mcp-ssh-manager@4.0.3
BLOCKEDPublisher claims: "MCP server for SSH: let AI agents (Claude Code, Codex, any MCP client) run commands, transfer files and manage servers over SSH, with human approval, an encrypted vault and a live audit trail." Observed in sandbox: reads credential files.
Registry npm (MCP server)Publisher bvisible · publishing for 403 daysInstalls 8,202Last detonated 10 h ago
Coverage
Server started and answered tools/list.- Tested
- MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
- Not tested
- what the tools do when called with real credentials
Revoked: guards refuse to launch this version
confirmed incident: read ~/.ssh-manager/profile Every machine running vet-skills guard stops starting it at the next launch; the state clears when the honeypot re-run or a reviewer clears it.
Before you give it your token
- It will ask for
SSH_AUTH_SOCKConfiguration, not credentials: CODEX_HOME, GITHUB_OUTPUT, MAX_SOCKET_PATH, MCP_SSH_COMPACT_JSON, MCP_SSH_CONNECTION_TIMEOUT, MCP_SSH_DEBUG, MCP_SSH_DEFAULT_TIMEOUT, MCP_SSH_KEEPALIVE_INTERVAL, MCP_SSH_MAX_OUTPUT_LENGTH, MCP_SSH_MAX_RSYNC_OUTPUT, MCP_SSH_MAX_TAIL_LINES, MCP_SSH_MAX_TIMEOUT, npm_execpath, PREFER_TOML_CONFIG, RELEASE_REQUIRE_TAG, RELEASE_TAG, SSH_CONFIG_PATH, SSH_ENV_PATH, SSH_GROUPS_FILE, SSH_HISTORY_FILE, SSH_LOG_FILE, SSH_LOG_LEVEL, SSH_MANAGER_ANNOUNCE_AGENT, SSH_MANAGER_APPROVAL, SSH_MANAGER_APPROVAL_SOCKET, SSH_MANAGER_APPROVAL_TIMEOUT_MS, SSH_MANAGER_DEMO_DROP, SSH_MANAGER_ENV, SSH_MANAGER_HOME, SSH_MANAGER_KEY_SOURCE, SSH_MANAGER_KNOWN_HOSTS, SSH_MANAGER_LOG_OUTPUT, SSH_MANAGER_PROFILE, SSH_MANAGER_VAULT, SSH_VERBOSE- Where it talks to
- no vendor host named in the codeAlso no-color.org, openxmlformats.org — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- read ~/.ssh-manager/profile · no network
- What we could not test
- what the tools do when called with real credentials
Do not connect it. The honeypot or a critical finding blocked this version; the evidence is below.
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-14 and scored it 37/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Reads credential paths from the home directory. Summary: reads credential files.
Behavior trace
Honeypot run · 29 s · 2 scenariost+CategoryObserved action
0.0sprocessno install scripts in bundle
9.0sprocessdependency install exit 0
29sfilesystemread ~/.ssh-manager/profile
29sclaimed37 tools: ssh_execute, ssh_upload, ssh_download, ssh_sync, ssh_tail, ssh_monitor, ssh_history, ssh_session_start, ssh_session_send, ssh_session_list, ssh_session_close, ssh_execute_group, ssh_group_manage, ssh_list_servers, ssh_deploy, ssh_execute_sudo, ssh_command_alias, ssh_hooks, ssh_profile, ssh_connection_status, ssh_tunnel_create, ssh_tunnel_list, ssh_tunnel_close, ssh_key_manage, ssh_alias
29stools2d683b0fb7d7c06d
29stoolsa2c0aa3318dde8e8
29stoolsbf1cd7ca5a66960c
29stoolsa573910938ebad8d
29stoolse77bb49bbdeac4ce
29stools38b65bd2dc74d555
29stools336cbcf546bfc7da
29stools420567405f637cb8
29stoolsc21bf88529da63ff
29stoolsa946d865716ae400
29stoolsff2a4a8420dfd06f
29stoolsc711c1b8ccfb9019
29stoolsa24a15e8543a9c39
29stools86a928e0571bd7ab
29stools57220ee214dd2de2
29stools1c25f8708b799603
29stools6c040bbae12545ad
29stools575970fd0e4aa4cf
29stools87dabe825ce6ee93
29stools6003632858bb2705
29stools4ae75d76515260f5
29stools37cd97bd9ca8a305
29stoolsf58dc0b0f35de248
29stools1914f0a22c68d6cd
29stoolsae4fc904ef7f853b
29stools5ab6f4838def9a23
29stoolse8388ca4134d9d94
29stoolsf36d5653a5a0ff22
29stools69c02ecd21c4eadb
29stoolsf9302ec0cffcb164
29stoolsf48eb92ba35815dd
29stools9c0614cf57b2b474
29stoolsfc23022afae0cca4
29stools5e65424022161ff4
29stoolsd0ab8de78d430d7f
29stoolsc49988d8de434d5d
29stoolse658f4e79822c053
29sprocessscript backend runs setup only
29sprocessno install scripts to re-run
Static findings
HIGH
Access to sensitive file pathsscripts/test-upgrade-from-published.mjs:126 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05keyPath: '~/.ssh/fixture-key', passphrase: 'fixture-passphrase', port: 2222, defaultDir: '~/fixture folder',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathscli/build.sh:111 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if [ ! -f "$HOME/mcp/mcp-ssh-manager/.env" ] && [ ! -f "$HOME/.ssh-manager/.env" ]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.CRITICAL
Reads credential paths from the home directorysrc/server-import.js:176 · Reads credential paths from the home directory
AST03label: 'OpenSSH config (~/.ssh/config)',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/test-upgrade-from-published.mjs:4 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* Installs three times and probes .env, TOML and process-environment setups.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/agent-clients.js:240 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05const env = { ...(previous?.env || {}) };Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsCLAUDE.md:179 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST052. `.env` file in project rootFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Destructive file system command detectedscripts/demo-env.mjs:314 · Destructive file system command detected
AST05'rm -rf /srv/app/releases/2026-08-21',Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Destructive file system command detectedscripts/demo-env.mjs:313 · Destructive file system command detected
AST05{ command: 'rm -rf /srv/app/releases/2026-08-21' },Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathssrc/approval.js:109 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// from a .env, a TOML file or the environment. An environment variable wouldFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsserver.json:28 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"description": "Path to a .env file declaring servers as SSH_SERVER_<NAME>_HOST, _USER, _KEYPATH and friends. Defaults to a .env next to the package.",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandsrc/config-loader.js:32 · Privileged sudo command — agent may execute with elevated privileges
