mcp-ssh-manager@3.1.0
CAUTIONPublisher claims: "MCP SSH Manager: Model Context Protocol server for SSH remote server management. Control SSH connections from Claude Code and OpenAI Codex - execute commands, transfer files, database operations, backups, health monitoring, and DevOps automation. NEW: Too" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher iflow-mcp · publishing for 458 daysInstalls 1,846Last detonated 4d ago
Coverage
Server started and answered tools/list.- Tested
- MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
- Not tested
- what the tools do when called with real credentials
Before you give it your token
- It will ask for
- no credential variables read in the code
- Where it talks to
- no vendor host named in the code
- What the honeypot saw
- no credential files read · no network
- What we could not test
- what the tools do when called with real credentials
Reasonable to connect. No credential asked for, no third-party host named, Server started and answered tools/list.
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-10 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 26 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
5.3sprocessdependency install exit 0
25sclaimed37 tools: ssh_execute, ssh_upload, ssh_download, ssh_sync, ssh_tail, ssh_monitor, ssh_history, ssh_session_start, ssh_session_send, ssh_session_list, ssh_session_close, ssh_execute_group, ssh_group_manage, ssh_list_servers, ssh_deploy, ssh_execute_sudo, ssh_command_alias, ssh_hooks, ssh_profile, ssh_connection_status, ssh_tunnel_create, ssh_tunnel_list, ssh_tunnel_close, ssh_key_manage, ssh_alias
25sprocessscript backend runs setup only
25sprocessno install scripts to re-run
Static findings
HIGH
Access to sensitive file pathscli/install.sh:91 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05echo " .env # Server definitions"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsCLAUDE.md:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05- Manages `.env` file with server configurationsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathscli/install.sh:90 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05echo " ~/.ssh-manager/ # Config directory"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathscli/lib/config.sh:82 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Load servers from .env fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file paths.pre-commit-config.yaml:102 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05entry: bash -c '! git ls-files | grep -q "^\.env$"'Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathscli/lib/config.sh:21 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05SSH_MANAGER_ENV="$(dirname "$(dirname "$REAL_DIR")")/.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathscli/commands/server.sh:194 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Edit server configuration (full .env file)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
References a credential file in the home directorycli/commands/server.sh:43 · References a credential file in the home directory
AST03prompt_input "SSH key path" "$HOME/.ssh/id_rsa" "auth_value"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file paths.pre-commit-config.yaml:101 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05name: Ensure .env is not trackedFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathscli/build.sh:111 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if [ ! -f "$HOME/mcp/mcp-ssh-manager/.env" ] && [ ! -f "$HOME/.ssh-manager/.env" ]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathscli/lib/config.sh:8 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Resolve .env path - handle both direct and symlinked executionFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandCLAUDE.md:117 · Privileged sudo command — agent may execute with elevated privileges
AST05- `ssh_execute_sudo`: Execute commands with sudo privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsCLAUDE.md:144 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST052. `.env` file in project rootFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandCLAUDE.md:178 · Privileged sudo command — agent may execute with elevated privileges
AST054. **Deployment Strategy**: The deploy helper detects permission issues and automatically creates scripts for sudo execution when neededFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
References a credential file in the home directorycli/lib/menu.sh:149 · References a credential file in the home directory
AST03echo " • ~/.ssh/id_rsa (default RSA key)"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsCLAUDE.md:137 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST051. **Environment Variables (.env)** - Traditional format for Claude CodeFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandCLAUDE.md:155 · Privileged sudo command — agent may execute with elevated privileges
AST05SSH_SERVER_[NAME]_SUDO_PASSWORD=pass # Optional for automated sudoFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathscli/demo.sh:61 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05echo " • All configurations are saved in .env file"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.CRITICAL
Reads credential paths from the home directorysrc/tool-config-manager.js:16 · Reads credential paths from the home directory
AST03* User-global only: ~/.ssh-manager/tools-config.jsonFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathscli/lib/config.sh:90 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Parse .env file for server definitionsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsCLAUDE.md:51 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05ssh-manager codex convert to-env # Convert TOML to .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Authorization escalation languageCLAUDE.md:117 · Authorization escalation language
AST01- `ssh_execute_sudo`: Execute commands with sudo privilegesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Privileged sudo commandCLAUDE.md:167 · Privileged sudo command — agent may execute with elevated privileges
AST05sudo_password = "pass" # Optional for automated sudoFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathscli/lib/config.sh:12 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05SSH_MANAGER_ENV="$(dirname "$SCRIPT_DIR")/.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsCLAUDE.md:50 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05ssh-manager codex convert to-toml # Convert .env to TOMLFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandcli/install.sh:54 · Privileged sudo command — agent may execute with elevated privileges
AST05echo -e "${YELLOW}Note: You may need sudo permissions to install to $INSTALL_DIR${NC}"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathscli/build.sh:112 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05print_info "No .env file found. You'll need to configure servers after installation."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File permission modification commandcli/migrate.sh:107 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "$WRAPPER"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.HIGH
