@yawlabs/ssh-mcp 0.3.0 → 0.5.0

package/dist/index.js

@@ -3,11 +3,11 @@
 // src/index.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
-// src/server.ts
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-
-// src/tools.ts
-import { z } from "zod";
+// src/ssh.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+import { Client } from "ssh2";
 
 // src/diagnose.ts
 import { execFileSync } from "child_process";
@@ -30,6 +30,25 @@ function runArgs(cmd, args) {
 }
 function checkSshAgent() {
   const sock = process.env.SSH_AUTH_SOCK;
+  if (!sock && process.platform === "win32") {
+    const { stdout: stdout2, ok: ok2 } = runArgs("ssh-add", ["-l"]);
+    if (ok2) {
+      return { status: "ok", message: `Windows OpenSSH agent running with keys:
+${stdout2}` };
+    }
+    if (stdout2.includes("no identities") || stdout2.includes("The agent has no identities")) {
+      return {
+        status: "warning",
+        message: "Windows OpenSSH agent is running but has no keys loaded. Run: ssh-add <key-path>"
+      };
+    }
+    if (!stdout2.includes("Error connecting") && !stdout2.includes("unable to")) {
+      return {
+        status: "warning",
+        message: "Windows OpenSSH Authentication Agent may not be running. Start it: Get-Service ssh-agent | Set-Service -StartupType Automatic; Start-Service ssh-agent"
+      };
+    }
+  }
   if (!sock) {
     return {
       status: "error",
@@ -238,10 +257,359 @@ function diagnose(host, port = 22) {
   return { overall, checks, suggestions };
 }
 
+// src/ssh.ts
+function resolveFromSshConfig(host) {
+  try {
+    const { stdout, ok } = runArgs("ssh", ["-G", host]);
+    if (!ok) return null;
+    const config = {};
+    const identityFiles = [];
+    for (const line of stdout.split("\n")) {
+      const spaceIdx = line.indexOf(" ");
+      if (spaceIdx > 0) {
+        const key = line.substring(0, spaceIdx);
+        const value = line.substring(spaceIdx + 1);
+        if (key === "identityfile") {
+          identityFiles.push(value);
+        } else {
+          config[key] = value;
+        }
+      }
+    }
+    return {
+      hostname: config.hostname || host,
+      user: config.user || "",
+      port: config.port || "22",
+      identityFiles,
+      proxyJump: config.proxyjump && config.proxyjump !== "none" ? config.proxyjump : void 0
+    };
+  } catch {
+    return null;
+  }
+}
+function resolveConfig(config) {
+  const sshConfig = resolveFromSshConfig(config.host);
+  const connectConfig = {
+    host: sshConfig?.hostname || config.host,
+    port: config.port || (sshConfig ? Number.parseInt(sshConfig.port, 10) : 22),
+    username: config.username || sshConfig?.user || process.env.USER || process.env.USERNAME || "root",
+    keepaliveInterval: 15e3,
+    keepaliveCountMax: 3
+  };
+  const agentSock = config.agent || process.env.SSH_AUTH_SOCK || (process.platform === "win32" ? "\\\\.\\pipe\\openssh-ssh-agent" : void 0);
+  if (agentSock) {
+    connectConfig.agent = agentSock;
+  }
+  if (config.password) {
+    connectConfig.password = config.password;
+  }
+  if (config.privateKeyPath) {
+    connectConfig.privateKey = readFileSync2(config.privateKeyPath);
+  } else if (!agentSock) {
+    const home = homedir2();
+    const keyPaths = sshConfig && sshConfig.identityFiles.length > 0 ? sshConfig.identityFiles.map((p) => p.startsWith("~") ? join2(home, p.slice(1)) : p) : [join2(home, ".ssh", "id_ed25519"), join2(home, ".ssh", "id_rsa"), join2(home, ".ssh", "id_ecdsa")];
+    for (const keyPath of keyPaths) {
+      try {
+        connectConfig.privateKey = readFileSync2(keyPath);
+        break;
+      } catch {
+      }
+    }
+  }
+  return { connectConfig, proxyJump: sshConfig?.proxyJump };
+}
+function formatDiagnostics(host) {
+  try {
+    const checks = [
+      { name: "SSH Agent", ...checkSshAgent() },
+      { name: "SSH Keys", ...checkSshKeys() },
+      { name: "SSH Config", ...checkSshConfig(host) },
+      { name: "Known Hosts", ...checkKnownHosts(host) }
+    ];
+    const parts = [];
+    const suggestions = [];
+    for (const check of checks) {
+      if (check.status !== "ok") {
+        parts.push(`[${check.status.toUpperCase()}] ${check.name}: ${check.message}`);
+      }
+    }
+    const agent = checks[0];
+    if (agent.status === "error") suggestions.push('Start ssh-agent: eval "$(ssh-agent -s)"');
