Remote Ssh — the complete, unedited output of the deterministic mcptrustchecker engine v1.9.0, scanned . Every finding, capability tag and score component below is exactly what the engine produced — no AI, no post-processing.
{
"tool": {
"name": "mcptrustchecker",
"version": "1.9.0",
"methodologyVersion": "mcptrustchecker-1.9"
},
"target": {
"id": "@shiharu/mcp-remote-ssh",
"source": {
"kind": "package",
"origin": "@shiharu/mcp-remote-ssh"
},
"server": {
"name": "@shiharu/mcp-remote-ssh"
}
},
"grade": "A",
"score": {
"score": 92,
"threatScore": 100,
"grade": "A",
"band": "A",
"categorySubtotals": {
"injection": 0,
"exfiltration": 0,
"permissions": 0,
"supply-chain": 0,
"network": 0,
"hygiene": 0
},
"vector": [
{
"kind": "client",
"term": "capability-exposure",
"level": "high",
"label": "capability blast radius (high) — client exposure if the model is manipulated",
"appliedPenalty": 6
},
{
"kind": "client",
"term": "verification-discount",
"level": "none",
"label": "publisher verification (unlinked) — no provenance/repo link, but the shipped source was fully read",
"appliedPenalty": 2
},
{
"kind": "client",
"term": "coverage-honesty",
"level": "source",
"label": "inspection depth (source) — how much of the target the scan could see",
"appliedPenalty": 0
}
],
"gatesFired": [],
"methodologyVersion": "mcptrustchecker-1.9"
},
"capability": {
"level": "high",
"reasons": [
"ingests untrusted external content (a prompt-injection entry point)",
"reads sensitive or local data",
"has a read → egress path (a data-exfiltration surface)",
"can execute shell commands or code"
],
"tags": [
"code-exec",
"untrusted-input",
"sensitive-source"
]
},
"coverage": {
"level": "source",
"inputs": {
"toolSurface": true,
"implementationSource": true,
"packageMetadata": true,
"liveTransport": false
},
"caveats": [
"Tools were statically extracted from the published source (14 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command \"npx -y <package>\"."
]
},
"findings": [
{
"ruleId": "MTC-SRC-006",
"title": "Reads a sensitive credential path or dumps the environment (dist/src/shared/config.js)",
"category": "exfiltration",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/src/shared/config.js:21`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/src/shared/config.js"
},
"evidence": "privateKey: \"~/.ssh/id_rsa\", }, }; // ─── Cached config directory path (resolved once on first call) ───────────",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-006",
"file": "dist/src/shared/config.js",
"line": 21,
"nonRuntime": false
}
},
{
"ruleId": "MTC-CAP-001",
"title": "Tool \"exec_session_start\" exposes command/code execution",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "Tool \"exec_session_start\" appears to run shell commands or evaluate code (keyword \"exec\" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.",
"remediation": "Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.",
"location": {
"kind": "tool",
"name": "exec_session_start"
},
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"tags": [
"code-exec"
]
}
},
{
"ruleId": "MTC-CAP-001",
"title": "Tool \"exec\" exposes command/code execution",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "Tool \"exec\" appears to run shell commands or evaluate code (keyword \"exec\" in tool name, parameter \"command\"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.",
"remediation": "Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.",
"location": {
"kind": "tool",
"name": "exec"
},
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"tags": [
"code-exec"
]
}
},
{
"ruleId": "MTC-CAP-001",
"title": "Tool \"exec_session_close\" exposes command/code execution",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "Tool \"exec_session_close\" appears to run shell commands or evaluate code (keyword \"exec\" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.",
"remediation": "Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.",
"location": {
"kind": "tool",
"name": "exec_session_close"
},
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"tags": [
"code-exec"
]
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/src/gateway/transport.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/src/gateway/transport.js:102`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/src/gateway/transport.js"
},
"evidence": "sion lifecycle: start → exec (multiple) → close. \" + \"Returns session_id and initial working directory.\",",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/src/gateway/transport.js",
"line": 102,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/src/managers/exec.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/src/managers/exec.js:159`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/src/managers/exec.js"
},
"evidence": "pdated cwd. */ exec(sessionId, command, opts) { const session = this.sessions.get(sessionId); i",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/src/managers/exec.js",
"line": 159,
"nonRuntime": false
}
},
{
"ruleId": "MTC-FLOW-005",
"title": "Untrusted input can drive an external action",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "Untrusted-input tools ([sftp_download]) co-exist with external-action tools ([exec_session_start, exec, exec_session_close]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.",
"remediation": "Require confirmation for state-changing/egress actions triggered after processing untrusted content.",
