ssh-mcp-pro 1.0.0

package/dist/http-rate-limit.js

@@ -0,0 +1,41 @@
+const rateLimitHeaderNames = {
+    limit: "X-RateLimit-Limit",
+    remaining: "X-RateLimit-Remaining",
+    reset: "X-RateLimit-Reset",
+};
+export function buildRateLimitHeaders(rateLimiter, rateLimit, key = "global", now = Date.now()) {
+    if (!rateLimit.enabled) {
+        return {};
+    }
+    const usage = rateLimiter.getUsage(key, {
+        maxRequests: rateLimit.maxRequests,
+        windowMs: rateLimit.windowMs,
+    });
+    const resetIn = Math.max(0, usage?.resetIn ?? rateLimit.windowMs);
+    return {
+        [rateLimitHeaderNames.limit]: String(rateLimit.maxRequests),
+        [rateLimitHeaderNames.remaining]: String(usage?.remaining ?? rateLimit.maxRequests),
+        [rateLimitHeaderNames.reset]: String(Math.ceil((now + resetIn) / 1000)),
+    };
+}
+export function attachRateLimitHeaders(res, buildHeaders) {
+    const originalWriteHead = res.writeHead;
+    const originalEnd = res.end;
+    const applyHeaders = () => {
+        if (res.headersSent) {
+            return;
+        }
+        for (const [name, value] of Object.entries(buildHeaders())) {
+            res.setHeader(name, value);
+        }
+    };
+    res.writeHead = function writeHeadWithRateLimitHeaders(...args) {
+        applyHeaders();
+        return Reflect.apply(originalWriteHead, this, args);
+    };
+    res.end = function endWithRateLimitHeaders(...args) {
+        applyHeaders();
+        return Reflect.apply(originalEnd, this, args);
+    };
+}
+//# sourceMappingURL=http-rate-limit.js.map

package/dist/http-rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-rate-limit.js","sourceRoot":"","sources":["../src/http-rate-limit.ts"],"names":[],"mappings":"AAIA,MAAM,oBAAoB,GAAG;IAC3B,KAAK,EAAE,mBAAmB;IAC1B,SAAS,EAAE,uBAAuB;IAClC,KAAK,EAAE,mBAAmB;CAClB,CAAC;AAQX,MAAM,UAAU,qBAAqB,CACnC,WAAiC,EACjC,SAAkC,EAClC,GAAG,GAAG,QAAQ,EACd,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,EAAE;QACtC,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,QAAQ,EAAE,SAAS,CAAC,QAAQ;KAC7B,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC;IAElE,OAAO;QACL,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC;QAC3D,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,IAAI,SAAS,CAAC,WAAW,CAAC;QACnF,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;KACxE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,GAAmB,EACnB,YAA0C;IAE1C,MAAM,iBAAiB,GAAG,GAAG,CAAC,SAAS,CAAC;IACxC,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC;IAE5B,MAAM,YAAY,GAAG,GAAG,EAAE;QACxB,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC,CAAC;IAEF,GAAG,CAAC,SAAS,GAAG,SAAS,6BAA6B,CAAuB,GAAG,IAAe;QAC7F,YAAY,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACtD,CAAgC,CAAC;IAEjC,GAAG,CAAC,GAAG,GAAG,SAAS,uBAAuB,CAAuB,GAAG,IAAe;QACjF,YAAY,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,CAA0B,CAAC;AAC7B,CAAC"}

package/dist/http-security.d.ts

@@ -0,0 +1,22 @@
+import { type ToolProfile } from "./connector-profile.js";
+import type { HostKeyPolicy } from "./types.js";
+export interface HttpStartupConfig {
+    host: string;
+    allowedOrigins: string[];
+    bearerTokenFile?: string;
+    publicUrl?: string;
+}
+export interface HttpStartupSecurityContext {
+    toolProfile: ToolProfile;
+    allowedHosts: string[];
+    hostKeyPolicy?: HostKeyPolicy;
+    authMode?: "bearer" | "oauth";
+    oauthConfigured?: boolean;
+}
+export declare function isLoopbackHost(host: string): boolean;
+export declare function validateHttpStartupConfig(httpConfig: HttpStartupConfig, bearerToken: string | undefined, context?: HttpStartupSecurityContext): void;
+export declare function isOriginAllowed(origin: string | undefined, allowedOrigins: string[]): boolean;
+export declare function corsHeaders(origin: string | undefined, allowedOrigins: string[]): Record<string, string>;
+export declare function oauthProtectedResourceMetadataUrl(publicMcpUrl: string): string;
+export declare function oauthWwwAuthenticateHeader(resourceMetadataUrl: string, scopes: readonly string[], includeErrorDetails?: boolean): string;
+//# sourceMappingURL=http-security.d.ts.map