AST05* @property {string} [sudoPassword] Password piped to `sudo -S`.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandCLAUDE.md:227 · Privileged sudo command — agent may execute with elevated privileges
AST054. **Deployment Strategy**: The deploy helper detects permission issues and automatically creates scripts for sudo execution when neededFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathscli/build.sh:112 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05print_info "No .env file found. You'll need to configure servers after installation."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Authorization escalation languageCLAUDE.md:152 · Authorization escalation language
AST01- `ssh_execute_sudo`: Execute commands with sudo privilegesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Collapsed <details> block carrying instructionsREADME.md:425 · Collapsed <details> block carrying instructions
AST01<summary><b>Spending less context — tool groups</b></summary> <br> All 37 tools cost roughly **43.5k tokens** of context. Most people don't need all of them. ``Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.CRITICAL
README tells the reader to click past SmartScreenREADME.md:64
AST06| Windows x64 / arm64 | `…-setup.exe` | **Not code-signed in 4.0.x.** Windows shows *"Windows protected your PC"*: *More info → Run anyway*. Check the file against the SHA-256 in `release-manifest-winFix: Pin versions and sources; vendor anything fetched at install time.CRITICAL
Reads credential paths from the home directorysrc/tool-config-manager.js:16 · Reads credential paths from the home directory
AST03* User-global only: ~/.ssh-manager/tools-config.jsonFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.CRITICAL
Pipe-to-shell patternsrc/backup-manager.js:494 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06// as the start of another job, so `* * * * * curl … | sh #` installed a jobFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Access to sensitive file pathsscripts/render-cli-menu.py:67 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05(state / '.env').write_text(DEMO_ENV)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandCLAUDE.md:191 · Privileged sudo command — agent may execute with elevated privileges
AST05SSH_SERVER_[NAME]_SUDO_PASSWORD=pass # Optional for automated sudoFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsCLAUDE.md:172 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST051. **Environment Variables (.env)** - Traditional format for Claude CodeFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/validate.sh:42 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if git ls-files | grep -q "^\.env$"; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/validate.sh:40 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Check for .env in gitFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/test-upgrade-from-published.mjs:120 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05const envFile = path.join(dir, '.env');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandCLAUDE.md:152 · Privileged sudo command — agent may execute with elevated privileges
AST05- `ssh_execute_sudo`: Execute commands with sudo privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathssrc/agent-clients.js:242 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05return { command: engine.command, args: engine.args, env: { ...env, ...engine.env } };Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathscli/demo.sh:61 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05echo " • All configurations are saved in .env file"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsCLAUDE.md:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05- Manages `.env` file with server configurationsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandCLAUDE.md:210 · Privileged sudo command — agent may execute with elevated privileges
AST05sudo_password = "pass" # Optional for automated sudoFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsscripts/validate.sh:46 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05echo " ✅ No .env file in git"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsCLAUDE.md:50 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05ssh-manager codex convert to-toml # Convert .env to TOMLFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsCLAUDE.md:51 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05ssh-manager codex convert to-env # Convert TOML to .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/test-upgrade-from-published.mjs:203 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05untouched(scenarios); ok('previous release: .env, TOML and environment each preserve all 20 effective fields and expose 37 tools');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/validate.sh:43 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05echo " ❌ WARNING: .env file is tracked in git!"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandsrc/ssh-manager.js:365 · Privileged sudo command — agent may execute with elevated privileges
AST05// sudo password reaches `sudo -S` without ever appearing in the remoteFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathssrc/logger.js:173 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// write a production password to ~/.ssh-manager.log and to stderr, whereFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandsrc/index.js:2223 · Privileged sudo command — agent may execute with elevated privileges
