ssh-mcp 1.2.2 → 1.3.0

package/README.md

@@ -45,6 +45,16 @@
   - **Parameters:**
     - `command` (required): Shell command to execute on the remote SSH server
   - **Timeout Configuration:**
+
+- `sudo-exec`: Execute a shell command with sudo elevation
+  - **Parameters:**
+    - `command` (required): Shell command to execute as root using sudo
+  - **Notes:**
+    - Requires `--sudoPassword` to be set for password-protected sudo
+    - Can be disabled by passing the `--disableSudo` flag at startup if sudo access is not needed or not available
+    - For persistent root access, consider using `--suPassword` instead which establishes a root shell
+    - Tool will not be available at all if server is started with `--disableSudo`
+  - **Timeout Configuration:**
     - Timeout is configured via command line argument `--timeout` (in milliseconds)
     - Default timeout: 60000ms (1 minute)
     - When a command times out, the server automatically attempts to abort the running process before closing the connection
@@ -77,8 +87,11 @@ You can configure your IDE or LLM like Cursor, Windsurf, Claude Desktop to use t
 - `port`: SSH port (default: 22)
 - `password`: SSH password (or use `key` for key-based auth)
 - `key`: Path to private SSH key
+- `sudoPassword`: Password for sudo elevation (when executing commands with sudo)
+- `suPassword`: Password for su elevation (when you need a persistent root shell)
 - `timeout`: Command execution timeout in milliseconds (default: 60000ms = 1 minute)
 - `maxChars`: Maximum allowed characters for the `command` input (default: 1000). Use `none` or `0` to disable the limit.
+- `disableSudo`: Flag to disable the `sudo-exec` tool completely. Useful when sudo access is not needed or not available.
 
 
 ```commandline
@@ -130,6 +143,11 @@ claude mcp add --transport stdio ssh-mcp -- npx -y ssh-mcp -- --host=example.com
 claude mcp add --transport stdio ssh-mcp -- npx -y ssh-mcp -- --host=192.168.1.100 --user=admin --password=your_password --timeout=120000 --maxChars=none
 ```
 
+**With Sudo and Su Support:**
+```bash
+claude mcp add --transport stdio ssh-mcp -- npx -y ssh-mcp -- --host=192.168.1.100 --user=admin --password=your_password --sudoPassword=sudo_pass --suPassword=root_pass
+```
+
 **Installation Scopes:**
 
 You can specify the scope when adding the server:

package/build/index.js

@@ -1,27 +1,38 @@
 #!/usr/bin/env node
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
-import { Client as SSHClient } from 'ssh2';
+import { Client } from 'ssh2';
 import { z } from 'zod';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-// Example usage: node build/index.js --host=1.2.3.4 --port=22 --user=root --password=pass --key=path/to/key --timeout=5000
+// Example usage: node build/index.js --host=1.2.3.4 --port=22 --user=root --password=pass --key=path/to/key --timeout=5000 --disableSudo
 function parseArgv() {
     const args = process.argv.slice(2);
     const config = {};
     for (const arg of args) {
-        const match = arg.match(/^--([^=]+)=(.*)$/);
-        if (match) {
-            config[match[1]] = match[2];
+        if (arg.startsWith('--')) {
+            const equalIndex = arg.indexOf('=');
+            if (equalIndex === -1) {
+                // Flag without value
+                config[arg.slice(2)] = null;
+            }
+            else {
+                // Key=value pair
+                config[arg.slice(2, equalIndex)] = arg.slice(equalIndex + 1);
+            }
         }
     }
     return config;
 }
+const isTestMode = process.env.SSH_MCP_TEST === '1';
 const isCliEnabled = process.env.SSH_MCP_DISABLE_MAIN !== '1';
-const argvConfig = isCliEnabled ? parseArgv() : {};
+const argvConfig = (isCliEnabled || isTestMode) ? parseArgv() : {};
 const HOST = argvConfig.host;
 const PORT = argvConfig.port ? parseInt(argvConfig.port) : 22;
 const USER = argvConfig.user;
 const PASSWORD = argvConfig.password;
+const SUPASSWORD = argvConfig.suPassword;
+const SUDOPASSWORD = argvConfig.sudoPassword;
+const DISABLE_SUDO = argvConfig.disableSudo !== undefined;
 const KEY = argvConfig.key;
 const DEFAULT_TIMEOUT = argvConfig.timeout ? parseInt(argvConfig.timeout) : 60000; // 60 seconds default timeout
 // Max characters configuration:
@@ -75,17 +86,27 @@ export function sanitizeCommand(command) {
     }
     return trimmedCommand;
 }
+function sanitizePassword(password) {
+    if (typeof password !== 'string')
+        return undefined;
+    // minimal check, do not log or modify content
+    if (password.length === 0)
+        return undefined;
+    return password;
+}
 // Escape command for use in shell contexts (like pkill)
 export function escapeCommandForShell(command) {
     // Replace single quotes with escaped single quotes
     return command.replace(/'/g, "'\"'\"'");
 }
-// SSH Connection Manager to maintain persistent connection
 export class SSHConnectionManager {
     conn = null;
-    sshConfig = null;
+    sshConfig;
     isConnecting = false;
     connectionPromise = null;
+    suShell = null; // Store the elevated shell session
+    suPromise = null;
+    isElevated = false; // Track if we're in su mode
     constructor(config) {
         this.sshConfig = config;
     }
@@ -98,7 +119,7 @@ export class SSHConnectionManager {
         }
         this.isConnecting = true;
         this.connectionPromise = new Promise((resolve, reject) => {
-            this.conn = new SSHClient();
+            this.conn = new Client();
             const timeoutId = setTimeout(() => {
                 this.conn?.end();
                 this.conn = null;
@@ -106,10 +127,22 @@ export class SSHConnectionManager {
                 this.connectionPromise = null;
                 reject(new McpError(ErrorCode.InternalError, 'SSH connection timeout'));
             }, 30000); // 30 seconds connection timeout
-            this.conn.on('ready', () => {
+            this.conn.on('ready', async () => {
                 clearTimeout(timeoutId);
                 this.isConnecting = false;
                 console.error('SSH connection established');
+                // If suPassword is provided, attempt to elevate to su shell in background
+                // Do not block connection establishment on elevation (it may take time);
+                // elevation is attempted asynchronously and errors are logged.
+                if (this.sshConfig.suPassword) {
+                    this.ensureElevated().then(() => {
+                        console.error('Successfully elevated to su shell');
+                    }).catch((err) => {
+                        console.error('Failed to elevate to su shell:', err);
+                        // Do not reject connection; just log the error. Subsequent sudo calls
+                        // will either use the su shell if available or provide sudo password.
+                    });
+                }
                 resolve();
             });
             this.conn.on('error', (err) => {
@@ -138,6 +171,73 @@ export class SSHConnectionManager {
     isConnected() {
         return this.conn !== null && this.conn._sock && !this.conn._sock.destroyed;
     }
+    getSudoPassword() {
+        return this.sshConfig.sudoPassword;
+    }
+    async ensureElevated() {
+        if (this.isElevated && this.suShell)
+            return;
+        if (!this.sshConfig.suPassword)
+            return;
+        if (this.suPromise)
+            return this.suPromise;
+        this.suPromise = new Promise((resolve, reject) => {
+            const conn = this.getConnection();
+            // Open an interactive shell and run `su -` inside it, responding to the password prompt.
+            // Request a PTY so that su/sudo can prompt for a password interactively.
+            conn.shell({ term: 'xterm', cols: 80, rows: 24 }, (err, stream) => {
+                if (err) {
+                    this.suPromise = null;
+                    reject(new McpError(ErrorCode.InternalError, `Failed to start interactive shell for su: ${err.message}`));
+                    return;
+                }
+                let buffer = '';
+                const cleanup = () => {
+                    try {
+                        stream.removeAllListeners('data');
+                    }