package/dist/http-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-security.d.ts","sourceRoot":"","sources":["../src/http-security.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2B,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,WAAW,CAAC;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC9B,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CASpD;AAED,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,iBAAiB,EAC7B,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,OAAO,GAAE,0BAMR,GACA,IAAI,CAuDN;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAE7F;AAED,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,cAAc,EAAE,MAAM,EAAE,GACvB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYxB;AAED,wBAAgB,iCAAiC,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAQ9E;AAED,wBAAgB,0BAA0B,CACxC,mBAAmB,EAAE,MAAM,EAC3B,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,mBAAmB,UAAQ,GAC1B,MAAM,CAUR"}

package/dist/http-security.js

@@ -0,0 +1,88 @@
+import { isRemoteSafeToolProfile } from "./connector-profile.js";
+export function isLoopbackHost(host) {
+    const normalized = host.toLowerCase().replace(/^\[/u, "").replace(/\]$/u, "");
+    return (normalized === "localhost" ||
+        normalized.endsWith(".localhost") ||
+        normalized === "::1" ||
+        normalized === "0:0:0:0:0:0:0:1" ||
+        /^127(?:\.\d{1,3}){3}$/u.test(normalized));
+}
+export function validateHttpStartupConfig(httpConfig, bearerToken, context = {
+    toolProfile: "full",
+    allowedHosts: [],
+    hostKeyPolicy: "strict",
+    authMode: "bearer",
+    oauthConfigured: false,
+}) {
+    if (httpConfig.bearerTokenFile && bearerToken?.length === 0) {
+        throw new Error("Refusing HTTP MCP startup with an empty bearer token file");
+    }
+    if (isLoopbackHost(httpConfig.host)) {
+        return;
+    }
+    const hasBearerAuth = Boolean(bearerToken);
+    const hasOAuthAuth = context.authMode === "oauth" && context.oauthConfigured === true;
+    if ((!hasBearerAuth && !hasOAuthAuth) || httpConfig.allowedOrigins.length === 0) {
+        throw new Error("Refusing non-loopback HTTP MCP binding without SSH_MCP_HTTP_BEARER_TOKEN_FILE or OAuth config, and SSH_MCP_HTTP_ALLOWED_ORIGINS");
+    }
+    if (!httpConfig.publicUrl) {
+        throw new Error("Refusing non-loopback HTTP MCP binding without SSH_MCP_HTTP_PUBLIC_URL for stable protected resource metadata");
+    }
+    try {
+        const publicUrl = new URL(httpConfig.publicUrl);
+        if (publicUrl.protocol !== "https:") {
+            throw new Error("public URL must use HTTPS");
+        }
+        if (isLoopbackHost(publicUrl.hostname)) {
+            throw new Error("public URL must not use a loopback host");
+        }
+    }
+    catch (error) {
+        throw new Error(`Refusing non-loopback HTTP MCP binding with invalid SSH_MCP_HTTP_PUBLIC_URL: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!isRemoteSafeToolProfile(context.toolProfile)) {
+        throw new Error("Refusing non-loopback HTTP MCP binding with full tool profile. Set SSH_MCP_TOOL_PROFILE=remote-safe, chatgpt, claude, remote-readonly, or remote-broker.");
+    }
+    if (context.allowedHosts.length === 0) {
+        throw new Error("Refusing non-loopback HTTP MCP binding without SSH_MCP_ALLOWED_HOSTS for remote connector profile");
+    }
+    if ((context.hostKeyPolicy ?? "strict") !== "strict") {
+        throw new Error("Refusing non-loopback HTTP MCP binding without strict SSH host-key verification");
+    }
+}
+export function isOriginAllowed(origin, allowedOrigins) {
+    return !origin || allowedOrigins.length === 0 || allowedOrigins.includes(origin);
+}
+export function corsHeaders(origin, allowedOrigins) {
+    if (!origin || !isOriginAllowed(origin, allowedOrigins)) {
+        return {};
+    }
+    return {
+        "Access-Control-Allow-Origin": origin,
+        "Access-Control-Allow-Headers": "authorization, content-type, mcp-session-id",
+        "Access-Control-Allow-Methods": "GET, POST, DELETE, OPTIONS",
+        "Access-Control-Expose-Headers": "mcp-session-id, WWW-Authenticate",
+        Vary: "Origin",
+    };
+}
+export function oauthProtectedResourceMetadataUrl(publicMcpUrl) {
+    const url = new URL(publicMcpUrl);
+    url.username = "";
+    url.password = "";
+    url.pathname = "/.well-known/oauth-protected-resource";
+    url.search = "";
+    url.hash = "";
+    return url.toString();
+}
+export function oauthWwwAuthenticateHeader(resourceMetadataUrl, scopes, includeErrorDetails = false) {
+    const parts = [`resource_metadata="${resourceMetadataUrl}"`];
+    if (scopes.length > 0) {
+        parts.push(`scope="${scopes.join(" ")}"`);
+    }
+    if (includeErrorDetails) {
+        parts.push('error="invalid_token"');
+        parts.push('error_description="A valid OAuth access token is required"');
+    }
+    return `Bearer ${parts.join(", ")}`;
+}
+//# sourceMappingURL=http-security.js.map