+    if (agent.status === "warning") suggestions.push("Load a key: ssh-add ~/.ssh/id_ed25519");
+    const keys = checks[1];
+    if (keys.status === "error") suggestions.push('Generate a key: ssh-keygen -t ed25519 -C "your@email.com"');
+    const known = checks[3];
+    if (known.status === "warning") suggestions.push(`Add host key: ssh-keyscan -H "${host}" >> ~/.ssh/known_hosts`);
+    if (suggestions.length > 0) {
+      parts.push(`Suggested fixes: ${suggestions.join(" | ")}`);
+    }
+    return parts.length > 0 ? parts.join("\n") : "";
+  } catch {
+    return "";
+  }
+}
+function connectRaw(connectConfig) {
+  return new Promise((resolve, reject) => {
+    const client = new Client();
+    client.on("ready", () => resolve(client)).on("error", (err) => reject(err)).connect(connectConfig);
+  });
+}
+async function connectWithProxy(resolved) {
+  if (!resolved.proxyJump) {
+    return connectRaw(resolved.connectConfig);
+  }
+  const jumpResolved = resolveConfig({ host: resolved.proxyJump });
+  const jumpClient = await connectWithProxy(jumpResolved);
+  const targetHost = resolved.connectConfig.host;
+  const targetPort = resolved.connectConfig.port;
+  const stream = await new Promise((resolve, reject) => {
+    jumpClient.forwardOut("127.0.0.1", 0, targetHost, targetPort, (err, stream2) => {
+      if (err) {
+        jumpClient.end();
+        return reject(err);
+      }
+      resolve(stream2);
+    });
+  });
+  return new Promise((resolve, reject) => {
+    const client = new Client();
+    client.on("ready", () => resolve(client)).on("error", (err) => {
+      jumpClient.end();
+      reject(err);
+    }).on("close", () => {
+      jumpClient.end();
+    }).connect({ ...resolved.connectConfig, sock: stream });
+  });
+}
+function exec(client, command, timeoutMs = 3e4) {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const settle = (fn) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      fn();
+    };
+    const timer = setTimeout(() => {
+      settle(() => reject(new Error(`Command timed out after ${timeoutMs}ms`)));
+    }, timeoutMs);
+    client.exec(command, (err, stream) => {
+      if (err) {
+        settle(() => reject(err));
+        return;
+      }
+      let stdout = "";
+      let stderr = "";
+      stream.on("close", (code) => {
+        settle(() => resolve({ stdout, stderr, code: code ?? 0 }));
+      }).on("data", (data) => {
+        stdout += data.toString();
+      }).on("error", (err2) => {
+        settle(() => reject(err2));
+      });
+      stream.stderr.on("data", (data) => {
+        stderr += data.toString();
+      }).on("error", (err2) => {
+        settle(() => reject(err2));
+      });
+    });
+  });
+}
+function getSftp(client) {
+  return new Promise((resolve, reject) => {
+    client.sftp((err, sftp) => {
+      if (err) return reject(err);
+      resolve(sftp);
+    });
+  });
+}
+async function readFile(client, remotePath) {
+  const sftp = await getSftp(client);
+  try {
+    return await new Promise((resolve, reject) => {
+      sftp.readFile(remotePath, (err, data) => {
+        if (err) return reject(err);
+        resolve(data.toString("utf8"));
+      });
+    });
+  } finally {
+    sftp.end();
+  }
+}
+async function writeFile(client, remotePath, content) {
+  const sftp = await getSftp(client);
+  try {
+    await new Promise((resolve, reject) => {
+      sftp.writeFile(remotePath, content, (err) => {
+        if (err) return reject(err);
+        resolve();
+      });
+    });
+  } finally {
+    sftp.end();
+  }
+}
+async function uploadFile(client, localPath, remotePath) {
+  const sftp = await getSftp(client);
+  try {
+    await new Promise((resolve, reject) => {
+      sftp.fastPut(localPath, remotePath, (err) => {
+        if (err) return reject(err);
+        resolve();
+      });
+    });
+  } finally {
+    sftp.end();
+  }
+}
+async function downloadFile(client, remotePath, localPath) {
+  const sftp = await getSftp(client);
+  try {
+    await new Promise((resolve, reject) => {
+      sftp.fastGet(remotePath, localPath, (err) => {
+        if (err) return reject(err);
+        resolve();
+      });
+    });
+  } finally {
+    sftp.end();
+  }
+}
+async function listDir(client, remotePath) {
+  const sftp = await getSftp(client);
+  try {
+    return await new Promise((resolve, reject) => {
+      sftp.readdir(remotePath, (err, list) => {
+        if (err) return reject(err);