AST05…ctions. Deliberately omits secrets, so no passwords, key paths, passphrases, or sudo passwords are returned. Takes no parameters. Useful as a first call to discover …Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathssrc/user-state.js:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* SSH_MANAGER_HOME (~/.ssh-manager by default), readable by their owner only.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/secret-store.js:175 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* clear-text .env it replaces, and it keeps the vault usable on Windows, inFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/config-paths.js:37 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* The same .env must be used by the MCP engine, CLI and optional control plane.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/config-paths.js:67 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05path.join(process.cwd(), '.env'),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/secret-store.js:4 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// write it in clear text in a .env or TOML file. That file sits in a projectFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/logger.js:84 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* manager home, beside the .env. Up to 3.8.5 the default was inside theFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/tool-config-manager.js:16 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* User-global only: ~/.ssh-manager/tools-config.jsonFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/secret-store.js:377 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05+ 'If the servers are still in a .env: delete the vault and run ssh-manager vault import\n'Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/config-loader.js:102 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05/** @type {string|null} The .env actually read, once one has been. */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandsrc/deploy-helper.js:52 · Privileged sudo command — agent may execute with elevated privileges
AST05// Step 2: Determine if we need sudoFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathssrc/server-groups.js:302 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// sees .env servers, never TOML ones — hence the provider.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/control-plane.js:80 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// Keep an explicit empty value so the lower-priority .env cannot fillFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandsrc/deploy-helper.js:62 · Privileged sudo command — agent may execute with elevated privileges
AST05// A step that needs the sudo password carries it as `stdin`, never insideFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File permission modification commandcli/build.sh:95 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "$TEMP_BUILD/ssh-manager"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.HIGH
References a credential file in the home directorysrc/server-export.js:90 · References a credential file in the home directory
AST03keyPath: '~/.ssh/id_ed25519', group: 'staging' },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/server-import.js:6 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* Nobody starts here. They have a `~/.ssh/config` with forty hosts, or aFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/config-loader.js:142 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// Load .env file (higher priority, overwrites TOML)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandsrc/ssh-manager.js:366 · Privileged sudo command — agent may execute with elevated privileges
AST05// command line: interpolating it into `echo "..." | sudo -S` left itFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Destructive file system command detectedsrc/shell-segments.js:8 · Destructive file system command detected
AST05* such as `^rm ` missed `echo x; rm -rf /data` for the same reason. SplittingFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Privileged sudo commandsrc/index.js:2309 · Privileged sudo command — agent may execute with elevated privileges
AST05// step.stdin carries the sudo password for steps that need it, so itFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandsrc/index.js:2366 · Privileged sudo command — agent may execute with elevated privileges
AST05…xecute_sudo', { description: 'Runs a command with elevated privileges via sudo on the named server and returns the exit code and output. Prepends sudo when abs…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
References a credential file in the home directorysrc/server-export.js:87 · References a credential file in the home directory
AST03keyPath: '~/.ssh/id_ed25519', defaultDir: '/var/www', group: 'production',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/config-loader.js:75 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// strings "true"/"1"/"yes"/"on" (case-insensitive) from .env, where every valueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/server-import.js:176 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05label: 'OpenSSH config (~/.ssh/config)',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/config-paths.js:35 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* Which .env the engine reads, and why.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/user-state.js:8 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* install directory (issue #87). They now live beside the .env, inFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/control-plane.js:1463 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// being told they can clean up their .env.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/config-loader.js:109 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* 2. .env fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandsrc/index.js:2362 · Privileged sudo command — agent may execute with elevated privileges