package/dist/http-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-security.js","sourceRoot":"","sources":["../src/http-security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAoB,MAAM,wBAAwB,CAAC;AAkBnF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9E,OAAO,CACL,UAAU,KAAK,WAAW;QAC1B,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;QACjC,UAAU,KAAK,KAAK;QACpB,UAAU,KAAK,iBAAiB;QAChC,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,UAA6B,EAC7B,WAA+B,EAC/B,UAAsC;IACpC,WAAW,EAAE,MAAM;IACnB,YAAY,EAAE,EAAE;IAChB,aAAa,EAAE,QAAQ;IACvB,QAAQ,EAAE,QAAQ;IAClB,eAAe,EAAE,KAAK;CACvB;IAED,IAAI,UAAU,CAAC,eAAe,IAAI,WAAW,EAAE,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IAED,IAAI,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,eAAe,KAAK,IAAI,CAAC;IACtF,IAAI,CAAC,CAAC,aAAa,IAAI,CAAC,YAAY,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CACb,iIAAiI,CAClI,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,+GAA+G,CAChH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,cAAc,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,gFACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,0JAA0J,CAC3J,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,mGAAmG,CACpG,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAA0B,EAAE,cAAwB;IAClF,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,MAA0B,EAC1B,cAAwB;IAExB,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO;QACL,6BAA6B,EAAE,MAAM;QACrC,8BAA8B,EAAE,6CAA6C;QAC7E,8BAA8B,EAAE,4BAA4B;QAC5D,+BAA+B,EAAE,kCAAkC;QACnE,IAAI,EAAE,QAAQ;KACf,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,YAAoB;IACpE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IAClC,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;IAClB,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;IAClB,GAAG,CAAC,QAAQ,GAAG,uCAAuC,CAAC;IACvD,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACd,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,mBAA2B,EAC3B,MAAyB,EACzB,mBAAmB,GAAG,KAAK;IAE3B,MAAM,KAAK,GAAG,CAAC,sBAAsB,mBAAmB,GAAG,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,mBAAmB,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,UAAU,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACtC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+/**
+ * SSH MCP Server - Entry Point
+ *
+ * A Model Context Protocol (MCP) server that provides SSH automation tools
+ * for MCP-capable clients. Supports secure session management, remote command
+ * execution, file operations, transfers, tunnels, and system administration.
+ */
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;;;;GAMG"}

