeof options.maxsize !== "string") {
+    throw new Error('Invalid maxsize: expected a string such as "10M" or "500k"');
+  }
   if (options.minsize && !VALID_FIND_SIZE.test(options.minsize)) {
     throw new Error(
       `Invalid minsize format: "${options.minsize}". Expected: digits followed by optional c/w/b/k/M/G (e.g. "1M", "100k")`
@@ -1756,11 +1786,11 @@ async function find(client, options, timeoutMs = 3e4) {
   }
   const pathOperand = options.path.startsWith("-") || FIND_EXPRESSION_TOKENS.has(options.path) ? `./${options.path}` : options.path;
   const args = [shellQuote(pathOperand)];
-  if (options.maxdepth !== void 0) args.push("-maxdepth", String(options.maxdepth));
-  if (options.type) args.push("-type", options.type);
+  if (options.maxdepth !== void 0) args.push("-maxdepth", shellQuote(String(options.maxdepth)));
+  if (options.type) args.push("-type", shellQuote(options.type));
   if (options.name) args.push("-name", shellQuote(options.name));
-  if (options.minsize) args.push("-size", `+${options.minsize}`);
-  if (options.maxsize) args.push("-size", `-${options.maxsize}`);
+  if (options.minsize) args.push("-size", shellQuote(`+${options.minsize}`));
+  if (options.maxsize) args.push("-size", shellQuote(`-${options.maxsize}`));
   if (options.newer) args.push("-newer", shellQuote(options.newer));
   const command = `find ${args.join(" ")}`;
   const result = await exec(client, command, timeoutMs);
@@ -1770,6 +1800,9 @@ async function find(client, options, timeoutMs = 3e4) {
   return result.stdout.split("\n").filter(Boolean);
 }
 async function tail(client, path, lines = 100, grep, timeoutMs = 3e4) {
+  if (!isNonNegativeInteger(lines) || lines === 0) {
+    throw new Error(`Invalid lines: ${String(lines)}. Expected a positive integer`);
+  }
   let command = `tail -n ${lines} -- ${shellQuote(path)}`;
   if (grep) {
     command += ` | grep -i -e ${shellQuote(grep)}`;
@@ -2314,7 +2347,7 @@ ${result.stderr}`);
       path: z.string().describe("Directory to search in (e.g. /var/log, /home/user)"),
       name: z.string().optional().describe("Filename pattern with wildcards (e.g. '*.log', 'config.*')"),
       type: z.enum(["f", "d", "l"]).optional().describe("File type: f=file, d=directory, l=symlink"),
-      maxdepth: z.number().optional().describe("Maximum directory depth to search"),
+      maxdepth: z.number().int().nonnegative().optional().describe("Maximum directory depth to search (0 = the path itself only)"),
       minsize: z.string().optional().describe("Minimum file size (e.g. '1M', '100k')"),
       maxsize: z.string().optional().describe("Maximum file size (e.g. '10M', '500k')"),
       newer: z.string().optional().describe("Reference file path -- find matches files modified more recently than this file"),

package/dist/server.js

@@ -299,7 +299,16 @@ function diagnose(host, port = 22) {
 
 // src/env.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { appendFileSync, existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync3, statSync } from "fs";
+import {
+  appendFileSync,
+  closeSync,
+  existsSync as existsSync2,
+  constants as fsConstants,
+  fstatSync,
+  openSync,
+  readdirSync as readdirSync2,
+  readFileSync as readFileSync3
+} from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join3 } from "path";
 