AST05// Execute command with sudo supportFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathssrc/control-plane.js:2567 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* ~/.ssh/known_hosts with a line number from an error message.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/control-plane.js:1427 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* What is still living in a .env rather than in the vault.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Process kill commandCLAUDE.md:141 · Process kill command — agent can terminate processes
AST05- `ssh_process_manager`: List, monitor, or kill processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathssrc/secret-store.js:79 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* (~/.ssh-manager/) rather than in the project directory, so it is not caughtFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File permission modification commandcli/build.sh:97 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "$TEMP_BUILD/migrate.sh"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.HIGH
Access to sensitive file pathssrc/ssh-manager.js:564 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// Method 3: Parse /etc/passwd directlyFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandsrc/deploy-helper.js:63 · Privileged sudo command — agent may execute with elevated privileges
AST05// `command`. Interpolating it (`echo "<pass>" | sudo -S …`) published theFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File permission modification commandcli/build.sh:96 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "$TEMP_BUILD/install.sh"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.HIGH
Access to sensitive file pathssrc/config-paths.js:66 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05path.join(managerHome(), '.env'),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandsrc/ssh-manager.js:369 · Privileged sudo command — agent may execute with elevated privileges
AST05// afterwards tells sudo no more is coming; only done when a callerFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathssrc/server-groups.js:278 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05'Change the group of the servers themselves in your .env/TOML config, or use a different group name.'Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/config-paths.js:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* or ~/.ssh-manager. Read at call time so a test or a host that sets theFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandsrc/desktop-install.js:115 · Privileged sudo command — agent may execute with elevated privileges
AST05* `inherit` hands it the terminal (sudo asks for its password there)Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathssrc/control-plane.js:1493 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// The .env is not touched, here or anywhere: it stays the fallback, andFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/ssh-manager.js:576 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// /etc/passwd parsing failed, try last resortFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandsrc/index.js:2255 · Privileged sudo command — agent may execute with elevated privileges
AST05…ackup can be disabled per call. Options can set owner and permissions, supply a sudo password, and name a single service to restart afterward. Detects sensible owner…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathssrc/ssh-manager.js:566 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05const result = await this.execCommand('grep "^$USER:" /etc/passwd | cut -d: -f6', {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/config-loader.js:13 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* by every handler. **Field names are camelCase, always** — the `.env` keysFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandsrc/deploy-helper.js:66 · Privileged sudo command — agent may execute with elevated privileges
AST05const sudoPrefix = sudoPassword ? 'sudo -S -k -p \'\' ' : 'sudo ';Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathssrc/server-export.js:87 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05keyPath: '~/.ssh/id_ed25519', defaultDir: '/var/www', group: 'production',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/server-export.js:90 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05keyPath: '~/.ssh/id_ed25519', group: 'staging' },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedscripts/macbook-mockup.py:225 · Python subprocess execution detected
AST05subprocess.run(['ffmpeg', '-y', '-loglevel', 'error', '-i', str(src),Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File permission modification commandsrc/deploy-helper.js:86 · File permission modification command — agent changes file ownership/permissions
AST05command: `${sudoPrefix}chown ${shellQuote(owner)} ${target}`Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Process kill commandscripts/preview-candidate.mjs:243 · Process kill command — agent can terminate processes
AST05const kill = signal => {Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File type combined with upload actionscripts/preview-candidate.mjs:132 · File type combined with upload action — agent may exfiltrate local data files
AST07fs.writeFileSync(path.join(home, 'Documents', 'upload-me.txt'), 'Temporary candidate preview upload.\n');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Process kill commandscripts/test-upgrade-from-published.mjs:105 · Process kill command — agent can terminate processes
AST05const kill = setTimeout(() => child.kill(), 1000);Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandscripts/validate.sh:64 · Process kill command — agent can terminate processes
