@yawlabs/ssh-mcp 0.6.0 → 0.7.0

package/README.md

@@ -98,6 +98,18 @@ All connections respect your `~/.ssh/config`. Host aliases, custom ports, userna
 
 **ProxyJump / bastion hosts** are supported automatically. If your SSH config has `ProxyJump bastion` for a host, ssh-mcp connects through the bastion transparently. Chained proxies work too.
 
+### Host key verification
+
+All remote operations verify the server's host key against `~/.ssh/known_hosts`:
+
+- **Known host, key matches** — accept.
+- **Known host, key changed** — reject (MITM protection).
+- **Unknown host** — accept on first connection (TOFU). Use `ssh_known_hosts_fix` to pin the key for future mismatch detection.
+
+For stricter environments, set `SSH_MCP_STRICT_HOST_KEY=1` to reject unknown hosts. Add them explicitly with `ssh_known_hosts_fix` first.
+
+The diagnostic tools (`ssh_test`, `ssh_diagnose`) use `StrictHostKeyChecking=no` for their probe commands. Those probes only run `echo SSH_OK` — no credentials or data pass through — so the relaxed setting is safe for connectivity testing. Real operations always go through the `hostVerifier`.
+
 ### Windows support
 
 On Windows, ssh-mcp detects the OpenSSH Authentication Agent service automatically (via the `\\.\pipe\openssh-ssh-agent` named pipe). No `SSH_AUTH_SOCK` needed — just make sure the OpenSSH agent service is running.

package/dist/index.js

@@ -290,14 +290,50 @@ function resolveFromSshConfig(host) {
     return null;
   }
 }
+function readKnownHostsKeys(host, port) {
+  if (!isValidHostname(host)) return [];
+  const targets = port && port !== 22 ? [`[${host}]:${port}`, host] : [host];
+  const keys = [];
+  for (const target of targets) {
+    const { stdout, ok } = runArgs("ssh-keygen", ["-F", target]);
+    if (!ok || !stdout.trim()) continue;
+    for (const line of stdout.split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const parts = trimmed.split(/\s+/);
+      if (parts.length < 3) continue;
+      try {
+        keys.push(Buffer.from(parts[2], "base64"));
+      } catch {
+      }
+    }
+  }
+  return keys;
+}
+function buildHostVerifier(hosts, port) {
+  const strict = process.env.SSH_MCP_STRICT_HOST_KEY === "1";
+  return (key) => {
+    const known = hosts.flatMap((h) => readKnownHostsKeys(h, port));
+    if (known.length === 0) {
+      return !strict;
+    }
+    return known.some((k) => k.equals(key));
+  };
+}
 function resolveConfig(config) {
   const sshConfig = resolveFromSshConfig(config.host);
+  const port = config.port || (sshConfig ? Number.parseInt(sshConfig.port, 10) : 22);
+  const verifierHosts = [config.host];
+  if (sshConfig?.hostname && sshConfig.hostname !== config.host) {
+    verifierHosts.push(sshConfig.hostname);
+  }
   const connectConfig = {
     host: sshConfig?.hostname || config.host,
-    port: config.port || (sshConfig ? Number.parseInt(sshConfig.port, 10) : 22),
+    port,
     username: config.username || sshConfig?.user || process.env.USER || process.env.USERNAME || "root",
     keepaliveInterval: 15e3,
-    keepaliveCountMax: 3
+    keepaliveCountMax: 3,
+    hostVerifier: buildHostVerifier(verifierHosts, port)
   };
   const agentSock = config.agent || process.env.SSH_AUTH_SOCK || (process.platform === "win32" ? "\\\\.\\pipe\\openssh-ssh-agent" : void 0);
   if (agentSock) {
@@ -1029,10 +1065,10 @@ function registerTools(server, pool) {
   const connectionPool = pool ?? new ConnectionPool();
   server.tool(
     "ssh_exec",
-    "Execute a command on a remote host via SSH. Returns stdout, stderr, and exit code.",
+    "Execute a command on a remote host via SSH. The command is interpreted by the remote login shell \u2014 pipes, redirects, globs, and other shell metacharacters work as expected. Returns stdout, stderr, and exit code.",
     {
       ...connectionParams,
-      command: z.string().describe("Shell command to execute on the remote host"),
+      command: z.string().describe("Shell command to execute on the remote host (interpreted by the remote login shell)"),
       timeout: TimeoutSchema
     },
     async ({ host, port, username, privateKeyPath, password, command, timeout }) => {
@@ -1400,7 +1436,7 @@ ${files.join("\n")}` }] };
 function createServer(pool) {
   const server = new McpServer({
     name: "ssh-mcp",
-    version: "0.6.0"
+    version: "0.7.0"
   });
   registerTools(server, pool);
   return server;

package/dist/server.d.ts

@@ -18,6 +18,7 @@ interface ResolvedConfig {
     connectConfig: ConnectConfig;
     proxyJump?: string;
 }
+declare function readKnownHostsKeys(host: string, port?: number): Buffer[];
 declare function resolveConfig(config: SSHConfig): ResolvedConfig;
 declare function formatDiagnostics(host: string): string;
 declare function connectRaw(connectConfig: ConnectConfig): Promise<Client>;
@@ -164,4 +165,4 @@ declare function testConnection(host: string, port?: number): {
 
 declare function createServer(pool?: ConnectionPool): McpServer;
 