@@ -1092,7 +1101,7 @@ function ensureAgent() {
     message: 'Could not start ssh-agent. Run manually: eval "$(ssh-agent -s)"'
   };
 }
-function detectKeyType(filePath, fileName) {
+function detectKeyType(filePath, fileName, content) {
   const pubPath = `${filePath}.pub`;
   if (existsSync2(pubPath)) {
     try {
@@ -1109,7 +1118,6 @@ function detectKeyType(filePath, fileName) {
   if (fileName.includes("ecdsa")) return "ecdsa";
   if (fileName.includes("dsa")) return "dsa";
   try {
-    const content = readFileSync3(filePath, "utf8");
     if (content.includes("RSA PRIVATE KEY")) return "rsa";
     if (content.includes("EC PRIVATE KEY")) return "ecdsa";
     if (content.includes("DSA PRIVATE KEY")) return "dsa";
@@ -1148,12 +1156,13 @@ function listSshKeysDetailed() {
   for (const file of files) {
     if (file.endsWith(".pub") || file.startsWith(".") || SSH_NON_KEY_FILES.has(file)) continue;
     const filePath = join3(sshDir, file);
+    let fd;
     try {
-      const stat = statSync(filePath);
-      if (!stat.isFile()) continue;
-      const content = readFileSync3(filePath, "utf8");
+      fd = openSync(filePath, fsConstants.O_RDONLY | (fsConstants.O_NONBLOCK ?? 0) | (fsConstants.O_NOCTTY ?? 0));
+      if (!fstatSync(fd).isFile()) continue;
+      const content = readFileSync3(fd, "utf8");
       if (!content.includes("PRIVATE KEY")) continue;
-      const type = detectKeyType(filePath, file);
+      const type = detectKeyType(filePath, file, content);
       let fingerprint;
       const { stdout: fpOut, ok: fpOk } = runArgs("ssh-keygen", ["-lf", filePath]);
       if (fpOk) {
@@ -1163,6 +1172,8 @@ function listSshKeysDetailed() {
       const loadedInAgent = fingerprint ? loadedFingerprints.has(fingerprint) : false;
       keys.push({ name: file, path: filePath, type, fingerprint, loadedInAgent });
     } catch {
+    } finally {
+      if (fd !== void 0) closeSync(fd);
     }
   }
   return { status: "ok", dir: sshDir, keys };
@@ -1318,7 +1329,7 @@ function testConnection(host, port = 22) {
 }
 
