OpenAccess MCP

OpenAccess MCP - The Ultimate MCP Server for SSH, SFTP, Rsync, VPN & Remote Access

The most comprehensive MCP server for secure remote access operations - SSH execution, SFTP file transfer, rsync synchronization, SSH tunneling, VPN management, and RDP brokering with enterprise-grade security, policy enforcement, and audit logging.

🔍 What is OpenAccess MCP?

OpenAccess MCP is a Model Context Protocol (MCP) server that provides secure, policy-driven access to remote systems through SSH, SFTP, rsync, tunneling, VPNs, and RDP. It's designed for AI assistants, automation tools, and DevOps teams who need secure remote access with full audit trails.

Key Search Terms & Use Cases:

MCP for SSH - Secure SSH execution through MCP protocol
MCP for SFTP - File transfer operations via MCP
MCP for Rsync - Synchronization with policy enforcement
MCP for VPN - WireGuard and OpenVPN management
MCP for Tunneling - SSH port forwarding and tunneling
MCP for RDP - Remote desktop brokering
MCP Server for Remote Access - Complete remote access solution
Secure MCP Server - Policy-driven access control
Audit-Ready MCP - Compliance and security logging

🚀 Core Features & MCP Tools

🔐 SSH Operations (MCP Tool: `ssh.exec`)

Secure command execution with policy allowlists
RBAC enforcement and session timeboxing
Command validation and sudo control
Real-time output streaming with timeout management

📁 File Transfer (MCP Tool: `sftp.transfer`)

Secure file upload/download with checksum verification
Directory synchronization and recursive operations
Permission preservation and ownership management
Bandwidth throttling and progress monitoring

🔄 Synchronization (MCP Tool: `rsync.sync`)

Dry-run protection for destructive operations
Change ticket requirements for risky operations
Bandwidth limiting and exclude patterns
Incremental sync with conflict resolution

🌐 Tunneling (MCP Tool: `tunnel.create/close`)

Local port forwarding for service access
Remote port forwarding for reverse connections
Dynamic SOCKS proxy for flexible routing
TTL enforcement and automatic cleanup

🔒 VPN Management (MCP Tool: `vpn.wireguard/openvpn`)

WireGuard interface creation and management
OpenVPN connection handling and monitoring
Peer management and key rotation
Connection status and health checks

🖥️ RDP Brokering (MCP Tool: `rdp.launch`)

Secure RDP connection brokering
Connection URL generation with signatures
TTL management and access control
Audit logging for all connections

🏗️ Architecture & MCP Integration

┌─────────────────────────────────────────────────────────────────┐
│                    AI Assistant / Client                        │
│              (ChatGPT, Claude, Custom AI)                      │
└─────────────────────┬───────────────────────────────────────────┘
                      │ MCP Protocol (stdio/websocket)
                      ▼
┌─────────────────────────────────────────────────────────────────┐
│                 OpenAccess MCP Server                          │
│  ┌─────────────────┐  ┌─────────────────┐  ┌─────────────────┐ │
│  │   SSH Provider  │  │  SFTP Provider  │  │ Rsync Provider  │ │
│  │   (ssh.exec)    │  │ (sftp.transfer) │  │  (rsync.sync)   │ │
│  └─────────────────┘  └─────────────────┘  └─────────────────┘ │
│  ┌─────────────────┐  ┌─────────────────┐  ┌─────────────────┐ │
│  │ Tunnel Provider │  │   VPN Provider  │  │  RDP Provider   │ │
│  │(tunnel.create)  │  │ (vpn.wireguard) │  │  (rdp.launch)   │ │
│  └─────────────────┘  └─────────────────┘  └─────────────────┘ │
│  ┌─────────────────┐  ┌─────────────────┐  ┌─────────────────┐ │
│  │ Policy Engine   │  │ Audit Logger    │  │ Secret Store    │ │
│  │ (RBAC, Rules)   │  │ (Hash-chained)  │  │ (Vault/Keyring) │ │
│  └─────────────────┘  └─────────────────┘  └─────────────────┘ │
└─────────────────────┬───────────────────────────────────────────┘
                      │ Network Operations
                      ▼
┌─────────────────────────────────────────────────────────────────┐
│                Remote Systems & Infrastructure                  │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐            │
│  │ Linux/Unix  │  │   Windows   │  │   Network   │            │
│  │   Servers   │  │   Servers   │  │  Devices    │            │
│  └─────────────┘  └─────────────┘  └─────────────┘            │
└─────────────────────────────────────────────────────────────────┘

🎯 Why Choose OpenAccess MCP?