Privileged sudo commandsrc/index.js:1978 · Privileged sudo command — agent may execute with elevated privileges
AST05// Execute command with sudo supportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathssrc/config-loader.js:45 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// Load .env file (higher priority, overwrites TOML)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/tool-config-manager.js:16 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* User-global only: ~/.ssh-manager/tools-config.jsonFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/ssh-manager.js:315 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05const result = await this.execCommand('grep "^$USER:" /etc/passwd | cut -d: -f6', {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathscli/migrate.sh:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"../.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathscli/migrate.sh:22 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandprofiles/frappe.json:25 · Privileged sudo command — agent may execute with elevated privileges
AST05"check-supervisor": "sudo supervisorctl status",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File permission modification commandcli/build.sh:95 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "$TEMP_BUILD/ssh-manager"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.HIGH
Access to sensitive file pathscli/migrate.sh:21 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"$HOME/mcp/mcp-ssh-manager/.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathscli/lib/menu.sh:203 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Save to .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandprofiles/frappe.json:26 · Privileged sudo command — agent may execute with elevated privileges
AST05"restart-supervisor": "sudo supervisorctl restart all",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File permission modification commandcli/install.sh:74 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "$CLI_HOME/ssh-manager"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commandsrc/deploy-helper.js:69 · File permission modification command — agent changes file ownership/permissions
AST05`echo "${sudoPassword}" | sudo -S chown ${owner} "${remotePath}"` :Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commandcli/build.sh:96 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "$TEMP_BUILD/install.sh"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.HIGH
Access to sensitive file pathssrc/index.js:161 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05dotenv.config({ path: path.join(__dirname, '..', '.env') });Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/config-loader.js:52 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05logger.warn(`Failed to load .env config: ${error.message}`);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandsrc/deploy-helper.js:56 · Privileged sudo command — agent may execute with elevated privileges
AST05`echo "${sudoPassword}" | sudo -S cp {{tempFile}} "${remotePath}"` :Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathscli/lib/menu.sh:149 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05echo " • ~/.ssh/id_rsa (default RSA key)"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/config-loader.js:22 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05envPath = path.join(process.cwd(), '.env'),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
References a credential file in the home directorycli/lib/menu.sh:309 · References a credential file in the home directory
AST03prompt_input "SSH key path" "${current_keypath:-$HOME/.ssh/id_rsa}" "auth_value"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathscli/lib/menu.sh:151 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05echo " • ~/.ssh/custom_key (custom key)"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandsrc/index.js:2003 · Privileged sudo command — agent may execute with elevated privileges
AST05fullCommand = `sudo ${fullCommand}`;Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsscripts/validate.sh:36 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05echo " ✅ No .env file in git"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Process kill commandscripts/validate.sh:55 · Process kill command — agent can terminate processes
AST05kill $PID 2>/dev/nullFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandsrc/index.js:1982 · Privileged sudo command — agent may execute with elevated privileges
AST05description: 'Execute command with sudo on remote server',Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathssrc/config-loader.js:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* 2. .env fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/ssh-manager.js:313 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// Method 3: Parse /etc/passwd directlyFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/validate.sh:33 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05echo " ❌ WARNING: .env file is tracked in git!"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathscli/lib/menu.sh:63 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05echo " Directly edit .env file"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandsrc/index.js:2001 · Privileged sudo command — agent may execute with elevated privileges
AST05// Add sudo if not already presentFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsscripts/validate.sh:30 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Check for .env in gitFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandsrc/index.js:2002 · Privileged sudo command — agent may execute with elevated privileges
AST05if (!fullCommand.startsWith('sudo ')) {Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathssrc/ssh-manager.js:325 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// /etc/passwd parsing failed, try last resortFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
References a credential file in the home directorycli/lib/menu.sh:150 · References a credential file in the home directory
AST03echo " • ~/.ssh/id_ed25519 (modern ED25519 key)"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File permission modification commandcli/build.sh:98 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "$TEMP_BUILD/demo.sh" 2>/dev/null || trueFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.HIGH
Privileged sudo commandsrc/deploy-helper.js:69 · Privileged sudo command — agent may execute with elevated privileges
AST05`echo "${sudoPassword}" | sudo -S chown ${owner} "${remotePath}"` :Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathssrc/index.js:172 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05envPath: path.join(__dirname, '..', '.env'),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandsrc/deploy-helper.js:58 · Privileged sudo command — agent may execute with elevated privileges