package/dist/index.js

@@ -0,0 +1,201 @@
+#!/usr/bin/env node
+/**
+ * SSH MCP Server - Entry Point
+ *
+ * A Model Context Protocol (MCP) server that provides SSH automation tools
+ * for MCP-capable clients. Supports secure session management, remote command
+ * execution, file operations, transfers, tunnels, and system administration.
+ */
+import { readFileSync } from "fs";
+import path from "path";
+import { fileURLToPath } from "url";
+import { parseArgs } from "./cli.js";
+import { createContainer } from "./container.js";
+import { SERVER_VERSION, SSHMCPServer } from "./mcp.js";
+import { logger } from "./logging.js";
+import { initTelemetry, shutdownTelemetry } from "./telemetry.js";
+function getPackageInfo() {
+    try {
+        const __filename = fileURLToPath(import.meta.url);
+        const __dirname = path.dirname(__filename);
+        const pkgPath = path.resolve(__dirname, "..", "package.json");
+        const raw = readFileSync(pkgPath, "utf8");
+        return JSON.parse(raw);
+    }
+    catch {
+        return {};
+    }
+}
+function printHelp() {
+    const pkg = getPackageInfo();
+    const name = pkg.name ?? "ssh-mcp-pro";
+    const version = pkg.version ? `v${pkg.version}` : "";
+    const help = [
+        `${name} ${version}`.trim(),
+        "",
+        "Usage:",
+        "  ssh-mcp-pro             Start MCP server over stdio (default)",
+        "  ssh-mcp-pro stdio       Start MCP server over stdio",
+        "  ssh-mcp-pro http        Start Streamable HTTP server",
+        "  ssh-mcp-pro --transport=http Start Streamable HTTP server",
+        "  ssh-mcp-pro-agent enroll --server <url> --token <token> --alias <alias>",
+        "  ssh-mcp-pro-agent run        Run the no-custody outbound agent",
+        "  ssh-mcp-pro-agent status     Show local agent enrollment status",
+        "  ssh-mcp-pro --help      Show this help",
+        "  ssh-mcp-pro --version   Show version",
+        "  ssh-mcp-pro --stdio     Force stdio mode (default)",
+        "  ssh-mcp-pro --transport=http --host 127.0.0.1 --port 3000",
+        "  ssh-mcp-pro --transport=http --bearer-token-file /path/token --enable-legacy-sse",
+        "  ssh-mcp-pro --transport=http --tool-profile remote-safe",
+        "  ssh-mcp-pro --transport=http --connector-credential-provider agent",
+        "",
+        "Examples:",
+        "  Run as MCP stdio server: ssh-mcp-pro",
+        "  Enroll remote agent: npx --yes --package ssh-mcp-pro@latest ssh-mcp-pro-agent enroll --server <url> --token <token> --alias <alias>",
+        "  Run remote agent: npx --yes --package ssh-mcp-pro@latest ssh-mcp-pro-agent run",
+        "  Claude/VS Code config snippet:",
+        '    { "servers": { "ssh-mcp": { "type": "stdio", "command": "ssh-mcp-pro", "args": [] }}}',
+        "  Debug: MCP_STDIO=1 ssh-mcp-pro",
+        "",
+    ].join("\n");
+    process.stdout.write(help);
+}
+function printVersion() {
+    const pkg = getPackageInfo();
+    process.stdout.write(`${pkg.version ?? "0.0.0"}\n`);
+}
+async function main() {
+    const argv = process.argv.slice(2);
+    const opts = parseArgs(argv);
+    if (opts.unsupportedNoStdio) {
+        process.stderr.write("Error: --no-stdio is not supported. This server only runs over stdio.\n");
+        process.exit(2);
+    }
+    if (opts.help) {
+        printHelp();
+        process.exit(0);
+    }
+    if (opts.version) {
+        printVersion();
+        process.exit(0);
+    }
+    if (opts.agentArgs) {
+        const { runAgentCli } = await import("./remote/agent-cli.js");
+        await runAgentCli(opts.agentArgs);
+        return;
+    }
+    if (opts.transport === "http") {
+        if (opts.host) {
+            process.env.SSH_MCP_HTTP_HOST = opts.host;
+        }
+        if (opts.port) {
+            process.env.SSH_MCP_HTTP_PORT = opts.port;
+        }
+        if (opts.bearerTokenFile) {
+            process.env.SSH_MCP_HTTP_BEARER_TOKEN_FILE = opts.bearerTokenFile;
+        }
+        if (opts.enableLegacySse) {
+            process.env.SSH_MCP_ENABLE_LEGACY_SSE = "true";
+        }
+        if (opts.toolProfile) {
+            process.env.SSH_MCP_TOOL_PROFILE = opts.toolProfile;
+        }
+        if (opts.connectorCredentialProvider) {
+            process.env.SSH_MCP_CONNECTOR_CREDENTIAL_PROVIDER = opts.connectorCredentialProvider;
+        }
+        await import("./server-http.js");
+        return;
+    }
+    try {
+        logger.info("Starting SSH MCP Server...");
+        container = createContainer();
+        initTelemetry({
+            serviceVersion: SERVER_VERSION,
+        });
+        const server = new SSHMCPServer(container);
+        await server.run();
+        // Gentle warning if a human types into the terminal
+        let warned = false;
+        process.stdin.on("data", (chunk) => {
+            const trimmed = chunk.toString().trimStart();
+            if (!warned && trimmed && !trimmed.startsWith("{") && !trimmed.startsWith("[")) {
+                process.stderr.write("This is an MCP stdio server. Do not type commands here. Use an MCP client or run --help.\n");
+                warned = true;
+            }
+        });
+        // Check if running in daemon mode (for testing)
+        if (process.env.SSH_MCP_DAEMON === "true") {
+            logger.info("Running in daemon mode - will not wait for stdin");
+            // Keep alive but don't block on stdin
+            setInterval(() => { }, 1000);
+        }
+        else if (process.env.SSH_MCP_ONESHOT === "true") {
+            logger.info("Running in one-shot mode - will exit after processing");
+            // Process stdin once and exit with timeout
+            const timeout = setTimeout(() => {
+                logger.info("One-shot mode timeout, exiting");
+                process.exit(0);
+            }, 2000);
+            process.stdin.once("data", () => {
+                clearTimeout(timeout);
+                setTimeout(() => process.exit(0), 100);
+            });
+            process.stdin.resume();
+        }
+        else {
+            // Keep the process running for MCP stdio communication
+            process.stdin.resume();
+        }
+    }
+    catch (error) {
+        logger.error("Failed to start SSH MCP Server", { error });
+        process.exit(1);
+    }
+}
+// Handle uncaught exceptions
+process.on("uncaughtException", (error) => {
+    logger.error("Uncaught exception", { error });
+    process.exit(1);
+});
+process.on("unhandledRejection", (reason, promise) => {
+    logger.error("Unhandled rejection", { reason, promise });
+    process.exit(1);
+});
+// Handle graceful shutdown
+let shuttingDown = false;
+let container;
+async function gracefulShutdown(signal) {
+    if (shuttingDown) {
+        // Second signal = force exit immediately
+        logger.info("Force exit");
+        process.exit(0);
+    }
+    shuttingDown = true;
+    logger.info(`Received ${signal}, shutting down...`);
+    // Force exit after 2 seconds max
+    const forceExit = setTimeout(() => {
+        logger.info("Shutdown timeout, forcing exit");
+        process.exit(0);
+    }, 2000);
+    try {
+        container?.rateLimiter.destroy();
+        if (container) {
+            await container.sessionManager.destroy();
+        }
+        await shutdownTelemetry();
+    }
+    catch (error) {
+        logger.error("Shutdown error", { error });
+    }
+    clearTimeout(forceExit);
+    process.exit(0);
+}
+process.on("SIGINT", () => {
+    void gracefulShutdown("SIGINT");
+});
+process.on("SIGTERM", () => {
+    void gracefulShutdown("SIGTERM");
+});
+// Run the server
+void main();
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,eAAe,EAAqB,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAElE,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,aAAa,CAAC;IACvC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG;QACX,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,IAAI,EAAE;QAC3B,EAAE;QACF,QAAQ;QACR,iEAAiE;QACjE,uDAAuD;QACvD,wDAAwD;QACxD,6DAA6D;QAC7D,2EAA2E;QAC3E,kEAAkE;QAClE,mEAAmE;QACnE,0CAA0C;QAC1C,wCAAwC;QACxC,sDAAsD;QACtD,6DAA6D;QAC7D,oFAAoF;QACpF,2DAA2D;QAC3D,sEAAsE;QACtE,EAAE;QACF,WAAW;QACX,wCAAwC;QACxC,uIAAuI;QACvI,kFAAkF;QAClF,kCAAkC;QAClC,2FAA2F;QAC3F,kCAAkC;QAClC,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAE7B,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAC;QAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,SAAS,EAAE,CAAC;QACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,YAAY,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAC9D,MAAM,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClC,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC;QAC5C,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC;QAC5C,CAAC;QACD,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,8BAA8B,GAAG,IAAI,CAAC,eAAe,CAAC;QACpE,CAAC;QACD,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,MAAM,CAAC;QACjD,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,IAAI,CAAC,WAAW,CAAC;QACtD,CAAC;QACD,IAAI,IAAI,CAAC,2BAA2B,EAAE,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,qCAAqC,GAAG,IAAI,CAAC,2BAA2B,CAAC;QACvF,CAAC;QACD,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAE1C,SAAS,GAAG,eAAe,EAAE,CAAC;QAC9B,aAAa,CAAC;YACZ,cAAc,EAAE,cAAc;SAC/B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC;QAEnB,oDAAoD;QACpD,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,CAAC;YAC7C,IAAI,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/E,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4FAA4F,CAC7F,CAAC;gBACF,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,gDAAgD;QAChD,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;YAChE,sCAAsC;YACtC,WAAW,CAAC,GAAG,EAAE,GAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;aAAM,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,MAAM,EAAE,CAAC;YAClD,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;YACrE,2CAA2C;YAC3C,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC9B,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;gBAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,EAAE,IAAI,CAAC,CAAC;YAET,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;gBAC9B,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACzC,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,uDAAuD;YACvD,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,6BAA6B;AAC7B,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE;IACxC,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IACnD,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,2BAA2B;AAC3B,IAAI,YAAY,GAAG,KAAK,CAAC;AACzB,IAAI,SAAmC,CAAC;AAExC,KAAK,UAAU,gBAAgB,CAAC,MAAc;IAC5C,IAAI,YAAY,EAAE,CAAC;QACjB,yCAAyC;QACzC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,YAAY,GAAG,IAAI,CAAC;IACpB,MAAM,CAAC,IAAI,CAAC,YAAY,MAAM,oBAAoB,CAAC,CAAC;IAEpD,iCAAiC;IACjC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;QAChC,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,EAAE,IAAI,CAAC,CAAC;IAET,IAAI,CAAC;QACH,SAAS,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,SAAS,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;QAC3C,CAAC;QACD,MAAM,iBAAiB,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,YAAY,CAAC,SAAS,CAAC,CAAC;IACxB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;IACxB,KAAK,gBAAgB,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC;AACH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;IACzB,KAAK,gBAAgB,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AAEH,iBAAiB;AACjB,KAAK,IAAI,EAAE,CAAC"}