+        resolve(list.map((item) => item.filename));
+      });
+    });
+  } finally {
+    sftp.end();
+  }
+}
+
+// src/pool.ts
+var ConnectionPool = class {
+  entries = /* @__PURE__ */ new Map();
+  idleTtlMs;
+  constructor(options) {
+    this.idleTtlMs = options?.idleTtlMs ?? 6e4;
+  }
+  async acquire(config) {
+    const resolved = resolveConfig(config);
+    const cc = resolved.connectConfig;
+    const key = `${cc.username}@${cc.host}:${cc.port}`;
+    const existing = this.entries.get(key);
+    if (existing && !existing.dead) {
+      existing.refCount++;
+      if (existing.idleTimer) {
+        clearTimeout(existing.idleTimer);
+        existing.idleTimer = null;
+      }
+      return existing.client;
+    }
+    if (existing?.dead) {
+      this.entries.delete(key);
+    }
+    try {
+      const client = await connectWithProxy(resolved);
+      const entry = { client, key, refCount: 1, idleTimer: null, dead: false };
+      const markDead = () => {
+        entry.dead = true;
+        if (entry.idleTimer) {
+          clearTimeout(entry.idleTimer);
+          entry.idleTimer = null;
+        }
+        if (this.entries.get(key) === entry) {
+          this.entries.delete(key);
+        }
+      };
+      client.on("close", markDead);
+      client.on("end", markDead);
+      client.on("error", markDead);
+      this.entries.set(key, entry);
+      return client;
+    } catch (err) {
+      const diag = formatDiagnostics(config.host);
+      if (diag) {
+        const message = err instanceof Error ? err.message : String(err);
+        const enhanced = new Error(`${message}
+
+SSH Diagnostics:
+${diag}`);
+        enhanced.cause = err;
+        throw enhanced;
+      }
+      throw err;
+    }
+  }
+  release(client) {
+    for (const entry of this.entries.values()) {
+      if (entry.client === client) {
+        entry.refCount = Math.max(0, entry.refCount - 1);
+        if (entry.refCount === 0 && !entry.dead) {
+          entry.idleTimer = setTimeout(() => {
+            try {
+              entry.client.end();
+            } catch {
+            }
+            this.entries.delete(entry.key);
+          }, this.idleTtlMs);
+          entry.idleTimer.unref();
+        }
+        return;
+      }
+    }
+    try {
+      client.end();
+    } catch {
+    }
+  }
+  async withConnection(config, fn) {
+    const client = await this.acquire(config);
+    try {
+      return await fn(client);
+    } finally {
+      this.release(client);
+    }
+  }
+  drain() {
+    for (const entry of this.entries.values()) {
+      if (entry.idleTimer) {
+        clearTimeout(entry.idleTimer);
+      }
+      try {
+        entry.client.end();
+      } catch {
+      }
+    }
+    this.entries.clear();
+  }
+  get size() {
+    return this.entries.size;
+  }
+  get stats() {
+    let active = 0;
+    let idle = 0;
+    for (const entry of this.entries.values()) {
+      if (entry.refCount > 0) active++;
+      else idle++;
+    }
+    return { active, idle };
+  }
+};
+
+// src/server.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+
+// src/tools.ts
+import { z } from "zod";
+
 // src/env.ts
-import { appendFileSync, existsSync as existsSync2, readFileSync as readFileSync2, readdirSync as readdirSync2, statSync } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join2 } from "path";
+import { appendFileSync, existsSync as existsSync2, readFileSync as readFileSync3, readdirSync as readdirSync2, statSync } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join3 } from "path";
 function ensureAgent() {
   const sock = process.env.SSH_AUTH_SOCK;
   if (sock) {
@@ -259,6 +627,21 @@ function ensureAgent() {
       };
     }
   }
+  if (!sock && process.platform === "win32") {
+    const { stdout: stdout2, ok: ok2 } = runArgs("ssh-add", ["-l"]);
+    const noIdentities = stdout2.includes("no identities") || stdout2.includes("The agent has no identities");
+    if (ok2 || noIdentities) {
+      const keys = ok2 && !noIdentities ? stdout2.split("\n").filter(Boolean) : [];
+      return {
+        running: true,
+        reachable: true,
+        socket: "\\\\.\\pipe\\openssh-ssh-agent",
+        keys,
+        started: false,
+        message: keys.length > 0 ? `Windows OpenSSH agent running with ${keys.length} key(s) loaded` : "Windows OpenSSH agent running but no keys loaded. Use ssh_key_load to add one."
