ssh-mcp@2.22.0

CAUTION

Publisher claims: "MCP server exposing policy-gated, audited SSH access for Linux and Windows hosts via the Model Context Protocol." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher tufantunc · joined 0 days agoInstalls 31,568Last detonated 59 min ago

Dispute verdict

Behavior trace

Honeypot run · 1 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.6sprocessdependency install exit 1

0.7sprocessexec /usr/bin/timeout

0.7sprocessexited 1: Node.js v22.23.4

0.7sclaimedno tools/list reply (exit 1)

0.7sprocessscript backend runs setup only

Static findings

CRITICAL

Destructive file system command detectedREADME.md:771 · Destructive file system command detected

AST05

CRITICAL

Destructive file system command detectedREADME.md:734 · Destructive file system command detected

AST05

CRITICAL

Destructive file system command detectedREADME.md:753 · Destructive file system command detected

AST05

CRITICAL

Destructive file system command detectedREADME.md:766 · Destructive file system command detected

AST05

CRITICAL

Destructive file system command detectedREADME.md:707 · Destructive file system command detected

AST05

CRITICAL

Destructive file system command detectedbuild/policy/classifier.js:628 · Destructive file system command detected

AST05

CRITICAL

Destructive file system command detectedbuild/policy/classifier.js:632 · Destructive file system command detected

AST05

CRITICAL

Destructive file system command detectedbuild/policy/classifier.js:625 · Destructive file system command detected

AST05

CRITICAL

Privileged sudo commandbuild/policy/classifier.js:949 · Privileged sudo command — agent may execute with elevated privileges

AST05

CRITICAL

Privileged sudo commandbuild/policy/classifier.js:543 · Privileged sudo command — agent may execute with elevated privileges

AST05

CRITICAL

Reads credential paths from the home directorybuild/policy/classifier.js:1853 · Reads credential paths from the home directory

AST03

CRITICAL

Privileged sudo commandbuild/tools/command-tools.js:50 · Privileged sudo command — agent may execute with elevated privileges

AST05

CRITICAL

Privileged sudo commandbuild/tools/command-tools.js:67 · Privileged sudo command — agent may execute with elevated privileges

AST05

CRITICAL

Privileged sudo commandbuild/tools/command-tools.js:64 · Privileged sudo command — agent may execute with elevated privileges

AST05

CRITICAL

Privileged sudo commandREADME.md:160 · Privileged sudo command — agent may execute with elevated privileges

AST05

CRITICAL

Privileged sudo commandbuild/tools/pipeline.js:300 · Privileged sudo command — agent may execute with elevated privileges

AST05

HIGH

References a credential file in the home directoryREADME.md:428 · References a credential file in the home directory

AST03

CRITICAL

Privileged sudo commandbuild/tools/command-tools.js:71 · Privileged sudo command — agent may execute with elevated privileges

AST05

CRITICAL

Privileged sudo commandbuild/guard/sanitizer.js:122 · Privileged sudo command — agent may execute with elevated privileges

AST05

CRITICAL

Destructive file system command detectedbuild/policy/classifier.js:543 · Destructive file system command detected

AST05

HIGH

File permission modification commandREADME.md:60 · File permission modification command — agent changes file ownership/permissions

AST05

CRITICAL

Destructive file system command detectedbuild/policy/classifier.js:991 · Destructive file system command detected

AST05

CRITICAL

Pipe-to-shell patternbuild/policy/classifier.js:1678 · Pipe-to-shell pattern — downloads and immediately executes remote code

AST06

CRITICAL

Privileged sudo commandbuild/policy/awk.js:332 · Privileged sudo command — agent may execute with elevated privileges

AST05

HIGH

References a credential file in the home directoryREADME.md:54 · References a credential file in the home directory

AST03

CRITICAL

Privileged sudo commandbuild/tools/command-tools.js:62 · Privileged sudo command — agent may execute with elevated privileges

AST05

CRITICAL

Privileged sudo commandbuild/policy/awk.js:97 · Privileged sudo command — agent may execute with elevated privileges

AST05

CRITICAL

Privileged sudo commandbuild/guard/sanitizer.js:13 · Privileged sudo command — agent may execute with elevated privileges

AST05

HIGH

Access to sensitive file pathsREADME.md:424 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

Access to sensitive file pathsREADME.md:213 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

Access to sensitive file pathsREADME.md:408 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Privileged sudo commandREADME.md:595 · Privileged sudo command — agent may execute with elevated privileges

AST05

CRITICAL

Privileged sudo commandbuild/policy/classifier.js:566 · Privileged sudo command — agent may execute with elevated privileges