package/dist/logging.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Logging utilities with sensitive data redaction
+ */
+/**
+ * Redacts sensitive information from an object
+ */
+export declare function redactSensitiveData(obj: unknown): unknown;
+/**
+ * Redacts sensitive information from error messages and stack traces
+ */
+export declare function redactErrorMessage(message: string): string;
+/**
+ * Logger levels
+ */
+export declare enum LogLevel {
+    SILENT = -1,
+    ERROR = 0,
+    WARN = 1,
+    INFO = 2,
+    DEBUG = 3
+}
+export type LogFormat = "plain" | "json";
+/**
+ * Simple logger with redaction
+ */
+export declare class Logger {
+    private readonly level;
+    private readonly format;
+    constructor(level?: LogLevel, format?: LogFormat);
+    private writePlain;
+    private writeJson;
+    private log;
+    error(message: string, data?: unknown): void;
+    warn(message: string, data?: unknown): void;
+    info(message: string, data?: unknown): void;
+    debug(message: string, data?: unknown): void;
+}
+export declare const logger: Logger;
+/**
+ * Performance measurement utilities
+ */
+export declare class Timer {
+    private startTime;
+    constructor();
+    elapsed(): number;
+    reset(): void;
+}
+/**
+ * Creates a timer for measuring operation duration
+ */
+export declare function createTimer(): Timer;
+//# sourceMappingURL=logging.d.ts.map