AST05if kill -0 $PID 2>/dev/null; thenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/health-monitor.js:271 · Process kill command — agent can terminate processes
AST05return `kill -${signal} ${pid}`;Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/index.js:1318 · Process kill command — agent can terminate processes
AST05… In follow mode, output is streamed to stderr.\nTo stop tailing, you'll need to kill the session.` } ] }; } else { // Non…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
npx invocation of non-well-known packagescripts/verify-mac-build.sh:138 · npx invocation of non-well-known package — may execute untrusted code
AST06else npx --no-install asar list "$ASAR" 2>/dev/nullFix: Pin versions and sources; vendor anything fetched at install time.LOW
HTML comment carrying imperative instructions to the agentdist/ui/index.html:6 · HTML comment carrying imperative instructions to the agent · informational: not an instruction file
AST01Inlined: the browser requests a favicon without the token, which the control plane refuses. A data URI costs no request at all.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Process kill commandsrc/ssh-manager.js:330 · Process kill command — agent can terminate processes
AST05// Try multiple ways to kill the streamFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedscripts/render-cli-menu.py:72 · Python subprocess execution detected
AST05result = subprocess.run(['script', '-q', '/dev/null', 'bash', str(ROOT / 'cli' / 'ssh-manager')],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/macbook-mockup.py:253 · Python subprocess execution detected
AST05subprocess.run(['ffmpeg', '-y', '-loglevel', 'error', '-framerate', str(fps),Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
npx invocation of non-well-known packagescripts/verify-mac-build.sh:133 · npx invocation of non-well-known package — may execute untrusted code
AST06# shell and not at the repository root — `npx --no-install asar` from hereFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Process kill commandsrc/index.js:4155 · Process kill command — agent can terminate processes
AST05…op processes (read-only), info returns details for one process (read-only), and kill sends a signal to terminate a process and mutates remote state. pid is required …Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/health-monitor.js:258 · Process kill command — agent can terminate processes
AST05* Build command to kill a processFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
npx invocation of non-well-known packagescripts/frame-screenshots.py:9 · npx invocation of non-well-known package — may execute untrusted code
AST06browser a tab pointed at the local control plane — what `npx mcp-ssh-managerFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Process kill commandsrc/tunnel-manager.js:23 · Process kill command — agent can terminate processes
AST05* that used to kill the whole MCP server process, while the awaited promiseFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File type combined with upload actionscripts/preview-candidate.mjs:32 · File type combined with upload action — agent may exfiltrate local data files
AST07if (/\b(ls|ll)\b/.test(command)) return 'README.txt reports uploads\n';Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Remote installer piped to shellsrc/backup-manager.js:494 · Remote installer piped to shell
AST07// as the start of another job, so `* * * * * curl … | sh #` installed a jobFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File permission modification commandcli/build.sh:98 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "$TEMP_BUILD/demo.sh" 2>/dev/null || trueFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Process kill commandscripts/validate.sh:65 · Process kill command — agent can terminate processes
AST05kill $PID 2>/dev/nullFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File permission modification commandsrc/deploy-helper.js:94 · File permission modification command — agent changes file ownership/permissions
AST05command: `${sudoPrefix}chmod ${shellQuote(permissions)} ${target}`Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commandsrc/index.js:3915 · File permission modification command — agent changes file ownership/permissions
AST05await ssh.execCommand(`printf '%s' ${shellQuote(scriptContent)} > ${quotedPath} && chmod +x ${quotedPath}`);Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Process kill commandsrc/index.js:329 · Process kill command — agent can terminate processes
AST05// Execute command with timeout - using child_process timeout for real killFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedscripts/macbook-mockup.py:265 · Python subprocess execution detected
AST05subprocess.run(['ffmpeg', '-y', '-loglevel', 'error', '-framerate', str(fps),Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.Cost to the agent
Instructions loaded
≈3,385 tok
2 files · 81 in bundle
Tool list per prompt
≈9,621 tok
37 tools · 260 per tool
Handshake
1732 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 478
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for mcp-ssh-manager@4.0.3 as of 2 h ago. This is the package itself, not its dependencies.
What would make this Verified
43 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Reads credential files≈ +27 on the totalThe sandbox saw reads under ~/.ssh, ~/.aws, ~/.npmrc, ~/.config or similar. Read only files inside the project, and only the ones the task needs.
- Reads credential paths from the home directory≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- README tells the reader to click past SmartScreen≈ +9 on the totalPin versions and sources; vendor anything fetched at install time.
- Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- Unclaimed publisher≈ +8 on the totalClaim bvisible: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim bvisiblePropose a patch to the maintainer