+      };
+    }
+  }
   const { stdout, ok } = runArgs("ssh-agent", ["-s"]);
   if (ok) {
     const sockMatch = stdout.match(/SSH_AUTH_SOCK=([^;]+)/);
@@ -282,14 +665,14 @@ function ensureAgent() {
     reachable: false,
     keys: [],
     started: false,
-    message: 'Could not start ssh-agent. Run manually: eval "$(ssh-agent -s)"'
+    message: process.platform === "win32" ? "Windows OpenSSH agent not running. Start it: Get-Service ssh-agent | Set-Service -StartupType Automatic; Start-Service ssh-agent" : 'Could not start ssh-agent. Run manually: eval "$(ssh-agent -s)"'
   };
 }
 function detectKeyType(filePath, fileName) {
   const pubPath = `${filePath}.pub`;
   if (existsSync2(pubPath)) {
     try {
-      const pub = readFileSync2(pubPath, "utf8");
+      const pub = readFileSync3(pubPath, "utf8");
       if (pub.includes("ssh-ed25519")) return "ed25519";
       if (pub.includes("ssh-rsa")) return "rsa";
       if (pub.includes("ecdsa")) return "ecdsa";
@@ -302,7 +685,7 @@ function detectKeyType(filePath, fileName) {
   if (fileName.includes("ecdsa")) return "ecdsa";
   if (fileName.includes("dsa")) return "dsa";
   try {
-    const content = readFileSync2(filePath, "utf8");
+    const content = readFileSync3(filePath, "utf8");
     if (content.includes("RSA PRIVATE KEY")) return "rsa";
     if (content.includes("EC PRIVATE KEY")) return "ecdsa";
     if (content.includes("DSA PRIVATE KEY")) return "dsa";
@@ -311,7 +694,7 @@ function detectKeyType(filePath, fileName) {
   return "unknown";
 }
 function listSshKeys() {
-  const sshDir = join2(homedir2(), ".ssh");
+  const sshDir = join3(homedir3(), ".ssh");
   if (!existsSync2(sshDir)) return [];
   const loadedFingerprints = /* @__PURE__ */ new Set();
   const { stdout: agentOut, ok: agentOk } = runArgs("ssh-add", ["-l"]);
@@ -331,11 +714,11 @@ function listSshKeys() {
   }
   for (const file of files) {
     if (file.endsWith(".pub") || file.startsWith(".") || skipFiles.has(file)) continue;
-    const filePath = join2(sshDir, file);
+    const filePath = join3(sshDir, file);
     try {
       const stat = statSync(filePath);
       if (!stat.isFile()) continue;
-      const content = readFileSync2(filePath, "utf8");
+      const content = readFileSync3(filePath, "utf8");
       if (!content.includes("PRIVATE KEY")) continue;
       const type = detectKeyType(filePath, file);
       let fingerprint;
@@ -356,7 +739,7 @@ function loadKey(keyPath) {
   if (!agent.reachable) {
     return { status: "error", message: agent.message };
   }
-  const resolved = keyPath.startsWith("~") ? join2(homedir2(), keyPath.slice(1)) : keyPath;
+  const resolved = keyPath.startsWith("~") ? join3(homedir3(), keyPath.slice(1)) : keyPath;
   if (!existsSync2(resolved)) {
     return { status: "error", message: `Key not found: ${resolved}` };
   }
@@ -422,7 +805,7 @@ function fixKnownHosts(host, port = 22) {
   const { stdout: scanOut, ok: scanOk } = runArgs("ssh-keyscan", scanArgs);
   if (scanOk && scanOut.trim()) {
     try {
-      const knownHostsPath = join2(homedir2(), ".ssh", "known_hosts");
+      const knownHostsPath = join3(homedir3(), ".ssh", "known_hosts");
       appendFileSync(knownHostsPath, `
 ${scanOut.trim()}
 `);
@@ -515,192 +898,71 @@ function testConnection(host, port = 22) {
   return { status: "error", message: `Connection failed to ${host}:${port}: ${stdout}` };
 }
 
-// src/ssh.ts
-import { readFileSync as readFileSync3 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join3 } from "path";
-import { Client } from "ssh2";
-function resolveConfig(config) {
-  const connectConfig = {
-    host: config.host,
-    port: config.port || 22,
-    username: config.username || process.env.USER || process.env.USERNAME || "root"
-  };
-  if (config.privateKeyPath) {
-    connectConfig.privateKey = readFileSync3(config.privateKeyPath);
-  } else if (config.password) {
-    connectConfig.password = config.password;
-  } else if (config.agent || process.env.SSH_AUTH_SOCK) {
-    connectConfig.agent = config.agent || process.env.SSH_AUTH_SOCK;
-  } else {
-    const home = homedir3();
-    const defaultKeys = ["id_ed25519", "id_rsa", "id_ecdsa"];
-    for (const keyName of defaultKeys) {
-      const keyPath = join3(home, ".ssh", keyName);
-      try {
-        connectConfig.privateKey = readFileSync3(keyPath);
-        break;
-      } catch {
-      }
-    }
-  }
-  return connectConfig;
+// src/ops.ts
