console-automation-mcp-legacy

Maintenance-only compatibility package for the former Console Automation MCP runtime. It preserves the interactive console, 40-tool MCP surface, test framework, and legacy protocol integrations removed from RunBeacon 3.0.

Use RunBeacon and console-automation-mcp@3 for new durable local, SSH, Slurm, Apple-signing, or GitHub jobs. Use this package only while migrating a client that still depends on the old interactive console or protocol APIs.

Support policy

console-automation-mcp-legacy@2.0.x receives only High and Critical security fixes for six months after RunBeacon 3.0 reaches Stable. It receives no new protocols, features, compatibility work, Codex plugin releases, or lower-severity fixes.

The package can execute arbitrary local and remote commands. Keep MCP approvals enabled, use restricted accounts, prefer SSH agents or environment-backed secret references, and install optional integrations only when required. See SECURITY.md.

Related MCP server: Everything MCP Server

Installation

npm install console-automation-mcp-legacy@2

The package exposes two equivalent executables:

npx console-automation-mcp-legacy
npx mcp-console

Example MCP configuration:

{
  "mcpServers": {
    "console-automation-legacy": {
      "command": "npx",
      "args": ["-y", "console-automation-mcp-legacy@2"]
    }
  }
}

This repository does not ship the remote-job-monitor Codex plugin and cannot replace RunBeacon's lifecycle daemon, durable Runner, approval dashboard, or credential tools.

Preserved surface

The MCP server retains 40 tools in six groups:

• Session management: create, input, keys, output, streaming, waits, stop, list, and cleanup.

• Command execution: execute, error detection, resource usage, output clearing, state, and history.

• Monitoring: system/session metrics, alerts, dashboard data, and monitoring start/stop.

• Profiles: save, list, remove, and use legacy connection profiles.

• Background jobs: execute, status, output, cancel, list, progress, result, metrics, and cleanup.

• Test automation: output, exit-code, error, snapshot, comparison, and state assertions.

The source also preserves the legacy local, SSH, cloud, container, virtualization, serial, database, and remote-console protocol adapters. Most non-core adapters use optional peer dependencies; install only the peers needed by your deployment.

The complete historical tool and protocol references remain under docs.

Security defaults

• Saved profiles reject inline passwords, passphrases, tokens, and private-key contents.

• File logging is disabled by default in MCP mode and owner-only when explicitly enabled.

• Session persistence is disabled by default because recovery metadata can contain commands, paths, and environment names.

• Xen XAPI requires verified HTTPS.

• VNC challenge authentication is allowed only inside a verified TLS channel.

• Dynamic progress patterns use RE2-compatible matching and bounded input.

Do not publish credentials, host addresses, command output, or production configuration in issues. Use GitHub private vulnerability reporting for security reports.

Development

Node.js 18, 20, and 22 are covered by the maintenance CI matrix.

npm ci
npm run typecheck
npm run build
npm run test:mcp
npm run test:logger
npm run test:package
npm run test:ci

Dependency audit and CodeQL security-extended scanning are required for maintenance releases. Releases are manual; this repository has no automatic npm publication workflow.

Migration

RunBeacon 3.0 intentionally replaces interactive sessions with one durable job lifecycle:

• console_create_session and background-job polling become job_start followed by one job_wait.

• Long remote work can use the Go Runner and resume after SSH or coordinator restarts.

• The dashboard watches one task through local long polling without model turns.

• Credentials remain in OS-managed stores or SSH agents.

• Slurm, training, Apple signing, and GitHub publishing have explicit adapters and policy gates.

Pin this package to 2.0.x only for the migration window. Do not add new production dependencies on the legacy surface.

License

MIT. See LICENSE.