Auth uses ~/.ssh/config, an SSH agent, and default identity files - the
same as running `ssh host` yourself. No password argument is accepted:
credentials must never flow through MCP tool-call arguments. Unknown
host keys are rejected unless trust_unknown_host=True; prefer connecting
with `ssh host` once yourself to pin the key instead.

`hostname`/`identity_file` override the resolved address and key path
without editing ~/.ssh/config - handy for e.g. a local molecule/vagrant
instance. Only a path is passed, never key contents.

`system` and `packages` are the objects returned by inventory_host (or a
filtered subset of `packages` if you only want to check specific ones).
Uses OSV's server-side ecosystem-aware version comparison rather than
name-only matching, so results reflect the exact installed version.

Use this to get an up-to-date description, CVSS score/severity, CWE
weakness classification, and reference links for a CVE surfaced by
check_cves (or one you already know about), rather than relying on
potentially stale training data.

`area` examples: 'ssh', 'sudo', 'kernel modules', 'password policy'. If a
matching role is found in the konstruktoid.hardening GitHub repo, it is
returned too. Also returns the MITRE ATT&CK techniques (and, where
defined, the ATT&CK mitigation) that hardening this area addresses.

Only topic-area mapping is returned for CIS/DISA STIG, never fabricated
specific rule IDs (e.g. "CIS 5.2.1") - those require the licensed
benchmark text. Consult the referenced role's own docs/tags for exactly
what it covers. ATT&CK technique/mitigation IDs, by contrast, are
MITRE's own public catalog (attack.mitre.org), so they're cited directly.

Sourced live from https://github.com/konstruktoid/cce-web, the community
JSON conversion of NIST's CCE spreadsheets. Coverage of this project's
target distros is thin: only RHEL-family ('rhel6'/'rhel7'/'rhel8') and
SUSE ('SLES12-DISA-STIG'/'SLES15-DISA-STIG'/'SLES15-PCI-DSS') are
usable - Debian, Ubuntu, Alpine, and Arch have no CCE data upstream.

`target`: free text naming a platform, resolved against the export
names published by https://github.com/konstruktoid/cce-web (NIST itself
only publishes CCE as spreadsheets). For a host from inventory_host, use
'rhel<major version>' for any RHEL-family distro_id (rhel, almalinux,
rocky - CCE only tracks the upstream RHEL number) or
'SLES<major version>-DISA-STIG' for suse; Debian, Ubuntu, Alpine, and
Arch have no CCE coverage upstream at all. Call list_cce_targets to see
every published platform (also covers e.g. 'firefox', 'apache-httpd2.2',
'win2k8r2').

Pass `keyword` (matched against title/description/rationale/config
group) or `cce_id` (exact ID, e.g. 'CCE-80876-6') to filter results.
Without either, only the platform's config-group categories and entry
count are returned - dumping an entire platform (hundreds of entries)
isn't useful; narrow with a keyword first.

`system`: object from inventory_host. `cve_matches`: entries from
check_cves you want remediated (each becomes a package-upgrade task
citing the CVE). `compliance_areas`: topic hints (e.g. ["ssh", "sudo"])
- each resolved via map_compliance and, where a matching
konstruktoid.hardening role exists, referenced in the playbook's
`roles:` list instead of reimplemented. The header also cites the MITRE
ATT&CK techniques/mitigations each area addresses. Always review the
output with `ansible-playbook --check --diff` before applying.