# Reported issues for ssh-mcp-pro

Pod holds 7 of 7 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [ssh-mcp-pro](/mcp/ssh-mcp-pro).

## Most discussed

### hardening(remote): add WebSocket lifecycle limits and standards-compliant framing

## Summary

Harden the remote agent WebSocket boundary with bounded pre-authentication lifetime, connection limits, and a maintained standards-compliant implementation.

## Background

The current minimal WebSocket implementation limits frame bytes but does not provide the breadth of protocol validation and lifecycle controls expected for an internet-facing control plane. Pre-authentication connections should not remain open indefinitely or consume unbounded resources.

## Scope

- Add an agent-

[Read the thread](https://github.com/oaslananka/ssh-mcp-pro/issues/29) · 2026-07-22 · closed · 0 comments

### test(http): cover real HTTP server authentication and session boundaries

## Summary

Add in-process tests for the actual HTTP server entrypoint and include security-relevant server wiring in meaningful coverage reporting.

## Background

Helper-level HTTP security tests are strong, but `src/server-http.ts` and `src/render-http.ts` are excluded from coverage. The real boundary combines CORS, bearer/OAuth authorization, session lifecycle, body parsing, transport setup, rate-limit headers, and graceful shutdown.

## Scope

- Create an isolated in-process HTTP test harne

[Read the thread](https://github.com/oaslananka/ssh-mcp-pro/issues/24) · 2026-07-22 · closed · 0 comments

### deps: remediate production advisories and restore a clean audit gate

## Summary

Upgrade, override, or otherwise remediate currently reported production dependency advisories so the configured audit gate passes without suppressing actionable findings.

## Background

The audit snapshot reported production-path findings in OpenTelemetry, `fast-uri`, `protobufjs`, Hono, and the Hono Node adapter. Development-only findings also exist, but runtime dependencies take priority because they block `pnpm run check` and affect published artifacts.

## Scope

- Update direct

[Read the thread](https://github.com/oaslananka/ssh-mcp-pro/issues/23) · 2026-07-22 · closed · 0 comments

### security(agent): add replay protection and monotonic validation for policy updates

## Summary

Apply nonce, freshness, and strictly monotonic version validation to signed `policy.update` envelopes on the agent.

## Background

Action requests have replay and deadline checks, but policy updates are accepted after signature validation without equivalent nonce-window, timestamp-age, or version monotonicity enforcement. A previously signed policy must not be reusable to roll an agent back.

## Scope

- Track recently accepted policy-update nonces with a bounded TTL window.
- Rejec

[Read the thread](https://github.com/oaslananka/ssh-mcp-pro/issues/22) · 2026-07-22 · closed · 0 comments

### security(http): validate the effective remote connector tool set before public binding

## Summary

Base non-loopback HTTP safety decisions on the effective exposed tool set, not only on the configured profile name.

## Background

Client-specific extra-tool environment variables can extend connector profiles. The current startup validation considers every non-`full` profile remote-safe even when extensions add tools that are outside the approved remote connector surface.

## Scope

- Introduce a canonical immutable allowlist for tools permitted on remote-safe profiles.
- Reject un

[Read the thread](https://github.com/oaslananka/ssh-mcp-pro/issues/21) · 2026-07-22 · closed · 0 comments

### security(agent): enforce tool-to-capability authorization invariants

## Summary

Enforce the canonical mapping between each remote tool and its required capability inside the agent before dispatching any action.

## Background

The control plane currently emits the expected tool/capability pair, but the agent must remain an independent authorization boundary. A controlled audit demonstrated that trusting the capability field without re-deriving it from the tool can permit an action under an unrelated enabled capability.

## Scope

- Resolve the expected capabilit

[Read the thread](https://github.com/oaslananka/ssh-mcp-pro/issues/19) · 2026-07-22 · closed · 0 comments

### security(agent): canonicalize local paths and prevent symlink boundary escapes

## Summary

Make local file and log authorization operate on canonical filesystem targets and fail closed when symlinks or path races cross policy boundaries.

## Background

The current remote-agent path policy performs lexical prefix checks before filesystem operations that may follow symlinks. A controlled audit confirmed that a lexically allowed path can resolve to a target outside the configured allowlist.

## Scope

- Canonicalize existing read targets with `realpath` before policy evaluat

[Read the thread](https://github.com/oaslananka/ssh-mcp-pro/issues/20) · 2026-07-22 · closed · 0 comments

## Most recent

The remaining reports are on [the project's issue tracker](https://github.com/oaslananka/ssh-mcp-pro/issues).