cfd5ca07ec
Repo-side hardening and tooling from the intensive test round (none of this ships in the app installer). - gateway: registry.json (holds bearer tokens) now gets a best-effort owner-only NTFS ACL on Windows via `icacls /inheritance:r /grant:r <user>:F` (the chmod 0600 is a no-op on NTFS); verified the file ends up <user>:(F) only. - gateway: connect_server now reads the app version from the real get_system_info shape (data.app.version / data.agent.version), so "connected to vX.Y.Z" works. - gateway: read_log tool description documents grep as a case-insensitive substring filter with "|" alternation (not a regex), matching the agent-side change. - gateway: standalone verification harnesses moved to gateway/verify/ (so `node --test` only sweeps real unit tests) and exposed via `npm run verify`: e2e-verify, integration-mcp (live gateway-MCP <-> agent, all 14 tools), and adversarial-probe (redaction fuzz + ReDoS + lockout). `npm test` runs the units. - eslint: gateway/** now lints as ESM (sourceType module) via a dedicated block; global ignores fixed so `eslint .` is clean across the whole project (0 errors). - docs/remote-diagnostics-setup.md: made the transport story honest — the agent speaks plaintext ws:// over enforced loopback; the SSH/WireGuard tunnel is the ONLY confidentiality layer (wss/TLS + cert-pin is a documented future mode, not active). Removed the stale "bind to a LAN/VPN IP" guidance (loopback is enforced). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| test | ||
| verify | ||
| .gitignore | ||
| agent-client.js | ||
| code.js | ||
| index.js | ||
| package-lock.json | ||
| package.json | ||
| README.md | ||
| registry.example.json | ||
| registry.js | ||
mhu-diagnostics-gateway
A standalone local stdio MCP gateway for remote, read-only diagnostics of the Multi-Hoster-Uploader app.
It is two things at once:
- an MCP server to Claude Code (stdio transport), exposing read-only diagnostic tools, and
- a plain WebSocket client to a diagnostic agent running inside the Electron app on a remote Windows server.
The operator enables "Diagnose-Zugriff" on a server, copies the connection code, and tells
Claude server <name> at <host>, code <CODE>. Claude calls connect_server(code, host) and then
the read-only diagnostic tools. After the first successful connect the server is remembered under
its label, so later you can just say connect_server(label:"prod-3") with no code.
This package is fully self-contained. It does not import anything from the parent Electron app and is not part of the app build.
Install
cd gateway
npm install
Requires Node >= 18.
Register with Claude Code (one time)
claude mcp add --transport stdio mhu-diag -- node "C:\Users\ploet\Desktop\Claude Projekte\multi-hoster-uploader\gateway\index.js"
Adjust the absolute path if you cloned the repo elsewhere.
Usage
In Claude Code, tell Claude:
server prod-3 at 127.0.0.1, code mhu1_<...>
Claude will call connect_server and then diagnostic tools such as server_health
(the one-shot "what's wrong" hub), read_log, list_errors, get_queue_state,
get_rotation_state, and so on.
Security
- Read-only. No screen access, no input injection, no writes. Only reads logs, errors, queue/history/config (redacted), rotation and system info.
- The code is a secret — it carries the auth token. Do not paste it anywhere public.
- The safe default is to reach the agent over
127.0.0.1via an SSH local port-forward or WireGuard. Seedocs/remote-diagnostics-setup.md. registry.jsonstores tokens and is git-ignored — never commit it.