+                    catch (e) { /* ignore */ }
+                };
+                const onData = (data) => {
+                    buffer += data.toString();
+                    // Detect password prompt from su
+                    if (/password[: ]*$/i.test(buffer)) {
+                        // Send the su password
+                        stream.write(this.sshConfig.suPassword + '\n');
+                        buffer = '';
+                        return;
+                    }
+                    // Detect common root prompt (ends with #) or explicit root indicator
+                    if (/\n[^\n]*# $/.test(buffer) || /root[@:]/i.test(buffer)) {
+                        // We appear to be elevated; keep the interactive shell as suShell
+                        cleanup();
+                        this.suShell = stream;
+                        this.isElevated = true;
+                        this.suPromise = null;
+                        resolve();
+                        return;
+                    }
+                    // Detect authentication failure
+                    if (/authentication failure|incorrect password|su: .*failed/i.test(buffer)) {
+                        cleanup();
+                        this.suPromise = null;
+                        reject(new McpError(ErrorCode.InternalError, `su authentication failed: ${buffer}`));
+                        return;
+                    }
+                };
+                stream.on('data', onData);
+                stream.on('close', () => {
+                    if (!this.isElevated) {
+                        this.suPromise = null;
+                        reject(new McpError(ErrorCode.InternalError, 'su shell closed before elevation completed'));
+                    }
+                });
+                // Kick off the su command
+                stream.write('su -\n');
+            });
+        });
+        return this.suPromise;
+    }
     async ensureConnected() {
         if (!this.isConnected()) {
             await this.connect();
@@ -151,6 +251,14 @@ export class SSHConnectionManager {
     }
     close() {
         if (this.conn) {
+            if (this.suShell) {
+                try {
+                    this.suShell.end();
+                }
+                catch (e) { /* ignore */ }
+                this.suShell = null;
+                this.isElevated = false;
+            }
             this.conn.end();
             this.conn = null;
         }
@@ -159,7 +267,7 @@ export class SSHConnectionManager {
 let connectionManager = null;
 const server = new McpServer({
     name: 'SSH MCP Server',
-    version: '1.2.2',
+    version: '1.3.0',
     capabilities: {
         resources: {},
         tools: {},
@@ -173,6 +281,9 @@ server.tool("exec", "Execute a shell command on the remote SSH server and return
     try {
         // Initialize connection manager if not already done
         if (!connectionManager) {
+            if (!HOST || !USER) {
+                throw new McpError(ErrorCode.InvalidParams, 'Missing required host or username');
+            }
             const sshConfig = {
                 host: HOST,
                 port: PORT,
@@ -185,6 +296,9 @@ server.tool("exec", "Execute a shell command on the remote SSH server and return
                 const fs = await import('fs/promises');
                 sshConfig.privateKey = await fs.readFile(KEY, 'utf8');
             }
+            if (SUPASSWORD !== null && SUPASSWORD !== undefined) {
+                sshConfig.suPassword = sanitizePassword(SUPASSWORD);
+            }
             connectionManager = new SSHConnectionManager(sshConfig);
         }
         // Ensure connection is active (reconnect if needed)
@@ -199,12 +313,66 @@ server.tool("exec", "Execute a shell command on the remote SSH server and return
         throw new McpError(ErrorCode.InternalError, `Unexpected error: ${err?.message || err}`);
     }
 });
+// Expose sudo-exec tool unless explicitly disabled
+if (!DISABLE_SUDO) {
+    server.tool("sudo-exec", "Execute a shell command on the remote SSH server using sudo. Will use sudo password if provided, otherwise assumes passwordless sudo.", {
+        command: z.string().describe("Shell command to execute with sudo on the remote SSH server"),
+    }, async ({ command }) => {
+        const sanitizedCommand = sanitizeCommand(command);
+        try {
+            if (!connectionManager) {
+                if (!HOST || !USER) {
+                    throw new McpError(ErrorCode.InvalidParams, 'Missing required host or username');
+                }
+                const sshConfig = {
+                    host: HOST,
+                    port: PORT || 22,
+                    username: USER,
+                };
+                if (PASSWORD) {
+                    sshConfig.password = PASSWORD;
+                }
+                else if (KEY) {
+                    const fs = await import('fs/promises');
+                    sshConfig.privateKey = await fs.readFile(KEY, 'utf8');
+                }
+                if (SUPASSWORD !== null && SUPASSWORD !== undefined) {
+                    sshConfig.suPassword = sanitizePassword(SUPASSWORD);
+                }
+                if (SUDOPASSWORD !== null && SUDOPASSWORD !== undefined) {
+                    sshConfig.sudoPassword = sanitizePassword(SUDOPASSWORD);
+                }
+                connectionManager = new SSHConnectionManager(sshConfig);
+            }
+            await connectionManager.ensureConnected();
+            let wrapped;
+            const sudoPassword = connectionManager.getSudoPassword();
+            if (!sudoPassword) {
+                // No password provided, use -n to fail if sudo requires a password
+                wrapped = `sudo -n sh -c '${sanitizedCommand.replace(/'/g, "'\\''")}'`;
+            }
+            else {
