vh
1f25cdcd19
elway is a convergent deploy runner and it is good at that: 64 playbooks, sudo handled once, upload, and three tiers of idempotency. It is the wrong shape for "what is running over there", which is why this session answered every reconnaissance question with a raw `ssh host '...'` despite CLAUDE.md saying to use elway — a playbook for a read-only `docker ps` is ceremony, and each ad-hoc command is a fresh handshake and a fresh permission decision. The MCP server fills that half. It holds a persistent shell, so cwd and exported variables survive between calls and a command costs ~6 ms rather than a full connect. Measured against nh3-extdev and irv-ml1: state persisted across calls on both, including the host reached over WireGuard. CLAUDE.md now routes by intent — changing versus looking — rather than naming one tool, because the previous single-tool instruction was being ignored in practice for exactly the cases it did not fit. Registered project-scoped rather than user-scoped: this workspace is where SSH infra work happens, and a server that can open shells on the fleet should be opted into per project rather than inherited everywhere. SSH_MCP_STRICT_ALLOWLIST=1 is set in .mcp.json deliberately and documented as load-bearing. Without it the allowlist is every Host in ~/.ssh/config — 18 aliases including both backup servers, database VMs and a tenant-managed host. Verified: corviduo-dev, present in ssh_config but not in our allowlist, is refused with host_not_allowed.
12 lines
214 B
JSON
12 lines
214 B
JSON
{
|
|
"mcpServers": {
|
|
"remote-ssh": {
|
|
"command": "node",
|
|
"args": ["/home/lkraven/development/remote-ssh-mcp/dist/index.js"],
|
|
"env": {
|
|
"SSH_MCP_STRICT_ALLOWLIST": "1"
|
|
}
|
|
}
|
|
}
|
|
}
|