package/dist/logging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.d.ts","sourceRoot":"","sources":["../src/logging.ts"],"names":[],"mappings":"AAAA;;GAEG;AA0BH;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CA0BzD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAqB1D;AAED;;GAEG;AACH,oBAAY,QAAQ;IAClB,MAAM,KAAK;IACX,KAAK,IAAI;IACT,IAAI,IAAI;IACR,IAAI,IAAI;IACR,KAAK,IAAI;CACV;AAED,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,MAAM,CAAC;AAEzC;;GAEG;AACH,qBAAa,MAAM;IAEf,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,KAAK,GAAE,QAAwB,EAC/B,MAAM,GAAE,SAAmB;IAG9C,OAAO,CAAC,UAAU;IAUlB,OAAO,CAAC,SAAS;IAWjB,OAAO,CAAC,GAAG;IAiBX,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI;IAK5C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI;IAI3C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI;IAI3C,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI;CAG7C;AAuBD,eAAO,MAAM,MAAM,QAAkC,CAAC;AAEtD;;GAEG;AACH,qBAAa,KAAK;IAChB,OAAO,CAAC,SAAS,CAAS;;IAM1B,OAAO,IAAI,MAAM;IAIjB,KAAK,IAAI,IAAI;CAGd;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,KAAK,CAEnC"}