AST05`sudo cp {{tempFile}} "${remotePath}"` :Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File permission modification commandcli/build.sh:97 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "$TEMP_BUILD/migrate.sh"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.HIGH
References a credential file in the home directorycli/lib/menu.sh:152 · References a credential file in the home directory
AST03prompt_input "SSH key path" "$HOME/.ssh/id_rsa" "auth_value"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathscli/migrate.sh:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Find .env fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Process kill commandscripts/validate.sh:54 · Process kill command — agent can terminate processes
AST05if kill -0 $PID 2>/dev/null; thenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsscripts/validate.sh:32 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if git ls-files | grep -q "^\.env$"; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathscli/migrate.sh:20 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"../../mcp-ssh-manager/.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/config-loader.js:50 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05logger.info(`Loaded SSH configuration from .env: ${envPath}`);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File permission modification commandsrc/deploy-helper.js:70 · File permission modification command — agent changes file ownership/permissions
AST05`sudo chown ${owner} "${remotePath}"`;Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.HIGH
Privileged sudo commandsrc/deploy-helper.js:44 · Privileged sudo command — agent may execute with elevated privileges
AST05// Step 2: Determine if we need sudoFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandsrc/deploy-helper.js:70 · Privileged sudo command — agent may execute with elevated privileges
AST05`sudo chown ${owner} "${remotePath}"`;Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandCLAUDE.md:106 · Process kill command — agent can terminate processes
AST05- `ssh_process_manager`: List, monitor, or kill processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathscli/lib/menu.sh:150 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05echo " • ~/.ssh/id_ed25519 (modern ED25519 key)"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Process kill commandsrc/index.js:3719 · Process kill command — agent can terminate processes
AST05.describe('Action: list processes, kill process, or get process info'),Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File permission modification commandsrc/deploy-helper.js:82 · File permission modification command — agent changes file ownership/permissions
AST05`sudo chmod ${permissions} "${remotePath}"`;Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Process kill commandsrc/index.js:3721 · Process kill command — agent can terminate processes
AST05.describe('Process ID (required for kill and info actions)'),Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/index.js:227 · Process kill command — agent can terminate processes
AST05// Execute command with timeout - using child_process timeout for real killFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/index.js:3715 · Process kill command — agent can terminate processes
AST05description: 'List, monitor, or kill processes on remote server',Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/index.js:1018 · Process kill command — agent can terminate processes
AST05… In follow mode, output is streamed to stderr.\nTo stop tailing, you'll need to kill the session.` } ] }; } else { // Non…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File permission modification commandsrc/index.js:3478 · File permission modification command — agent changes file ownership/permissions
AST05await ssh.execCommand(`echo '${escapedScript}' > "${scriptPath}" && chmod +x "${scriptPath}"`);Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commandsrc/deploy-helper.js:81 · File permission modification command — agent changes file ownership/permissions
AST05`echo "${sudoPassword}" | sudo -S chmod ${permissions} "${remotePath}"` :Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Process kill commandsrc/health-monitor.js:253 · Process kill command — agent can terminate processes
AST05* Build command to kill a processFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/health-monitor.js:266 · Process kill command — agent can terminate processes
AST05return `kill -${signal} ${pid}`;Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/ssh-manager.js:134 · Process kill command — agent can terminate processes
AST05// Try multiple ways to kill the streamFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.LOW
Authorization escalation languageREADME.md:702 · Authorization escalation language · informational: not an instruction file
AST01- `ssh_execute_sudo` - Execute commands with sudo privilegesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Authorization escalation languageREADME.md:119 · Authorization escalation language · informational: not an instruction file
AST01- **🔑 Sudo Support** - Execute commands with sudo privileges securelyFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Authorization escalation languagedocs/DEPLOYMENT_GUIDE.md:48 · Authorization escalation language · informational: not an instruction file
AST01Run commands with sudo privileges securely.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Authorization escalation languagedocs/TOOL_MANAGEMENT.md:126 · Authorization escalation language · informational: not an instruction file
AST01- `ssh_execute_sudo` - Execute commands with sudo privilegesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Authorization escalation languageREADME.md:479 · Authorization escalation language · informational: not an instruction file
AST01Execute commands with sudo privileges.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.Cost to the agent
Instructions loaded
≈2,166 tok
2 files · 58 in bundle
Tool list per prompt
≈5,806 tok
37 tools · 157 per tool
Handshake
738 ms
launch to tools/list, stdio
Undocumented tools
1
description under 20 chars · avg 43
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for @iflow-mcp/mcp-ssh-manager@3.1.0 as of 4d ago. This is the package itself, not its dependencies.
What would make this Verified
10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Reads credential paths from the home directory≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Unclaimed publisher≈ +8 on the totalClaim iflow-mcp: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- References a credential file in the home directory≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim iflow-mcpPropose a patch to the maintainer