 // src/pool.ts
-import { createHash } from "crypto";
+import { createHmac, randomBytes, scryptSync } from "crypto";
 var POOL_FULL_ERROR_CODE = "ERR_SSH_MCP_POOL_FULL";
 var PoolFullError = class extends Error {
   code = POOL_FULL_ERROR_CODE;
@@ -1348,21 +1359,24 @@ function defaultMaxPoolSize() {
   const parsed = Number.parseInt(raw, 10);
   return Number.isFinite(parsed) && parsed > 0 ? parsed : 100;
 }
+var AUTH_FINGERPRINT_SECRET = randomBytes(32);
+var PASSWORD_SCRYPT_COST = 1024;
+function updateField(h, tag, value) {
+  const bytes = typeof value === "string" ? Buffer.from(value, "utf8") : value;
+  const len = Buffer.alloc(4);
+  len.writeUInt32BE(bytes.length);
+  h.update(tag);
+  h.update(len);
+  h.update(bytes);
+}
 function authFingerprint(cc) {
-  const h = createHash("sha256");
-  if (cc.privateKey) {
-    h.update("k");
-    h.update(cc.privateKey);
-  }
+  const h = createHmac("sha256", AUTH_FINGERPRINT_SECRET);
+  if (cc.privateKey) updateField(h, "k", cc.privateKey);
   if (cc.password !== void 0) {
-    h.update("p");
-    h.update(cc.password);
-  }
-  if (typeof cc.agent === "string") {
-    h.update("a");
-    h.update(cc.agent);
+    updateField(h, "p", scryptSync(cc.password, AUTH_FINGERPRINT_SECRET, 32, { N: PASSWORD_SCRYPT_COST }));
   }
-  return h.digest("hex").slice(0, 16);
+  if (typeof cc.agent === "string") updateField(h, "a", cc.agent);
+  return h.digest("hex").slice(0, 32);
 }
 function resolveOrDiagnose(config) {
   try {
@@ -1522,7 +1536,7 @@ var ConnectionPool = class {
       return client;
     }
     throw new Error(
-      `Failed to acquire SSH connection for ${key} after ${MAX_ACQUIRE_ATTEMPTS} attempts: ${lastErr instanceof Error ? lastErr.message : String(lastErr)}`
+      `Failed to acquire SSH connection for ${cc.username}@${cc.host}:${cc.port} after ${MAX_ACQUIRE_ATTEMPTS} attempts: ${lastErr instanceof Error ? lastErr.message : String(lastErr)}`
     );
   }
   release(client) {
@@ -1746,7 +1760,23 @@ async function multiExec(pool, hosts, command, timeoutMs = 3e4) {
 }
 var VALID_FIND_SIZE = /^\d+[cwbkMG]?$/;
 var FIND_EXPRESSION_TOKENS = /* @__PURE__ */ new Set(["(", ")", "!", ","]);
+var VALID_FIND_TYPES = /* @__PURE__ */ new Set(["f", "d", "l"]);
+function isNonNegativeInteger(n) {
+  return typeof n === "number" && Number.isSafeInteger(n) && n >= 0;
+}
 async function find(client, options, timeoutMs = 3e4) {
+  if (options.type !== void 0 && !VALID_FIND_TYPES.has(options.type)) {
+    throw new Error(`Invalid type: "${String(options.type)}". Expected one of: f (file), d (directory), l (symlink)`);
+  }
+  if (options.maxdepth !== void 0 && !isNonNegativeInteger(options.maxdepth)) {
+    throw new Error(`Invalid maxdepth: ${String(options.maxdepth)}. Expected a non-negative integer`);
+  }
+  if (options.minsize !== void 0 && typeof options.minsize !== "string") {
+    throw new Error('Invalid minsize: expected a string such as "1M" or "100k"');
+  }
+  if (options.maxsize !== void 0 && typeof options.maxsize !== "string") {
+    throw new Error('Invalid maxsize: expected a string such as "10M" or "500k"');
+  }
   if (options.minsize && !VALID_FIND_SIZE.test(options.minsize)) {
     throw new Error(
       `Invalid minsize format: "${options.minsize}". Expected: digits followed by optional c/w/b/k/M/G (e.g. "1M", "100k")`
@@ -1759,11 +1789,11 @@ async function find(client, options, timeoutMs = 3e4) {
   }
   const pathOperand = options.path.startsWith("-") || FIND_EXPRESSION_TOKENS.has(options.path) ? `./${options.path}` : options.path;
   const args = [shellQuote(pathOperand)];
-  if (options.maxdepth !== void 0) args.push("-maxdepth", String(options.maxdepth));
-  if (options.type) args.push("-type", options.type);
+  if (options.maxdepth !== void 0) args.push("-maxdepth", shellQuote(String(options.maxdepth)));
+  if (options.type) args.push("-type", shellQuote(options.type));
   if (options.name) args.push("-name", shellQuote(options.name));
-  if (options.minsize) args.push("-size", `+${options.minsize}`);
-  if (options.maxsize) args.push("-size", `-${options.maxsize}`);
+  if (options.minsize) args.push("-size", shellQuote(`+${options.minsize}`));
+  if (options.maxsize) args.push("-size", shellQuote(`-${options.maxsize}`));
   if (options.newer) args.push("-newer", shellQuote(options.newer));
   const command = `find ${args.join(" ")}`;
   const result = await exec(client, command, timeoutMs);
@@ -1773,6 +1803,9 @@ async function find(client, options, timeoutMs = 3e4) {
   return result.stdout.split("\n").filter(Boolean);
 }
 async function tail(client, path, lines = 100, grep, timeoutMs = 3e4) {
+  if (!isNonNegativeInteger(lines) || lines === 0) {
+    throw new Error(`Invalid lines: ${String(lines)}. Expected a positive integer`);
+  }
   let command = `tail -n ${lines} -- ${shellQuote(path)}`;
   if (grep) {
     command += ` | grep -i -e ${shellQuote(grep)}`;
@@ -2320,7 +2353,7 @@ ${result.stderr}`);
       path: z.string().describe("Directory to search in (e.g. /var/log, /home/user)"),
       name: z.string().optional().describe("Filename pattern with wildcards (e.g. '*.log', 'config.*')"),
       type: z.enum(["f", "d", "l"]).optional().describe("File type: f=file, d=directory, l=symlink"),
-      maxdepth: z.number().optional().describe("Maximum directory depth to search"),
+      maxdepth: z.number().int().nonnegative().optional().describe("Maximum directory depth to search (0 = the path itself only)"),
       minsize: z.string().optional().describe("Minimum file size (e.g. '1M', '100k')"),
       maxsize: z.string().optional().describe("Maximum file size (e.g. '10M', '500k')"),
       newer: z.string().optional().describe("Reference file path -- find matches files modified more recently than this file"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/ssh-mcp",
-  "version": "0.17.2",
+  "version": "0.17.3",
   "mcpName": "io.github.YawLabs/ssh-mcp",
   "description": "SSH MCP server: run remote commands, transfer files over SFTP, manage ssh-agent keys and known_hosts, and auto-diagnose SSH failures.",
   "type": "module",