winrdp-mcp 0.1.3

Adds the MCP Registry ownership marker and lists winrdp-mcp on the official MCP Registry. No functional changes. See CHANGELOG.

winrdp-mcp 0.1.2

Polish release on top of the 0.1.1 security hardening.

Fixed

• SMB fast-channel probe fails fast (8s). smbprotocol defaults to a 60s connection timeout, so a box with 445 open at the TCP layer but SMB filtered (common on cloud VDS) would hang the first upload for a minute before falling back to SFTP/base64. (Found during live e2e.)
• DXT extension actually builds now. Fixed two Windows PowerShell 5.1 bugs in dxt/build.ps1: pip's stderr advisory no longer aborts the vendoring step, and the archive is written with forward-slash entry paths (Compress-Archive emitted backslashes, violating the ZIP spec and breaking the extension loader). Verified: a 23 MB self-contained .dxt.

Added

• Regression test suite (tests/test_security_fixes.py) that locks in every 0.1.1 fix so it can't silently regress in CI: the chunk-write inline invariant + non-staging routing (upload-recursion guard), argument-injection validation, provisioning omitting the weakening WinRM settings, secrets kept out of the script body, log redaction of %s args, and scrypt KDF + legacy-ciphertext migration.

Changed

• Graceful shutdown: serve / agent close cached transports on exit, and open SSH tunnels are torn down via an atexit hook.

pipx upgrade winrdp-mcp

Full details: CHANGELOG.md.

winrdp-mcp 0.1.1 — security hardening

Security & reliability hardening from a full-code audit. Recommended upgrade from 0.1.0.

No tool signatures were removed. One behavioral change: provisioning no longer enables
Basic auth / AllowUnencrypted / TrustedHosts=* (NTLM encrypts the payload without them).

Security

• Fixed a PowerShell injection in write_event (level) that ran as SYSTEM; validated file_hash.algorithm and ui_find.control_type too.
• deploy_ui_agent now binds 127.0.0.1 by default (was 0.0.0.0 with an optional auth key — an unauthenticated remote desktop-control endpoint); a non-loopback bind requires a validated auth_key.
• New-account passwords (user_create / service_create) are staged to an admin-only file and read on the box, keeping them off the target's process command line / Event 4688.
• Provisioning no longer sets Basic / AllowUnencrypted / TrustedHosts=*.
• Vault passphrase KDF is now scrypt + a persisted salt (was unsalted SHA-256); old inventories still decrypt and re-encrypt to the strong key on next save.
• Owner-only ACLs for the vault key (no open write window), the encrypted inventory, and an on-box secrets directory.
• Log redaction now scrubs the rendered message (secrets passed as %s args were leaking); model-facing error text is redacted.

Reliability

• Fixed infinite recursion in the chunked file upload over a WinRM-only box with no SMB/SSH fast channel.
• Each transport now serializes its own use (pywinrm/paramiko aren't thread-safe) — fixes the HTTP 400 cascade under concurrent same-host calls; run_on_hosts dedups aliases.
• Reconnect-retry no longer double-executes non-idempotent calls; per-call timeout is honored on WinRM.
• Session-leak fixes (SMB channel close, failed fast-channel close, port_forward SSH client + ssh_port); locked vault saves; guarded elevated-task cleanup.

Install / upgrade

pipx upgrade winrdp-mcp   # or: pipx install winrdp-mcp

Full details in CHANGELOG.md.

winrdp-mcp 0.1.0

Zero-config MCP server to provision and fully administer any Windows RDP box (Win10/11, Server 2016–2025) — for Claude & Claude Code.

Highlights

• 144 tools across 15 modules: hosts/fleet, provisioning & UAC, system, scripting, files, admin, RDP, software, network, deeper Windows management, native GUI automation, wait-for-condition helpers, scheduling/persistence, SSH tunneling, and high-level ops.
• Zero-config provisioning ladder — provision_host climbs WinRM → SSH → SMB/WMI cold-start → paste-once bootstrap.
• Real elevation — full-token over WinRM with a one-shot SYSTEM Scheduled-Task fallback; as_user runs inside the interactive RDP desktop.
• 5 MCP prompts (guided workflows) and 2 resources (inventory + live host summary).
• Tool profiles — WINRDP_PROFILE=full|admin|rdp|core.
• Safety-annotated tools (49 read-only / 23 destructive / 72 mutating).

Install

pipx install winrdp-mcp
# or: uvx winrdp-mcp serve   |   pip install winrdp-mcp

Register with Claude Code:

claude mcp add winrdp -- winrdp-mcp serve

See the README and docs/ for the full tool reference, provisioning walkthrough, and security model.