0c6c502aab
Matches the Real-Debrid-Downloader's rd-diagnostics-mcp model so the read-only
diagnostics agent is reachable over Tailscale (or any private tunnel) the same way
the downloader is, instead of requiring an SSH local-forward.
- lib/ip-allowlist.js (NEW): fail-closed IP allowlist — normalizeIp strips
::ffff:, loopback is always allowed, an empty allowlist accepts loopback ONLY
(fail-closed), exact IP + CIDR (incl. the Tailscale CGNAT range 100.64.0.0/10) +
wildcard rules. The real socket peer IP is the authority (never a forwarded header).
- remote-server.js: rejects non-allowlisted peers at connection (close 4005). Opt-in
via config.allowlist (the existing remote-control server, which passes none, is
unaffected). Loopback always passes, so local + SSH-forward use keeps working.
- Two bind modes (config diagnostics.bindMode): "local" -> 127.0.0.1 (default),
"network" -> 0.0.0.0 but ONLY when a non-empty allowlist is set (else it stays
loopback, fail-closed). The allowlist + token gate access; the tunnel
(Tailscale/WireGuard) is the confidentiality layer (transport is still plaintext ws://).
- The connection code now carries the host: mhu1_<base64url{v,h,p,t,n,fp?,s?}>. The
gateway decode is tolerant of the legacy {port,token,label} keys; connect_server
takes the host from the code (host arg is an optional override). Proven end-to-end:
the integration harness now connects with NO host arg and resolves it from the code.
- Renderer: Sichtbarkeit selector (local/network), public-host input with
suggested-host chips (os.networkInterfaces — the Tailscale IP shows up there),
allowlist textarea (network mode), and network-requires-allowlist validation.
- main.js: bindMode->host, getSuggestedRemoteHosts, host-in-code, allowlist plumbed
into startDiagnosticAgent + the diagnostics IPC (get/save/status).
- docs: rewritten for Tailscale (set the allowlist to your tailnet, put the Tailscale
IP/MagicDNS in the code address — no SSH forward needed).
This supersedes the v3.3.85 hard loopback-lock with the downloader's allowlist model.
Tests: lib/ip-allowlist (8) + remote-server allowlist wiring/loopback (2) + gateway
decode (host short-key + legacy tolerance). 393 app tests + 9 gateway tests + e2e +
host-in-code integration + adversarial all green; lint 0 errors.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| test | ||
| verify | ||
| .gitignore | ||
| agent-client.js | ||
| code.js | ||
| index.js | ||
| package-lock.json | ||
| package.json | ||
| README.md | ||
| registry.example.json | ||
| registry.js | ||
mhu-diagnostics-gateway
A standalone local stdio MCP gateway for remote, read-only diagnostics of the Multi-Hoster-Uploader app.
It is two things at once:
- an MCP server to Claude Code (stdio transport), exposing read-only diagnostic tools, and
- a plain WebSocket client to a diagnostic agent running inside the Electron app on a remote Windows server.
The operator enables "Diagnose-Zugriff" on a server, copies the connection code, and tells
Claude server <name> at <host>, code <CODE>. Claude calls connect_server(code, host) and then
the read-only diagnostic tools. After the first successful connect the server is remembered under
its label, so later you can just say connect_server(label:"prod-3") with no code.
This package is fully self-contained. It does not import anything from the parent Electron app and is not part of the app build.
Install
cd gateway
npm install
Requires Node >= 18.
Register with Claude Code (one time)
claude mcp add --transport stdio mhu-diag -- node "C:\Users\ploet\Desktop\Claude Projekte\multi-hoster-uploader\gateway\index.js"
Adjust the absolute path if you cloned the repo elsewhere.
Usage
In Claude Code, tell Claude:
server prod-3 at 127.0.0.1, code mhu1_<...>
Claude will call connect_server and then diagnostic tools such as server_health
(the one-shot "what's wrong" hub), read_log, list_errors, get_queue_state,
get_rotation_state, and so on.
Security
- Read-only. No screen access, no input injection, no writes. Only reads logs, errors, queue/history/config (redacted), rotation and system info.
- The code is a secret — it carries the auth token. Do not paste it anywhere public.
- The safe default is to reach the agent over
127.0.0.1via an SSH local port-forward or WireGuard. Seedocs/remote-diagnostics-setup.md. registry.jsonstores tokens and is git-ignored — never commit it.