+function shellQuote(s) {
+  return `'${s.replace(/'/g, "'\\''")}'`;
 }
-function formatDiagnostics(host) {
-  try {
-    const checks = [
-      { name: "SSH Agent", ...checkSshAgent() },
-      { name: "SSH Keys", ...checkSshKeys() },
-      { name: "SSH Config", ...checkSshConfig(host) },
-      { name: "Known Hosts", ...checkKnownHosts(host) }
-    ];
-    const parts = [];
-    const suggestions = [];
-    for (const check of checks) {
-      if (check.status !== "ok") {
-        parts.push(`[${check.status.toUpperCase()}] ${check.name}: ${check.message}`);
-      }
-    }
-    const agent = checks[0];
-    if (agent.status === "error") suggestions.push('Start ssh-agent: eval "$(ssh-agent -s)"');
-    if (agent.status === "warning") suggestions.push("Load a key: ssh-add ~/.ssh/id_ed25519");
-    const keys = checks[1];
-    if (keys.status === "error") suggestions.push('Generate a key: ssh-keygen -t ed25519 -C "your@email.com"');
-    const known = checks[3];
-    if (known.status === "warning") suggestions.push(`Add host key: ssh-keyscan -H "${host}" >> ~/.ssh/known_hosts`);
-    if (suggestions.length > 0) {
-      parts.push(`Suggested fixes: ${suggestions.join(" | ")}`);
+async function multiExec(pool, hosts, command, timeoutMs = 3e4) {
+  const results = await Promise.allSettled(
+    hosts.map(async (hostConfig) => {
+      return pool.withConnection(hostConfig, async (client) => {
+        const result = await exec(client, command, timeoutMs);
+        return { host: hostConfig.host, ...result };
+      });
+    })
+  );
+  return results.map((result, i) => {
+    if (result.status === "fulfilled") {
+      return result.value;
     }
-    return parts.length > 0 ? parts.join("\n") : "";
-  } catch {
-    return "";
-  }
-}
-function connect(config) {
-  return new Promise((resolve, reject) => {
-    const client = new Client();
-    const connectConfig = resolveConfig(config);
-    client.on("ready", () => resolve(client)).on("error", (err) => {
-      const diag = formatDiagnostics(config.host);
-      if (diag) {
-        const enhanced = new Error(`${err.message}
-
-SSH Diagnostics:
-${diag}`);
-        enhanced.cause = err;
-        reject(enhanced);
-      } else {
-        reject(err);
-      }
-    }).connect(connectConfig);
-  });
-}
-function exec(client, command, timeoutMs = 3e4) {
-  return new Promise((resolve, reject) => {
-    let settled = false;
-    const settle = (fn) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      fn();
+    return {
+      host: hosts[i].host,
+      stdout: "",
+      stderr: "",
+      code: -1,
+      error: result.reason instanceof Error ? result.reason.message : String(result.reason)
     };
-    const timer = setTimeout(() => {
-      settle(() => reject(new Error(`Command timed out after ${timeoutMs}ms`)));
-    }, timeoutMs);
-    client.exec(command, (err, stream) => {
-      if (err) {
-        settle(() => reject(err));
-        return;
-      }
-      let stdout = "";
-      let stderr = "";
-      stream.on("close", (code) => {
-        settle(() => resolve({ stdout, stderr, code: code ?? 0 }));
-      }).on("data", (data) => {
-        stdout += data.toString();
-      }).on("error", (err2) => {
-        settle(() => reject(err2));
-      });
-      stream.stderr.on("data", (data) => {
-        stderr += data.toString();
-      }).on("error", (err2) => {
-        settle(() => reject(err2));
-      });
-    });
-  });
-}
-function getSftp(client) {
-  return new Promise((resolve, reject) => {
-    client.sftp((err, sftp) => {
-      if (err) return reject(err);
-      resolve(sftp);
-    });
   });
 }
-async function readFile(client, remotePath) {
-  const sftp = await getSftp(client);
-  try {
-    return await new Promise((resolve, reject) => {
-      sftp.readFile(remotePath, (err, data) => {
-        if (err) return reject(err);
-        resolve(data.toString("utf8"));
-      });
-    });
-  } finally {
-    sftp.end();
-  }
+async function find(client, options, timeoutMs = 3e4) {
+  const args = [shellQuote(options.path)];
+  if (options.maxdepth !== void 0) args.push("-maxdepth", String(options.maxdepth));
+  if (options.type) args.push("-type", options.type);
+  if (options.name) args.push("-name", shellQuote(options.name));
+  if (options.minsize) args.push("-size", `+${options.minsize}`);
+  if (options.maxsize) args.push("-size", `-${options.maxsize}`);
