MCP SSH Orchestrator

graph TB subgraph "Layer 1: Transport Security" STDIO_SEC[stdio Transport] CONTAINER_SEC[Container Isolation] end subgraph "Layer 2: Network Security" IP_ALLOW[IP Allowlists] HOST_KEY[Host Key Verification] DNS_VERIFY[DNS Resolution] end subgraph "Layer 3: Policy Security" DENY_DEFAULT[Deny-by-Default] PATTERN_MATCH[Pattern Matching] EXEC_LIMITS[Execution Limits] end subgraph "Layer 4: Application Security" NON_ROOT[Non-root Execution] RESOURCE_LIMITS[Resource Limits] AUDIT_LOG[Audit Logging] end STDIO_SEC --> IP_ALLOW CONTAINER_SEC --> HOST_KEY IP_ALLOW --> DENY_DEFAULT HOST_KEY --> PATTERN_MATCH DENY_DEFAULT --> NON_ROOT PATTERN_MATCH --> RESOURCE_LIMITS EXEC_LIMITS --> AUDIT_LOG