-export { type AgentResult, type ConfigLookupResult, ConnectionPool, type DiagnosticReport, type DiagnosticResult, type ExecResult, type FindOptions, type KeyInfo, type MultiExecHost, type MultiExecResult, type PoolOptions, type ResolvedConfig, type SSHConfig, type ServiceStatus, checkConnectivity, checkGitSsh, checkKnownHosts, checkSshAgent, checkSshConfig, checkSshKeys, configLookup, connect, connectRaw, connectWithProxy, createServer, diagnose, downloadFile, ensureAgent, exec, find, fixKnownHosts, formatDiagnostics, listDir, listSshKeys, loadKey, multiExec, readFile, registerTools, resolveConfig, serviceStatus, tail, testConnection, uploadFile, writeFile };
+export { type AgentResult, type ConfigLookupResult, ConnectionPool, type DiagnosticReport, type DiagnosticResult, type ExecResult, type FindOptions, type KeyInfo, type MultiExecHost, type MultiExecResult, type PoolOptions, type ResolvedConfig, type SSHConfig, type ServiceStatus, checkConnectivity, checkGitSsh, checkKnownHosts, checkSshAgent, checkSshConfig, checkSshKeys, configLookup, connect, connectRaw, connectWithProxy, createServer, diagnose, downloadFile, ensureAgent, exec, find, fixKnownHosts, formatDiagnostics, listDir, listSshKeys, loadKey, multiExec, readFile, readKnownHostsKeys, registerTools, resolveConfig, serviceStatus, tail, testConnection, uploadFile, writeFile };

package/dist/server.js

@@ -581,14 +581,50 @@ function resolveFromSshConfig(host) {
     return null;
   }
 }
+function readKnownHostsKeys(host, port) {
+  if (!isValidHostname(host)) return [];
+  const targets = port && port !== 22 ? [`[${host}]:${port}`, host] : [host];
+  const keys = [];
+  for (const target of targets) {
+    const { stdout, ok } = runArgs("ssh-keygen", ["-F", target]);
+    if (!ok || !stdout.trim()) continue;
+    for (const line of stdout.split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const parts = trimmed.split(/\s+/);
+      if (parts.length < 3) continue;
+      try {
+        keys.push(Buffer.from(parts[2], "base64"));
+      } catch {
+      }
+    }
+  }
+  return keys;
+}
+function buildHostVerifier(hosts, port) {
+  const strict = process.env.SSH_MCP_STRICT_HOST_KEY === "1";
+  return (key) => {
+    const known = hosts.flatMap((h) => readKnownHostsKeys(h, port));
+    if (known.length === 0) {
+      return !strict;
+    }
+    return known.some((k) => k.equals(key));
+  };
+}
 function resolveConfig(config) {
   const sshConfig = resolveFromSshConfig(config.host);
+  const port = config.port || (sshConfig ? Number.parseInt(sshConfig.port, 10) : 22);
+  const verifierHosts = [config.host];
+  if (sshConfig?.hostname && sshConfig.hostname !== config.host) {
+    verifierHosts.push(sshConfig.hostname);
+  }
   const connectConfig = {
     host: sshConfig?.hostname || config.host,
-    port: config.port || (sshConfig ? Number.parseInt(sshConfig.port, 10) : 22),
+    port,
     username: config.username || sshConfig?.user || process.env.USER || process.env.USERNAME || "root",
     keepaliveInterval: 15e3,
-    keepaliveCountMax: 3
+    keepaliveCountMax: 3,
+    hostVerifier: buildHostVerifier(verifierHosts, port)
   };
   const agentSock = config.agent || process.env.SSH_AUTH_SOCK || (process.platform === "win32" ? "\\\\.\\pipe\\openssh-ssh-agent" : void 0);
   if (agentSock) {
@@ -1040,10 +1076,10 @@ function registerTools(server, pool) {
   const connectionPool = pool ?? new ConnectionPool();
   server.tool(
     "ssh_exec",
-    "Execute a command on a remote host via SSH. Returns stdout, stderr, and exit code.",
+    "Execute a command on a remote host via SSH. The command is interpreted by the remote login shell \u2014 pipes, redirects, globs, and other shell metacharacters work as expected. Returns stdout, stderr, and exit code.",
     {
       ...connectionParams,
-      command: z.string().describe("Shell command to execute on the remote host"),
+      command: z.string().describe("Shell command to execute on the remote host (interpreted by the remote login shell)"),
       timeout: TimeoutSchema
     },
     async ({ host, port, username, privateKeyPath, password, command, timeout }) => {
@@ -1411,7 +1447,7 @@ ${files.join("\n")}` }] };
 function createServer(pool) {
   const server = new McpServer({
     name: "ssh-mcp",
-    version: "0.6.0"
+    version: "0.7.0"
   });
   registerTools(server, pool);
   return server;
@@ -1441,6 +1477,7 @@ export {
   loadKey,
   multiExec,
   readFile,
+  readKnownHostsKeys,
   registerTools,
   resolveConfig,
   serviceStatus,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/ssh-mcp",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "MCP server for SSH operations with built-in diagnostics",
   "type": "module",
   "bin": {