+  if (options.newer) args.push("-newer", shellQuote(options.newer));
+  const command = `find ${args.join(" ")} 2>/dev/null`;
+  const result = await exec(client, command, timeoutMs);
+  return result.stdout.split("\n").filter(Boolean);
 }
-async function writeFile(client, remotePath, content) {
-  const sftp = await getSftp(client);
-  try {
-    await new Promise((resolve, reject) => {
-      sftp.writeFile(remotePath, content, (err) => {
-        if (err) return reject(err);
-        resolve();
-      });
-    });
-  } finally {
-    sftp.end();
+async function tail(client, path, lines = 100, grep, timeoutMs = 3e4) {
+  let command = `tail -n ${lines} ${shellQuote(path)}`;
+  if (grep) {
+    command += ` | grep -i ${shellQuote(grep)}`;
   }
-}
-async function uploadFile(client, localPath, remotePath) {
-  const sftp = await getSftp(client);
-  try {
-    await new Promise((resolve, reject) => {
-      sftp.fastPut(localPath, remotePath, (err) => {
-        if (err) return reject(err);
-        resolve();
-      });
-    });
-  } finally {
-    sftp.end();
+  const result = await exec(client, command, timeoutMs);
+  if (result.code !== 0 && result.stderr && !grep) {
+    throw new Error(result.stderr.trim());
   }
+  return result.stdout;
 }
-async function downloadFile(client, remotePath, localPath) {
-  const sftp = await getSftp(client);
-  try {
-    await new Promise((resolve, reject) => {
-      sftp.fastGet(remotePath, localPath, (err) => {
-        if (err) return reject(err);
-        resolve();
-      });
-    });
-  } finally {
-    sftp.end();
-  }
-}
-async function listDir(client, remotePath) {
-  const sftp = await getSftp(client);
-  try {
-    return await new Promise((resolve, reject) => {
-      sftp.readdir(remotePath, (err, list) => {
-        if (err) return reject(err);
-        resolve(list.map((item) => item.filename));
-      });
-    });
-  } finally {
-    sftp.end();
-  }
+async function serviceStatus(client, serviceName, timeoutMs = 3e4) {
+  const result = await exec(client, `systemctl status ${shellQuote(serviceName)} 2>&1`, timeoutMs);
+  const raw = result.stdout;
+  const activeMatch = raw.match(/Active:\s+(\S+)\s+\(([^)]+)\)/);
+  const descMatch = raw.match(/^\s+.*?-\s+(.+)$/m);
+  const pidMatch = raw.match(/Main PID:\s+(\d+)/);
+  const sinceMatch = raw.match(/since\s+(.+?);/);
+  return {
+    name: serviceName,
+    active: activeMatch?.[1] === "active",
+    status: activeMatch ? `${activeMatch[1]} (${activeMatch[2]})` : result.code === 0 ? "active" : "unknown",
+    description: descMatch?.[1]?.trim(),
+    since: sinceMatch?.[1]?.trim(),
+    pid: pidMatch ? Number.parseInt(pidMatch[1], 10) : void 0,
+    raw
+  };
 }
 
 // src/tools.ts
@@ -717,7 +979,8 @@ var connectionParams = {
   privateKeyPath: KeyPathSchema,
   password: PasswordSchema
 };
-function registerTools(server) {
+function registerTools(server, pool) {
+  const connectionPool = pool ?? new ConnectionPool();
   server.tool(
     "ssh_exec",
     "Execute a command on a remote host via SSH. Returns stdout, stderr, and exit code.",
@@ -727,8 +990,7 @@ function registerTools(server) {
       timeout: TimeoutSchema
     },
     async ({ host, port, username, privateKeyPath, password, command, timeout }) => {
-      const client = await connect({ host, port, username, privateKeyPath, password });
-      try {
+      return connectionPool.withConnection({ host, port, username, privateKeyPath, password }, async (client) => {
         const result = await exec(client, command, timeout || 3e4);
         const parts = [];
         if (result.stdout) parts.push(result.stdout);
@@ -736,9 +998,7 @@ function registerTools(server) {
 ${result.stderr}`);
         parts.push(`[exit code: ${result.code}]`);
         return { content: [{ type: "text", text: parts.join("\n") }] };
-      } finally {
-        client.end();
-      }
+      });
     }
   );
   server.tool(
@@ -749,13 +1009,10 @@ ${result.stderr}`);
       path: z.string().describe("Absolute path to the remote file")
     },
     async ({ host, port, username, privateKeyPath, password, path }) => {
-      const client = await connect({ host, port, username, privateKeyPath, password });
-      try {
+      return connectionPool.withConnection({ host, port, username, privateKeyPath, password }, async (client) => {
         const content = await readFile(client, path);
         return { content: [{ type: "text", text: content }] };