"location": {
"kind": "flow",
"name": "sftp_download → exec_session_start"
},
"evidence": "untrusted [sftp_download] → sinks [exec_session_start, exec, exec_session_close]",
"owasp": "LLM06:2025 Excessive Agency",
"references": [],
"data": {
"untrusted": [
"sftp_download"
],
"sinks": [
"exec_session_start",
"exec",
"exec_session_close"
]
}
},
{
"ruleId": "MTC-CAP-007",
"title": "Unconstrained URL/host parameter \"host\" on \"sftp_download\"",
"category": "network",
"severity": "medium",
"confidence": "heuristic",
"description": "Tool \"sftp_download\" takes a URL/host parameter \"host\" with no allowlist/pattern. An outbound-request tool with an unbounded destination enables SSRF and cloud-metadata access (e.g. 169.254.169.254).",
"remediation": "Allowlist destinations or constrain the parameter; block private/link-local addresses server-side.",
"location": {
"kind": "tool",
"name": "sftp_download",
"field": "inputSchema.properties.host"
},
"owasp": "LLM06:2025 Excessive Agency",
"data": {
"param": "host"
}
},
{
"ruleId": "MTC-CAP-006",
"title": "Unconstrained command parameter \"command\" on \"exec\"",
"category": "permissions",
"severity": "medium",
"confidence": "heuristic",
"description": "Tool \"exec\" takes a command-shaped parameter \"command\" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.",
"remediation": "Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.",
"location": {
"kind": "tool",
"name": "exec",
"field": "inputSchema.properties.command"
},
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"param": "command"
}
},
{
"ruleId": "MTC-CAP-005",
"title": "Mutating tool \"exec_session_start\" declares no destructiveHint",
"category": "hygiene",
"severity": "low",
"confidence": "heuristic",
"description": "Tool \"exec_session_start\" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.",
"remediation": "Declare accurate annotations, and gate destructive tools on user confirmation regardless.",
"location": {
"kind": "tool",
"name": "exec_session_start"
},
"data": {
"tags": [
"code-exec"
]
}
},
{
"ruleId": "MTC-CAP-005",
"title": "Mutating tool \"exec\" declares no destructiveHint",
"category": "hygiene",
"severity": "low",
"confidence": "heuristic",
"description": "Tool \"exec\" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.",
"remediation": "Declare accurate annotations, and gate destructive tools on user confirmation regardless.",
"location": {
"kind": "tool",
"name": "exec"
},
"data": {
"tags": [
"code-exec"
]
}
},
{
"ruleId": "MTC-CAP-005",
"title": "Mutating tool \"exec_session_close\" declares no destructiveHint",
"category": "hygiene",
"severity": "low",
"confidence": "heuristic",
"description": "Tool \"exec_session_close\" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.",
"remediation": "Declare accurate annotations, and gate destructive tools on user confirmation regardless.",
"location": {
"kind": "tool",
"name": "exec_session_close"
},
"data": {
"tags": [
"code-exec"
]
}
},
{
"ruleId": "MTC-SUP-012",
"title": "Package has no license",
"category": "hygiene",
"severity": "info",
"confidence": "strong",
"description": "\"@shiharu/mcp-remote-ssh\" has no declared license. This is a legal/reuse concern, not a security finding.",
"location": {
"kind": "package",
"name": "@shiharu/mcp-remote-ssh"
}
},
{
"ruleId": "MTC-SUP-011",
"title": "Package declares no source repository",
"category": "supply-chain",
"severity": "info",
"confidence": "strong",
"description": "\"@shiharu/mcp-remote-ssh\" declares no repository URL, so its published artifact cannot be compared against reviewable source.",
"remediation": "Prefer packages that link to public, reviewable source.",
"location": {
"kind": "package",
"name": "@shiharu/mcp-remote-ssh"
}
}
],
"toxicFlows": [
{
"id": "flow-1",
"severity": "medium",
"confidence": "strong",
"untrustedInput": [
"sftp_download"
],
"sensitiveSource": [],
"externalSink": [
"exec_session_start",
"exec",
"exec_session_close"
],
"selfContained": false,
"description": "Untrusted input can drive an external action even though no sensitive source is exposed."
}
],
"capabilities": [
{
"tool": "host_list",
"tags": [],
"reasons": {}
},
{
"tool": "host_add",
"tags": [],
"reasons": {}
},
{
"tool": "host_remove",
"tags": [],
"reasons": {}
},
{
"tool": "exec_session_start",
"tags": [
"code-exec"
],
"reasons": {
"code-exec": [
"keyword \"exec\" in tool name"
]
}
},
{
"tool": "exec",
"tags": [
"code-exec"
],
"reasons": {
"code-exec": [
"keyword \"exec\" in tool name",
"parameter \"command\""
]
}
},
{
"tool": "exec_session_close",
"tags": [
"code-exec"
],
"reasons": {
"code-exec": [
"keyword \"exec\" in tool name"
]
}
},
{
"tool": "screen_session_start",
"tags": [],
"reasons": {}
},
{
"tool": "screen_session_write",
"tags": [],
"reasons": {}
},
{
"tool": "screen_session_read",
"tags": [],
"reasons": {}
},
{
"tool": "screen_session_resize",
"tags": [],
"reasons": {}
},
{
"tool": "screen_session_interrupt",
"tags": [],
"reasons": {}
},
{
"tool": "screen_session_close",
"tags": [],
"reasons": {}
},
{
"tool": "sftp_upload",
"tags": [],
"reasons": {}
},
{
"tool": "sftp_download",
"tags": [
"untrusted-input"
],
"reasons": {
"untrusted-input": [
"keyword \"download\""
]
}
}
],
"surfaceDigest": "8e5b5b08e341e04c4272e3a875d2987527669a4f7f8e5caced0652d585321d6e",
"stats": {
"tools": 14,
"prompts": 0,
"resources": 0,
"findingsBySeverity": {
"critical": 0,
"high": 6,
"medium": 3,
"low": 3,
"info": 2
}
}
}