ACKNOWLEDGEMENTS.md

Acknowledgements

v2 is a near-total rewrite, which means a lot of contributed work shaped the result without being merged as commits. GitHub's contributor graph only counts merged commits, so this file exists to record what that graph cannot.

Reported problems that changed the design

• @BlackBird-BB — found that credentials could only be passed as command-line flags, readable by any local user (CVE-2026-7038). Removing that was the first thing v2 did.
• @codyaverett, with @amosroger91 and @apage43 — argued the Lethal Trifecta case in #33 and listed the mitigations. The policy engine, command classification, approval flow and audit log all trace back to that thread.
• @msexxeta — reported that output vanished and that command text leaked into results (#27), and proposed replacing prompt detection with a generated marker (#46). v2's session protocol works exactly that way.
• @wbern — asked for read-only commands to be distinguishable so an agent could be trusted with them (#23). That is why there is a read-command separate from run-command.
• @jonathanbird — asked for readOnlyHint (#36), and noted that annotating exec would not be truthful. Splitting the tool was the answer to that objection.
• @sunjl17 — hit "the input device is not a TTY" (#31), now a per-call tty option.
• @veithly — could not use an encrypted private key (#25), now supported and tested.
• @deevus — asked for configuration through environment variables (#32); SSH_MCP_KEY is the variable requested.
• @Blackspell01 — reported that sudo stopped working in v2 (#91), and then kept reporting when the first fix did not clear it. That thread turned out to hold four separate defects across three releases: a quick-start profile that could never reach the privileged class, a denylist that refused last reboot for containing the word, an approval dialog where choosing Accept came back as "you declined", and --disableApproval — the workaround they were told to use — silently doing nothing. Screenshots rather than a summary are what made the second and third of those findable at all.

Merged contributions

• @nordscope-fi — made the role matrix configurable (#108, closing #95), and then went past the brief in the direction that mattered. Their own review of the work found a prototype-pollution hole in the merge before anyone else saw the branch. In review they corrected a claim in mine — a cost I had attributed to removing the tier fallback was not reachable — and produced the case that was: a partial custom role whose profiles set no group at all, silently handed production's grant with no typo anywhere to catch it. The startup validation that now refuses those configs is theirs, including the inferred-tier case neither of us had asked for.

  They then diagnosed the approval dialog on #91 from the other side of the same failure, with client logs showing the two responses 30 seconds apart. Requiring a confirm boolean on top of the protocol's own accept/decline meant clients rendered a checkbox, and choosing Accept without ticking it submitted an invalid form — so the client sent cancel and the user was told they had declined. The argument for dropping it was theirs and correct: action already carries the decision. Reading the consumer to check that claim turned up two more defects, including three CLI flags that had never done anything.

Contributed implementations

Merged in spirit rather than as commits — these pull requests were built on v1 and could not be rebased onto the rewrite, but they arrived at the same designs.

• @Isla-Liu — TOML profile configuration (#55), redacted audit logging (#56), approval modes (#58) and per-profile approval settings (#59): four of v2's core mechanisms. Also identified that a multi-profile setup with no explicit selection silently targets the first host (#54) — a bug v2 still carried until it was fixed with their co-authorship. The WebUI (#60–#63) and config hot-reload (#64) proposals remain open.
• @ta5n — Docker packaging and multi-host connection pooling (#28).
• @mario-chamuty — SFTP transfer tools (#38).
• @henrik-koren — HTTP transport for multi-host execution (#41).
• @mikusnuz — passphrase support for encrypted keys (#35).
• @burtherman — determining command success by exit code rather than stderr output (#67).
• @donejeh — default working directory (#45).
• @hamb3r and @GautamKumarOffical — keeping v1 working against moving SDK and zod releases (#37, #51).
• @glebtv and @Ghits01 — review comments on #23 and #25 pointing at simpler alternatives worth considering.