-      } finally {
-        client.end();
-      }
+      });
     }
   );
   server.tool(
@@ -767,13 +1024,10 @@ ${result.stderr}`);
       content: z.string().describe("File content to write")
     },
     async ({ host, port, username, privateKeyPath, password, path, content }) => {
-      const client = await connect({ host, port, username, privateKeyPath, password });
-      try {
+      return connectionPool.withConnection({ host, port, username, privateKeyPath, password }, async (client) => {
         await writeFile(client, path, content);
         return { content: [{ type: "text", text: `Wrote ${content.length} bytes to ${path}` }] };
-      } finally {
-        client.end();
-      }
+      });
     }
   );
   server.tool(
@@ -785,13 +1039,10 @@ ${result.stderr}`);
       remotePath: z.string().describe("Absolute path on the remote host")
     },
     async ({ host, port, username, privateKeyPath, password, localPath, remotePath }) => {
-      const client = await connect({ host, port, username, privateKeyPath, password });
-      try {
+      return connectionPool.withConnection({ host, port, username, privateKeyPath, password }, async (client) => {
         await uploadFile(client, localPath, remotePath);
         return { content: [{ type: "text", text: `Uploaded ${localPath} \u2192 ${remotePath}` }] };
-      } finally {
-        client.end();
-      }
+      });
     }
   );
   server.tool(
@@ -803,13 +1054,10 @@ ${result.stderr}`);
       localPath: z.string().describe("Local path to save the downloaded file")
     },
     async ({ host, port, username, privateKeyPath, password, remotePath, localPath }) => {
-      const client = await connect({ host, port, username, privateKeyPath, password });
-      try {
+      return connectionPool.withConnection({ host, port, username, privateKeyPath, password }, async (client) => {
         await downloadFile(client, remotePath, localPath);
         return { content: [{ type: "text", text: `Downloaded ${remotePath} \u2192 ${localPath}` }] };
-      } finally {
-        client.end();
-      }
+      });
     }
   );
   server.tool(
@@ -820,13 +1068,10 @@ ${result.stderr}`);
       path: z.string().describe("Absolute path to the remote directory")
     },
     async ({ host, port, username, privateKeyPath, password, path }) => {
-      const client = await connect({ host, port, username, privateKeyPath, password });
-      try {
+      return connectionPool.withConnection({ host, port, username, privateKeyPath, password }, async (client) => {
         const files = await listDir(client, path);
         return { content: [{ type: "text", text: files.join("\n") }] };
-      } finally {
-        client.end();
-      }
+      });
     }
   );
   server.tool(
@@ -985,22 +1230,146 @@ ${result.stderr}`);
       return { content: [{ type: "text", text: lines.join("\n") }], isError: result.status === "error" };
     }
   );
+  server.tool(
+    "ssh_multi_exec",
+    "Execute a command on multiple remote hosts in parallel. Returns results per host. Use this instead of calling ssh_exec multiple times \u2014 it's faster and shows results side by side.",
+    {
+      hosts: z.array(z.string()).describe("List of SSH hostnames or IPs"),
+      command: z.string().describe("Shell command to execute on all hosts"),
+      username: UsernameSchema,
+      privateKeyPath: KeyPathSchema,
+      password: PasswordSchema,
+      timeout: TimeoutSchema
+    },
+    async ({ hosts, command, username, privateKeyPath, password, timeout }) => {
+      const hostConfigs = hosts.map((host) => ({ host, username, privateKeyPath, password }));
+      const results = await multiExec(connectionPool, hostConfigs, command, timeout || 3e4);
+      const lines = [];
+      for (const r of results) {
+        lines.push(`--- ${r.host} ---`);
+        if (r.error) {
+          lines.push(`[ERROR] ${r.error}`);
+        } else {
+          if (r.stdout) lines.push(r.stdout);
+          if (r.stderr) lines.push(`[stderr] ${r.stderr}`);
+          lines.push(`[exit code: ${r.code}]`);
+        }
+        lines.push("");
+      }
+      const hasErrors = results.some((r) => r.error || r.code !== 0);
+      return { content: [{ type: "text", text: lines.join("\n") }], isError: hasErrors };
+    }
+  );
+  server.tool(
+    "ssh_find",
+    "Search for files on a remote host. Wraps the find command with structured parameters so you don't have to construct find syntax manually.",