package/dist/logging.js

@@ -0,0 +1,180 @@
+/**
+ * Logging utilities with sensitive data redaction
+ */
+const SENSITIVE_PATTERNS = [
+    /password/i,
+    /privatekey/i,
+    /passphrase/i,
+    /sudopassword/i,
+    /secret/i,
+    /token/i,
+    /credential/i,
+    /auth/i,
+    /api.?key/i,
+    /bearer/i,
+    /private.?key/i,
+    /pem/i,
+];
+const REDACTED = "****";
+function isRecord(value) {
+    return typeof value === "object" && !!value;
+}
+function shouldPreserveSensitiveValue(value) {
+    return value === null || value === undefined || value === "" || typeof value === "boolean";
+}
+/**
+ * Redacts sensitive information from an object
+ */
+export function redactSensitiveData(obj) {
+    if (obj === null || obj === undefined) {
+        return obj;
+    }
+    if (typeof obj === "string") {
+        return obj;
+    }
+    if (Array.isArray(obj)) {
+        return obj.map(redactSensitiveData);
+    }
+    if (isRecord(obj)) {
+        const redacted = {};
+        for (const [key, value] of Object.entries(obj)) {
+            if (SENSITIVE_PATTERNS.some((pattern) => pattern.test(key))) {
+                redacted[key] = shouldPreserveSensitiveValue(value) ? value : REDACTED;
+            }
+            else {
+                redacted[key] = redactSensitiveData(value);
+            }
+        }
+        return redacted;
+    }
+    return obj;
+}
+/**
+ * Redacts sensitive information from error messages and stack traces
+ */
+export function redactErrorMessage(message) {
+    // Common patterns that might contain sensitive data
+    const patterns = [
+        /password[=:\s]+[^\s]+/gi,
+        /key[=:\s]+[^\s]+/gi,
+        /passphrase[=:\s]+[^\s]+/gi,
+        /auth[=:\s]+[^\s]+/gi,
+        /token[=:\s]+[^\s]+/gi,
+        /api.?key[=:\s]+[^\s]+/gi,
+        /bearer\s+[^\s]+/gi,
+        /private.?key[=:\s]+[^\s]+/gi,
+        /pem[=:\s]+[^\s]+/gi,
+        /-----BEGIN[^-]+-----[\s\S]*?-----END[^-]+-----/gi,
+    ];
+    let redacted = message;
+    for (const pattern of patterns) {
+        redacted = redacted.replace(pattern, REDACTED);
+    }
+    return redacted;
+}
+/**
+ * Logger levels
+ */
+export var LogLevel;
+(function (LogLevel) {
+    LogLevel[LogLevel["SILENT"] = -1] = "SILENT";
+    LogLevel[LogLevel["ERROR"] = 0] = "ERROR";
+    LogLevel[LogLevel["WARN"] = 1] = "WARN";
+    LogLevel[LogLevel["INFO"] = 2] = "INFO";
+    LogLevel[LogLevel["DEBUG"] = 3] = "DEBUG";
+})(LogLevel || (LogLevel = {}));
+/**
+ * Simple logger with redaction
+ */
+export class Logger {
+    level;
+    format;
+    constructor(level = LogLevel.INFO, format = "plain") {
+        this.level = level;
+        this.format = format;
+    }
+    writePlain(timestamp, levelName, message, data) {
+        let output = `[${timestamp}] ${levelName}: ${message}`;
+        if (data !== undefined) {
+            output += ` ${JSON.stringify(data)}`;
+        }
+        process.stderr.write(`${output}\n`);
+    }
+    writeJson(timestamp, levelName, message, data) {
+        const output = {
+            timestamp,
+            level: levelName.toLowerCase(),
+            message,
+            ...(data !== undefined ? { data } : {}),
+        };
+        process.stderr.write(`${JSON.stringify(output)}\n`);
+    }
+    log(level, message, data) {
+        if (level > this.level) {
+            return;
+        }
+        const timestamp = new Date().toISOString();
+        const levelName = LogLevel[level];
+        const redactedData = data !== undefined ? redactSensitiveData(data) : undefined;
+        if (this.format === "json") {
+            this.writeJson(timestamp, levelName, message, redactedData);
+            return;
+        }
+        this.writePlain(timestamp, levelName, message, redactedData);
+    }
+    error(message, data) {
+        const redactedMessage = redactErrorMessage(message);
+        this.log(LogLevel.ERROR, redactedMessage, data);
+    }
+    warn(message, data) {
+        this.log(LogLevel.WARN, message, data);
+    }
+    info(message, data) {
+        this.log(LogLevel.INFO, message, data);
+    }
+    debug(message, data) {
+        this.log(LogLevel.DEBUG, message, data);
+    }
+}
+// Global logger instance
+const LOG_LEVEL_MAP = {
+    none: LogLevel.SILENT,
+    off: LogLevel.SILENT,
+    silent: LogLevel.SILENT,
+    error: LogLevel.ERROR,
+    warn: LogLevel.WARN,
+    info: LogLevel.INFO,
+    debug: LogLevel.DEBUG,
+};
+const LOG_FORMAT_MAP = {
+    plain: "plain",
+    pretty: "plain",
+    json: "json",
+};
+const envLogLevel = process.env.LOG_LEVEL?.toLowerCase() ?? "info";
+const logLevel = LOG_LEVEL_MAP[envLogLevel] ?? LogLevel.INFO;
+const envLogFormat = process.env.LOG_FORMAT?.toLowerCase() ?? "plain";
+const logFormat = LOG_FORMAT_MAP[envLogFormat] ?? "plain";
+export const logger = new Logger(logLevel, logFormat);
+/**
+ * Performance measurement utilities
+ */
+export class Timer {
+    startTime;
+    constructor() {
+        this.startTime = Date.now();
+    }
+    elapsed() {
+        return Date.now() - this.startTime;
+    }
+    reset() {
+        this.startTime = Date.now();
+    }
+}
+/**
+ * Creates a timer for measuring operation duration
+ */
+export function createTimer() {
+    return new Timer();
+}
+//# sourceMappingURL=logging.js.map

