Report privately through GitHub Security Advisories on this repository ("Security" tab, "Report a vulnerability"). Do not open a public issue for a vulnerability.

Expect an acknowledgement within a week.

fast-mcp-ssh hands an SSH connection to a large language model. Treat the model as an untrusted, occasionally confused caller that is nonetheless allowed to run commands you authorized it to run.

What the server does defend against:

• Command patterns matched before any SSH packet leaves the machine (deny_patterns refuse outright, confirm_patterns require a user confirmation through MCP elicitation, and a client that cannot elicit is denied).
• Host-key pinning, TOFU by default, with strict and per-host fingerprint modes.
• Path-based refusal of well-known credential files over SFTP.
• Per-host read_only, allowed_tools and rate limits.

What it does not defend against, by design:

• A determined model that wants to bypass a regex guard will succeed. Shell quoting, $IFS, base64, bash -c and shell functions defined earlier in a persistent PTY all defeat pattern matching. Guards are a speed bump against accidents, not a security boundary against an adversary. The boundary is the remote account's own permissions, read_only, and allowed_tools.
• Anything the remote account can already do. Give the server an account scoped to what the model should be able to reach.

SSH agent forwarding is not supported and will not be added. Forwarding an agent into a machine an LLM is driving lets anyone with root on that machine sign with your key for the duration of the connection.

cargo audit findings that ship knowingly are listed in deny.toml with the reason. Re-check them before each release.