← All MCP servers
MCP server
SSH — policy-gated remote access
mcp:tufantunc/ssh-mcp
Policy-gated, audited SSH for Linux and Windows hosts: roles, approvals, and an audit log.
Verdict
Inconclusive
The analysis could not cover enough of the artifact to decide.
0
findings
—
highest severity
0
threat classes
275
files scanned
1,684/1,684
checks satisfied
0
package advisories
Why this verdict
- inconclusive: gap dynamic_metadata at src/tools/command-tools.ts
- inconclusive: gap dynamic_metadata at src/tools/config-tools.ts
- inconclusive: gap dynamic_metadata at src/tools/file-tools.ts
- inconclusive: gap dynamic_metadata at src/tools/session-tools.ts
- inconclusive: gap dynamic_metadata at src/tools/transfer-tools.ts
Security findings 0
No individual findings recorded
The inconclusive verdict rests on the open questions and coverage gaps below.
Open questions 1
What the analysis could not settle from the code alone.
The tool descriptions are read from an object D[...] defined outside the shown units. Is D a static local constant, or is it computed or fetched at runtime in a way that could carry poisoned metadata?
Tool poisoning
Coverage gaps 15
Parts of the artifact the static analysis could not fully examine.
dynamic_metadata line 16: tool 'read-command' input schema is computed: D["read-command"]src/tools/command-tools.ts
dynamic_metadata line 34: tool 'run-command' input schema is computed: D["run-command"]src/tools/command-tools.ts
dynamic_metadata line 67: tool 'privileged-command' input schema is computed: D["privileged-command"]src/tools/command-tools.ts
dynamic_metadata line 121: tool 'signal-process' input schema is computed: D["signal-process"]src/tools/command-tools.ts
dynamic_metadata line 18: tool 'reload-config' input schema is computed: D['reload-config']src/tools/config-tools.ts
dynamic_metadata line 45: tool 'sftp-upload' input schema is computed: D["sftp-upload"]src/tools/file-tools.ts
dynamic_metadata line 85: tool 'sftp-download' input schema is computed: D["sftp-download"]src/tools/file-tools.ts
dynamic_metadata line 28: tool 'list-connections' input schema is computed: D["list-connections"]src/tools/session-tools.ts
dynamic_metadata line 55: tool 'list-sessions' input schema is computed: D["list-sessions"]src/tools/session-tools.ts
dynamic_metadata line 74: tool 'open-session' input schema is computed: D["open-session"]src/tools/session-tools.ts
dynamic_metadata line 122: tool 'close-session' input schema is computed: D["close-session"]src/tools/session-tools.ts
dynamic_metadata line 165: tool 'read-session-output' input schema is computed: D["read-session-output"]src/tools/session-tools.ts
dynamic_metadata line 219: tool 'sftp-list' input schema is computed: D['sftp-list']src/tools/transfer-tools.ts
dynamic_metadata line 269: tool 'sftp-upload-file' input schema is computed: D['sftp-upload-file']src/tools/transfer-tools.ts
dynamic_metadata line 348: tool 'sftp-download-file' input schema is computed: D['sftp-download-file']src/tools/transfer-tools.ts