package/dist/logging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.js","sourceRoot":"","sources":["../src/logging.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,kBAAkB,GAAG;IACzB,WAAW;IACX,aAAa;IACb,aAAa;IACb,eAAe;IACf,SAAS;IACT,QAAQ;IACR,aAAa;IACb,OAAO;IACP,WAAW;IACX,SAAS;IACT,eAAe;IACf,MAAM;CACP,CAAC;AACF,MAAM,QAAQ,GAAG,MAAM,CAAC;AAExB,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC;AAC9C,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAc;IAClD,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,IAAI,OAAO,KAAK,KAAK,SAAS,CAAC;AAC7F,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,MAAM,QAAQ,GAA4B,EAAE,CAAC;QAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC5D,QAAQ,CAAC,GAAG,CAAC,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;YACzE,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,oDAAoD;IACpD,MAAM,QAAQ,GAAG;QACf,yBAAyB;QACzB,oBAAoB;QACpB,2BAA2B;QAC3B,qBAAqB;QACrB,sBAAsB;QACtB,yBAAyB;QACzB,mBAAmB;QACnB,6BAA6B;QAC7B,oBAAoB;QACpB,kDAAkD;KACnD,CAAC;IAEF,IAAI,QAAQ,GAAG,OAAO,CAAC;IACvB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,QAMX;AAND,WAAY,QAAQ;IAClB,4CAAW,CAAA;IACX,yCAAS,CAAA;IACT,uCAAQ,CAAA;IACR,uCAAQ,CAAA;IACR,yCAAS,CAAA;AACX,CAAC,EANW,QAAQ,KAAR,QAAQ,QAMnB;AAID;;GAEG;AACH,MAAM,OAAO,MAAM;IAEE;IACA;IAFnB,YACmB,QAAkB,QAAQ,CAAC,IAAI,EAC/B,SAAoB,OAAO;QAD3B,UAAK,GAAL,KAAK,CAA0B;QAC/B,WAAM,GAAN,MAAM,CAAqB;IAC3C,CAAC;IAEI,UAAU,CAAC,SAAiB,EAAE,SAAiB,EAAE,OAAe,EAAE,IAAc;QACtF,IAAI,MAAM,GAAG,IAAI,SAAS,KAAK,SAAS,KAAK,OAAO,EAAE,CAAC;QAEvD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC;IACtC,CAAC;IAEO,SAAS,CAAC,SAAiB,EAAE,SAAiB,EAAE,OAAe,EAAE,IAAc;QACrF,MAAM,MAAM,GAAG;YACb,SAAS;YACT,KAAK,EAAE,SAAS,CAAC,WAAW,EAAE;YAC9B,OAAO;YACP,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC;QAEF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;IAEO,GAAG,CAAC,KAAe,EAAE,OAAe,EAAE,IAAc;QAC1D,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,YAAY,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEhF,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,OAAe,EAAE,IAAc;QACnC,MAAM,eAAe,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,CAAC,OAAe,EAAE,IAAc;QAClC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,CAAC,OAAe,EAAE,IAAc;QAClC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,OAAe,EAAE,IAAc;QACnC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;CACF;AAED,yBAAyB;AACzB,MAAM,aAAa,GAA6B;IAC9C,IAAI,EAAE,QAAQ,CAAC,MAAM;IACrB,GAAG,EAAE,QAAQ,CAAC,MAAM;IACpB,MAAM,EAAE,QAAQ,CAAC,MAAM;IACvB,KAAK,EAAE,QAAQ,CAAC,KAAK;IACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;IACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;IACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;CACtB,CAAC;AACF,MAAM,cAAc,GAA8B;IAChD,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,OAAO;IACf,IAAI,EAAE,MAAM;CACb,CAAC;AAEF,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,MAAM,CAAC;AACnE,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC;AAC7D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,OAAO,CAAC;AACtE,MAAM,SAAS,GAAG,cAAc,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC;AAE1D,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAEtD;;GAEG;AACH,MAAM,OAAO,KAAK;IACR,SAAS,CAAS;IAE1B;QACE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC9B,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;IACrC,CAAC;IAED,KAAK;QACH,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC9B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,IAAI,KAAK,EAAE,CAAC;AACrB,CAAC"}

package/dist/mcp.d.ts

@@ -0,0 +1,16 @@
+import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
+import type { AppContainer } from "./container.js";
+export declare const SERVER_VERSION = "1.0.0";
+export declare const SERVER_NAME = "io.github.oaslananka/ssh-mcp-pro";
+export declare class SSHMCPServer {
+    private readonly container;
+    private readonly server;
+    private readonly registry;
+    private readonly toolProfile;
+    constructor(container: AppContainer);
+    private setupHandlers;
+    private setupErrorHandling;
+    run(): Promise<void>;
+    connect(transport: Transport): Promise<void>;
+}
+//# sourceMappingURL=mcp.d.ts.map