{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_4fg5yekgbtr8","handle":"ssh-forensics-mcp","url":"https://wellknown.network/agents/ssh-forensics-mcp","links":{"self":"https://wellknown.network/agents/ssh-forensics-mcp/record.json","html":"https://wellknown.network/agents/ssh-forensics-mcp","markdown":"https://wellknown.network/agents/ssh-forensics-mcp/record.md","api":"https://wellknown.network/api/v1/agents/ssh-forensics-mcp","status":"https://wellknown.network/api/v1/agents/ssh-forensics-mcp/status","claim":"https://wellknown.network/agents/ssh-forensics-mcp/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/ssh-forensics-mcp/claim.json","badge":"https://wellknown.network/agents/ssh-forensics-mcp/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/ssh-forensics-mcp/history","tools":"https://wellknown.network/api/v1/agents/ssh-forensics-mcp/tools"},"ard":{"identifier":"urn:air::server:ssh-forensics-mcp","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"ssh-forensics-mcp","summary":"SSH 远程取证 MCP Server：通道原语 + 本机主动探测 + JSONL 证据链","description":"![ssh-forensics-mcp](https://socialify.git.ci/xihan123/ssh-forensics/image?description=1&forks=1&issues=1&language=1&name=1&owner=1&pulls=1&stargazers=1&theme=Auto)\n\n![Python](https://img.shields.io/badge/Python-3.10%2B-brightgreen.svg)\n[![Build and publish](https://github.com/xihan123/ssh-forensics/actions/workflows/release.yml/badge.svg)](https://github.com/xihan123/ssh-forensics/actions/workflows/release.yml)\n![Version](https://img.shields.io/github/v/release/xihan123/ssh-forensics?label=version)\n![PyPI](https://img.shields.io/pypi/v/ssh-forensics-mcp)\n\n# ssh-forensics-mcp\n\n面向已授权目标的 SSH 远程取证 MCP Server，提供「通道 + 探测 + 证据链」原语：\n\n- SSH 连接、只读命令执行、SFTP 小文件读取、证据原件下载和会话管理；\n- 本机 TCP 端口扫描（nmap 优先）与 HTTP 指纹抓取；\n- 每次调用自动写入按主机隔离的 JSONL 证据链。\n\n面板识别、部署发现、数据库识别和入侵判断等业务逻辑交给上层 Agent 的\n`remote-forensics` Skill 完成，本服务不绑定特定 MCP 客户端。完整 SOP、知识库和\n报告模板见仓库：<https://github.com/xihan123/ssh-forensics>。\n\n## 目录\n\n- [环境要求](#环境要求)\n- [安装与运行](#安装与运行)\n- [MCP 客户端配置](#mcp-客户端配置)\n- [推荐取证流程](#推荐取证流程)\n- [工具](#工具)\n- [只读守卫与安全边界](#只读守卫与安全边界)\n- [证据目录](#证据目录)\n- [本地开发与验证](#本地开发与验证)\n- [合规声明](#合规声明)\n\n## 环境要求\n\n- Python 3.10 及以上；\n- 已获授权的 Linux 服务器和可用的 SSH 凭据；\n- `uv`（推荐）或 Python/pip；\n- `nmap` 可选，未安装时自动回退到内置 TCP connect 扫描。\n\n## 安装与运行\n\n### 使用 PyPI 发布包\n\n由 MCP 客户端直接拉起 stdio 服务：\n\n```bash\nuvx ssh-forensics-mcp\n```\n\n或安装到当前环境后运行：\n\n```bash\npython -m pip install ssh-forensics-mcp\nssh-forensics-mcp\n```\n\n### 从源码运行\n\n```bash\ncd mcp-ssh-forensics\nuv run ssh-forensics-mcp\n```\n\n也可以先执行 `python -m pip install -e .`，再运行 `ssh-forensics-mcp`。\n\n## MCP 客户端配置\n\n通用 JSON 配置：\n\n```json\n{\n  \"mcpServers\": {\n    \"ssh-forensics\": {\n      \"command\": \"uvx\",\n      \"args\": [\"ssh-forensics-mcp\"]\n    }\n  }\n}\n```\n\n使用已安装命令时，将 `command` 改成 `ssh-forensics-mcp` 并删除 `args` 即可。Codex CLI：\n\n```bash\ncodex mcp add ssh-forensics -- uvx ssh-forensics-mcp\n```\n\n服务使用 MCP stdio 传输，不监听网络端口；需要通过 URL 接入的客户端应使用其本地\nstdio 适配器，而不是把该进程直接暴露到公网。\n\n## 推荐取证流程\n\n1. `ssh_connect` 建连。密码和私钥二选一；有可信基线时填写\n   `expected_host_key_fingerprint` 做固定校验。\n2. `ssh_exec` 分块运行 `ss -tunlp`、`ps auxf`、日志和配置读…","publisher":{"name":"xihan123","url":null},"homepage":"https://github.com/xihan123/ssh-forensics","repository":"https://github.com/xihan123/ssh-forensics","version":"0.1.0","license":null,"protocols":["mcp"],"tags":["ssh","forensics","mcp","incident-response","security"],"pricing":null,"endpoints":[{"url":"pypi:ssh-forensics-mcp","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":null,"attribution":{"kind":"pypi","name":"pypi","repoUrl":"pypi","summary":"pypi","version":"pypi","description":"pypi","homepageUrl":"pypi","publisherName":"pypi"}},"derived":{"capabilities":[{"slug":"dev.version-control","name":"Version Control","confidence":1,"provenance":"derived"},{"slug":"dev.ci-cd","name":"CI/CD & Deploy","confidence":0.688,"provenance":"derived"}],"categories":["dev"],"language":"en"},"observed":{"status":"unknown","statusReason":"Distributed as a package to run locally; no network endpoint to check.","lastOkAt":null,"lastProbedAt":null,"statusComputedAt":null,"reliability30d":null,"latestObservations":[],"tools":null,"package":{"name":"ssh-forensics-mcp","registry":"pypi","observedAt":"2026-11-04T01:24:52.983Z","publishedAt":"2026-09-14T05:13:16.821859Z","latestVersion":"0.1.0"},"toolSurface":null,"endpointFacts":[]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"pypi","key":"ssh-forensics-mcp","url":"https://pypi.org/project/ssh-forensics-mcp/","firstSeenAt":"2026-09-16T13:22:52.070Z","fetchedAt":"2026-11-04T01:23:32.602Z","normalizedAt":"2026-11-04T01:23:32.602Z"}]},"firstSeenAt":"2026-09-16T13:22:52.070Z","updatedAt":"2026-11-04T01:24:52.983Z"}