Merge pull request #220 from imagewize/fix/ssh-passthrough-credential-guard

Require confirm before reading credential files via MCP

Author: jasperf

CHANGELOG.md

@@ -7,6 +7,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [5.20.1] - 2026-09-09
+
+### Security
+
+- **MCP `ssh_command` and `wp_cli` no longer auto-approve reads of credential-bearing
+  files.** `ssh_command`'s read-only allowlist (`cat`, `grep`, `head`, `tail`, ...) let
+  `cat web/wp-config.php` or `cat ~/.ssh/id_rsa` through with no `confirm: true` step,
+  because the *command* was harmless in general even though this particular argument
+  wasn't — same failure mode as [a WordPress consultant's LinkedIn post this fix was
+  prompted by](https://www.linkedin.com/posts/remkusdevries_connecting-ai-to-a-wordpress-site-now-takes-share-7503145873036685313-vCPk/)
+  describes: "once it has local file access, it can find your ssh credential... the
+  database credentials in your wp-config.php." `isReadOnlySshCommand()` now also
+  refuses when any argument matches a credential-shaped path (`wp-config.php`, `.env`,
+  `.ssh/`, `id_rsa`/`id_ed25519`/`id_ecdsa`, `*.pem`, `authorized_keys`, `.netrc`,
+  `.pgpass`, `.git-credentials`), forcing the normal confirm-after-explicit-approval
+  flow. Separately, `wp_cli`'s `isReadOnlyWpCommand()` treated `wp config get
+  DB_PASSWORD` as read-only too — `get` is a safe verb in general, but `wp config` is
+  WP-CLI's direct interface onto wp-config.php's constants, an even more direct route
+  to the same credentials. `wp config *` (any verb) now always needs `confirm: true`.
+  Neither change blocks legitimate reads or edits — it only removes the no-confirmation
+  fast path, matching how every other sensitive MCP operation already works.
+
 ## [5.20.0] - 2026-09-09
 
 ### Added

mcp-server/src/tools/sshPassthrough.ts

@@ -97,12 +97,39 @@ function tokenizeCommand(command: string): string[] {
   return tokens;
 }
 
+// Path fragments that indicate a credential-bearing file. Even a command in
+// READ_ONLY_COMMANDS (cat, grep, head, tail, ...) needs confirm: true when any
+// argument targets one of these — "cat" being harmless in general doesn't mean
+// "cat wp-config.php" or "cat ~/.ssh/id_rsa" should be auto-approved, since that
+// prints database credentials or an SSH private key straight into the response.
+const CREDENTIAL_PATH_PATTERNS: RegExp[] = [
+  /wp-config\.php$/i,
+  /(^|\/)\.env(\.|$)/,
+  /(^|\/)\.ssh(\/|$)/,
+  /(^|\/)id_rsa/,
+  /(^|\/)id_ed25519/,
+  /(^|\/)id_ecdsa/,
+  /\.pem$/i,
+  /(^|\/)authorized_keys$/,
+  /(^|\/)\.netrc$/,
+  /(^|\/)\.pgpass$/,
+  /(^|\/)\.git-credentials$/,
+];
+
+function touchesCredentialPath(tokens: string[]): boolean {
+  return tokens
+    .slice(1)
+    .some((token) => CREDENTIAL_PATH_PATTERNS.some((pattern) => pattern.test(token)));
+}
+
 export function isReadOnlySshCommand(command: string): boolean {
   const tokens = tokenizeCommand(command);
   const first = tokens[0];
   if (!first) return false;
   const base = path.basename(first);
-  return READ_ONLY_COMMANDS.has(base);
+  if (!READ_ONLY_COMMANDS.has(base)) return false;
+  if (touchesCredentialPath(tokens)) return false;
+  return true;
 }
 
 export function runSshCommand(entry: EnvEntry, command: string): Promise<SshCommandResult> {

mcp-server/src/tools/wpCli.ts

@@ -36,8 +36,18 @@ const NESTED_RESOURCE_VERBS: Record<string, Set<string>> = {
   cron: new Set(["event", "schedule"]),
 };
 
+// "wp config" is WP-CLI's dedicated interface onto wp-config.php constants —
+// DB_PASSWORD, DB_USER, AUTH_KEY salts, and whatever else a site defines there.
+// "get"/"list"/"export" all being in SAFE_READ_VERBS would otherwise let
+// "wp config get DB_PASSWORD" through with no confirmation, which is a plainer
+// path to the same credentials `cat wp-config.php` would print. Always confirm.
+const ALWAYS_CONFIRM_COMMANDS = new Set(["config"]);
+
 export function isReadOnlyWpCommand(args: string[]): boolean {
   const [command, verbOrResource, thirdToken] = args;
+  if (command !== undefined && ALWAYS_CONFIRM_COMMANDS.has(command)) {
+    return false;
+  }
   if (verbOrResource !== undefined && SAFE_READ_VERBS.has(verbOrResource)) {
     return true;
   }