+                // Password provided — pipe it into sudo using printf. This avoids complex
+                // PTY/stdin handling on the SSH channel and is simpler and more reliable.
+                const pwdEscaped = sudoPassword.replace(/'/g, "'\\''");
+                wrapped = `printf '%s\\n' '${pwdEscaped}' | sudo -p "" -S sh -c '${sanitizedCommand.replace(/'/g, "'\\''")}'`;
+            }
+            return await execSshCommandWithConnection(connectionManager, wrapped);
+        }
+        catch (err) {
+            if (err instanceof McpError)
+                throw err;
+            throw new McpError(ErrorCode.InternalError, `Unexpected error: ${err?.message || err}`);
+        }
+    });
+}
 // New function that uses persistent connection
-export async function execSshCommandWithConnection(manager, command) {
+export async function execSshCommandWithConnection(manager, command, stdin) {
     return new Promise((resolve, reject) => {
         let timeoutId;
         let isResolved = false;
         const conn = manager.getConnection();
+        const shell = manager.suShell; // Use su shell if available
         // Set up timeout
         timeoutId = setTimeout(() => {
             if (!isResolved) {
@@ -226,7 +394,23 @@ export async function execSshCommandWithConnection(manager, command) {
                 reject(new McpError(ErrorCode.InternalError, `Command execution timed out after ${DEFAULT_TIMEOUT}ms`));
             }
         }, DEFAULT_TIMEOUT);
-        conn.exec(command, (err, stream) => {
+        let execCommand = command;
+        const execFn = shell ?
+            (cb) => {
+                shell.write(execCommand + '\n');
+                cb(null, shell);
+            } :
+            (cb) => {
+                // If we have stdin to send (e.g., sudo -S), request a PTY so sudo can read the
+                // password reliably in environments that require a TTY.
+                if (stdin && stdin.length > 0) {
+                    conn.exec(execCommand, { pty: true }, cb);
+                }
+                else {
+                    conn.exec(execCommand, cb);
+                }
+            };
+        execFn((err, stream) => {
             if (err) {
                 if (!isResolved) {
                     isResolved = true;
@@ -237,6 +421,31 @@ export async function execSshCommandWithConnection(manager, command) {
             }
             let stdout = '';
             let stderr = '';
+            // Setup data handlers before sending any input
+            stream.on('data', (data) => {
+                stdout += data.toString();
+            });
+            stream.stderr.on('data', (data) => {
+                stderr += data.toString();
+            });
+            // If stdin provided, write it to the stream
+            if (stdin && stdin.length > 0 && !shell) {
+                try {
+                    // Write to the exec channel (send to remote stdin)
+                    stream.write(stdin);
+                    stream.end(); // End stdin after writing password
+                }
+                catch (e) {
+                    console.error('Error writing to stdin:', e);
+                }
+            }
+            else {
+                // No stdin, just end the stream (guard in case stream.end is not available)
+                try {
+                    stream.end();
+                }
+                catch (e) { /* ignore */ }
+            }
             stream.on('close', (code, signal) => {
                 if (!isResolved) {
                     isResolved = true;
@@ -254,19 +463,13 @@ export async function execSshCommandWithConnection(manager, command) {
                     }
                 }
             });
-            stream.on('data', (data) => {
-                stdout += data.toString();
-            });
-            stream.stderr.on('data', (data) => {
-                stderr += data.toString();
-            });
         });
     });
 }
 // Keep the old function for backward compatibility (used in tests)
-export async function execSshCommand(sshConfig, command) {
+export async function execSshCommand(sshConfig, command, stdin) {
     return new Promise((resolve, reject) => {
-        const conn = new SSHClient();
+        const conn = new Client();
         let timeoutId;
         let isResolved = false;
         // Set up timeout
@@ -304,6 +507,19 @@ export async function execSshCommand(sshConfig, command) {
                     conn.end();
                     return;
                 }
+                // If stdin provided, write it to the stream and end stdin
+                if (stdin && stdin.length > 0) {
+                    try {
+                        stream.write(stdin);
+                    }
+                    catch (e) {
+                        // ignore
+                    }
+                }
+                try {
+                    stream.end();
+                }
+                catch (e) { /* ignore */ }
                 let stdout = '';
                 let stderr = '';
                 stream.on('close', (code, signal) => {
@@ -363,7 +579,16 @@ async function main() {
         }
     });
 }
-if (process.env.SSH_MCP_DISABLE_MAIN !== '1') {
+// Initialize server in test mode for automated tests
+if (isTestMode) {
+    const transport = new StdioServerTransport();
+    server.connect(transport).catch(error => {
+        console.error("Fatal error connecting server:", error);
+        process.exit(1);
+    });
+}
+// Start server in CLI mode
+else if (isCliEnabled) {
     main().catch((error) => {
         console.error("Fatal error in main():", error);
         if (connectionManager) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ssh-mcp",
   "license": "MIT",
-  "version": "1.2.2",
+  "version": "1.3.0",
   "description": "MCP server exposing SSH control for Linux and Windows systems via Model Context Protocol.",
   "type": "module",
   "bin": {