+    {
+      ...connectionParams,
+      path: z.string().describe("Directory to search in (e.g. /var/log, /home/user)"),
+      name: z.string().optional().describe("Filename pattern with wildcards (e.g. '*.log', 'config.*')"),
+      type: z.enum(["f", "d", "l"]).optional().describe("File type: f=file, d=directory, l=symlink"),
+      maxdepth: z.number().optional().describe("Maximum directory depth to search"),
+      minsize: z.string().optional().describe("Minimum file size (e.g. '1M', '100k')"),
+      maxsize: z.string().optional().describe("Maximum file size (e.g. '10M', '500k')"),
+      timeout: TimeoutSchema
+    },
+    async ({
+      host,
+      port,
+      username,
+      privateKeyPath,
+      password,
+      path,
+      name,
+      type,
+      maxdepth,
+      minsize,
+      maxsize,
+      timeout
+    }) => {
+      return connectionPool.withConnection({ host, port, username, privateKeyPath, password }, async (client) => {
+        const files = await find(client, { path, name, type, maxdepth, minsize, maxsize }, timeout || 3e4);
+        if (files.length === 0) {
+          return { content: [{ type: "text", text: "No files found." }] };
+        }
+        return { content: [{ type: "text", text: `Found ${files.length} result(s):
+${files.join("\n")}` }] };
+      });
+    }
+  );
+  server.tool(
+    "ssh_tail",
+    "Read the last N lines of a file on a remote host, optionally filtering by a grep pattern. Use this for reading log files instead of ssh_exec with manual tail/grep commands.",
+    {
+      ...connectionParams,
+      path: z.string().describe("Absolute path to the file to tail"),
+      lines: z.number().optional().describe("Number of lines to read from the end (default: 100)"),
+      grep: z.string().optional().describe("Case-insensitive pattern to filter lines"),
+      timeout: TimeoutSchema
+    },
+    async ({ host, port, username, privateKeyPath, password, path, lines, grep, timeout }) => {
+      return connectionPool.withConnection({ host, port, username, privateKeyPath, password }, async (client) => {
+        const output = await tail(client, path, lines || 100, grep, timeout || 3e4);
+        if (!output.trim()) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: grep ? `No lines matching "${grep}" in last ${lines || 100} lines.` : "File is empty or does not exist."
+              }
+            ]
+          };
+        }
+        return { content: [{ type: "text", text: output }] };
+      });
+    }
+  );
+  server.tool(
+    "ssh_service_status",
+    "Check the status of a systemd service on a remote host. Returns whether it's active, its PID, uptime, and description. Use this instead of ssh_exec with systemctl.",
+    {
+      ...connectionParams,
+      service: z.string().describe("Systemd service name (e.g. nginx, sshd, docker)"),
+      timeout: TimeoutSchema
+    },
+    async ({ host, port, username, privateKeyPath, password, service, timeout }) => {
+      return connectionPool.withConnection({ host, port, username, privateKeyPath, password }, async (client) => {
+        const status = await serviceStatus(client, service, timeout || 3e4);
+        const lines = [];
+        lines.push(`Service: ${status.name}`);
+        lines.push(`Status: ${status.status}`);
+        if (status.description) lines.push(`Description: ${status.description}`);
+        if (status.pid) lines.push(`PID: ${status.pid}`);
+        if (status.since) lines.push(`Since: ${status.since}`);
+        lines.push("");
+        lines.push(status.raw);
+        return { content: [{ type: "text", text: lines.join("\n") }], isError: !status.active };
+      });
+    }
+  );
 }
 
 // src/server.ts
-function createServer() {
+function createServer(pool) {
   const server = new McpServer({
     name: "ssh-mcp",
-    version: "0.3.0"
+    version: "0.5.0"
   });
-  registerTools(server);
+  registerTools(server, pool);
   return server;
 }
 
 // src/index.ts
 async function main() {
-  const server = createServer();
+  const pool = new ConnectionPool();
+  const server = createServer(pool);
   const transport = new StdioServerTransport();
+  const shutdown = () => {
+    pool.drain();
+    process.exit(0);
+  };
+  process.on("SIGINT", shutdown);
+  process.on("SIGTERM", shutdown);
   await server.connect(transport);
 }
 main().catch((err) => {