AST05

CRITICAL

Privileged sudo commandREADME.md:927 · Privileged sudo command — agent may execute with elevated privileges

AST05

CRITICAL

Privileged sudo commandbuild/tools/descriptions.js:10 · Privileged sudo command — agent may execute with elevated privileges

AST05

HIGH

File permission modification commandREADME.md:736 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

Access to sensitive file pathsREADME.md:54 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

Process kill commandREADME.md:443 · Process kill command — agent can terminate processes

AST05

CRITICAL

Privileged sudo commandbuild/policy/classifier.js:872 · Privileged sudo command — agent may execute with elevated privileges

AST05

CRITICAL

Destructive file system command detectedbuild/guard/approval-grants.js:43 · Destructive file system command detected

AST05

CRITICAL

Privileged sudo commandbuild/policy/awk.js:355 · Privileged sudo command — agent may execute with elevated privileges

AST05

CRITICAL

Privileged sudo commandbuild/policy/engine.js:438 · Privileged sudo command — agent may execute with elevated privileges

AST05

CRITICAL

Privileged sudo commandbuild/policy/classifier.js:125 · Privileged sudo command — agent may execute with elevated privileges

AST05

CRITICAL

Privileged sudo commandbuild/policy/awk.js:376 · Privileged sudo command — agent may execute with elevated privileges

AST05

HIGH

File permission modification commandREADME.md:68 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

References a credential file in the home directoryREADME.md:424 · References a credential file in the home directory

AST03

HIGH

References a credential file in the home directoryREADME.md:314 · References a credential file in the home directory

AST03

HIGH

Access to sensitive file pathsREADME.md:314 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

MEDIUM

Remote installer piped to shellREADME.md:734 · Remote installer piped to shell

AST07

HIGH

Access to sensitive file pathsbuild/policy/classifier.js:514 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

npx invocation of non-well-known packageREADME.md:583 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Process kill commandbuild/index.js:123 · Process kill command — agent can terminate processes

AST05

HIGH

Process kill commandbuild/guard/sanitizer.js:35 · Process kill command — agent can terminate processes

AST05

HIGH

Access to sensitive file pathsbuild/tools/local-path.js:135 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

Access to sensitive file pathsbuild/policy/classifier.js:117 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

Process kill commandbuild/index.js:97 · Process kill command — agent can terminate processes

AST05

HIGH

Access to sensitive file pathsbuild/policy/classifier.js:582 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

Process kill commandbuild/tools/results.js:9 · Process kill command — agent can terminate processes

AST05

HIGH

Unicode escape sequence detectedbuild/guard/sanitizer.js:99 · Unicode escape sequence detected — may contain obfuscated payloads

AST07

HIGH

Process kill commandbuild/ssh/connection-registry.js:189 · Process kill command — agent can terminate processes

AST05

HIGH

File permission modification commandbuild/config/loader.js:70 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

Access to sensitive file pathsbuild/policy/classifier.js:552 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

File permission modification commandbuild/policy/classifier.js:608 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

File permission modification commandbuild/config/loader.js:75 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

File permission modification commandpackage.json:13 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

File permission modification commandbuild/policy/classifier.js:1733 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

File permission modification commandbuild/config/windows-acl.js:336 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

File permission modification commandbuild/config/loader.js:78 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

Access to sensitive file pathsbuild/tools/forbidden-dirs.js:23 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

Process kill commandbuild/tools/command-tools.js:83 · Process kill command — agent can terminate processes

AST05

HIGH

Access to sensitive file pathsbuild/guard/sanitizer.js:28 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

Process kill commandbuild/index.js:114 · Process kill command — agent can terminate processes

AST05

MEDIUM

MCP server using network transport (SSE/HTTP)build/index.js:61 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04

HIGH

Process kill commandbuild/ssh/connection.js:427 · Process kill command — agent can terminate processes

AST05

HIGH

Access to sensitive file pathsbuild/policy/classifier.js:543 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

File permission modification commandbuild/config/loader.js:35 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

Process kill commandbuild/ssh/session-manager.js:147 · Process kill command — agent can terminate processes

AST05

HIGH

File permission modification commandbuild/policy/classifier.js:1720 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

File permission modification commandbuild/ssh/sftp.js:401 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

File permission modification commandbuild/policy/classifier.js:626 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

Process kill commandbuild/ssh/connection-registry.js:243 · Process kill command — agent can terminate processes

AST05

HIGH

Access to sensitive file pathsbuild/tools/forbidden-dirs.js:29 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05