Skip to content

v3.8.2 — The sudo password stops leaking, and the server joins the official MCP Registry

Choose a tag to compare

View all tags
@bvisible bvisible released this 28 Aug 10:19
· 26 commits to main since this release
v3.8.2
0a1850c

Security

The sudo password no longer reaches the remote command line (#34).

ssh_execute_sudo and the three privileged steps of ssh_deploy built echo "<password>" | sudo -S <cmd>. For the lifetime of that echo, the password was readable in the remote process list, in /proc/<pid>/cmdline, and in any auditd trail — by every account on the host. The existing output masking never helped: it only redacted the copy sent back to the agent, never the remote-side exposure.

The password now travels on the SSH exec channel's stdin, where no other process can observe it. The command becomes sudo -S -k -p ''. The -k is not cosmetic: without it, an already-authorised sudo skips the prompt entirely and the password stays in the pipe for the command itself to read as input — sudo -S cat would have printed it.

Guarded by npm run test:sudostdin, which drives execCommand against a fake ssh2 channel to prove the password is written to stdin and absent from the command, checks every deployment step, and fails if the old pipeline reappears anywhere in src/.

No action needed — no configuration changes, no API changes.

Added

  • Listed in the official MCP Registry as io.github.bvisible/mcp-ssh-manager. That registry is what feeds MCP clients today, and the project was simply absent from it. Published from CI over GitHub OIDC, so future releases need no stored credential.
  • OpenSSF Scorecard workflow and badge — a public grade of the repository's supply-chain posture.
  • Release workflow publishing to npm with build provenance (verifiable with npm audit signatures) and attaching a CycloneDX SBOM to each release.
  • README section "Giving an agent SSH access, safely" — the per-server unrestricted / readonly / restricted modes have existed since v3.5.0 and were invisible to anyone landing on the page. The documented env syntax was verified against ConfigLoader rather than written from memory.

Fixed

  • SSHManager.execCommand accepts an stdin option, written to the exec channel and then closed. Commands passing no stdin are untouched, so interactive remote processes keep working.

Full changelog: https://github.com/bvisible/mcp-ssh-manager/blob/main/CHANGELOG.md#382---2026-08-28

Assets 2
Loading