🔍 For AI Assistants & LLMs:

ChatGPT Integration - Perfect for AI-powered remote operations
Claude Integration - Secure remote access through Claude
Custom AI Tools - Build AI assistants with remote capabilities
Natural Language - Convert natural language to secure operations

🛡️ For Security Teams:

Zero Trust Architecture - No direct credential exposure
Policy Enforcement - RBAC and command allowlists
Audit Compliance - SOC2, ISO27001, and regulatory requirements
Threat Detection - Anomaly detection and alerting

⚡ For DevOps & SRE:

Infrastructure Automation - Secure CI/CD pipeline integration
Incident Response - Quick access during outages
Configuration Management - Policy-driven change control
Monitoring Integration - OpenTelemetry and observability

🏢 For Enterprises:

Compliance Ready - Audit trails and policy enforcement
Scalable Architecture - Multi-tenant and distributed deployment
Integration Friendly - REST APIs and webhook support
Professional Support - Enterprise-grade reliability

🚀 Quick Start - Get Running in 5 Minutes

Prerequisites

Python 3.12+ (Latest Python for best performance)
Docker (for demo environment)
SSH access to target systems

Installation

# Clone the repository
git clone https://github.com/keepithuman/openaccess-mcp.git
cd openaccess-mcp

# Install with development dependencies
pip install -e ".[dev]"

# Or using uv (requires manual dependency installation)
uv sync --extra dev
uv pip install PyJWT prometheus-client
uv pip install -e .

Local Development Setup

# Create virtual environment
python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

# Install in development mode
pip install -e ".[dev]"

# Test the installation
python -c "from openaccess_mcp.server import OpenAccessMCPServer; print('✅ Installation successful!')"

# Run the server
python -m openaccess_mcp serve

Start the MCP server

openaccess-mcp start --profiles ./examples/profiles

In another terminal, verify audit logs

openaccess-audit verify ./audit.jsonl

### **Docker Demo Environment**

```bash
# Start demo environment (server + SSH target)
docker compose up -d

# Test the setup
openaccess-mcp start --profiles ./examples/profiles

📖 Comprehensive Documentation

Concepts Guide - Understanding profiles, policies, and MCP tools
Quickstart Guide - Get up and running in minutes
Security Model - Threat model and security guarantees
Policy Cookbook - Common policy patterns and examples
API Reference - Complete MCP tool schemas and examples
Integration Guide - ChatGPT, Claude, and custom AI integration

🛠️ Real-World Usage Examples

Test Your Installation First

# Verify everything works
source venv/bin/activate
python -c "from openaccess_mcp.server import OpenAccessMCPServer; print('✅ Core MCP functionality ready!')"

# Run unit tests
python -m pytest tests/unit/ -v

# Run integration tests  
python -m pytest tests/integration/ -v

Profile Configuration for Production

{
  "id": "prod-web-01",
  "host": "10.10.1.15",
  "port": 22,
  "protocols": ["ssh", "sftp", "rsync", "tunnel"],
  "auth": { "type": "vault_ref", "ref": "kv/ssh/prod-web-01" },
  "policy": {
    "roles": ["ops-oncall", "neteng-sre"],
    "command_allowlist": ["^systemctl status\\b", "^journalctl\\b", "^grep\\b"],
    "deny_sudo": true,
    "require_change_ticket_for": ["rsync.delete", "tunnel.dynamic"],
    "max_session_seconds": 3600
  }
}

SSH Command Execution via MCP

# Execute a command on a remote host through MCP
result = await mcp.call_tool("ssh.exec", {
    "profile_id": "prod-web-01",
    "command": "systemctl status nginx",
    "timeout_seconds": 30
})

print(f"Command output: {result.stdout}")
print(f"Exit code: {result.exit_code}")

Secure File Transfer via MCP

# Download a file securely through MCP
result = await mcp.call_tool("sftp.transfer", {
    "profile_id": "prod-web-01",
    "direction": "get",
    "remote_path": "/var/log/nginx/access.log",
    "local_path": "./nginx-access.log"
})

print(f"Transfer successful: {result.success}")
print(f"Bytes transferred: {result.bytes_transferred}")

Safe Synchronization with MCP

# First, dry-run to see what would change
plan = await mcp.call_tool("rsync.sync", {
    "profile_id": "prod-web-01",
    "direction": "push",
    "source": "./dist/",
    "dest": "/var/www/html/",
    "delete_extras": True,
    "dry_run": True
})

print(f"Plan: {plan.plan}")

# Then apply if the plan looks correct
if plan.success and input("Apply changes? (y/N): ").lower() == 'y':
    result = await mcp.call_tool("rsync.sync", {
        "profile_id": "prod-web-01",
        "direction": "push",
        "source": "./dist/",
        "dest": "/var/www/html/",
        "delete_extras": True,
        "dry_run": False,
        "change_ticket": "CHG-12345"
    })

SSH Tunneling via MCP

# Create a local port forward through MCP
tunnel = await mcp.call_tool("tunnel.create", {
    "profile_id": "prod-web-01",
    "tunnel_type": "local",
    "listen_port": 8080,
    "target_host": "internal-service",
    "target_port": 80,
    "ttl_seconds": 3600
})

print(f"Tunnel created: {tunnel.tunnel_id}")
print(f"Local port: {tunnel.listen_port}")

🔒 Enterprise Security Features

🔐 Zero Trust Architecture

No credential exposure - Secrets resolved server-side only
Policy-based access - Every operation validated against rules
Session isolation - No shared state between operations
Audit integrity - Hash-chained logs with cryptographic signatures

🛡️ Advanced Policy Enforcement

Role-based access control (RBAC) - Granular permission management
Command allowlists - Regex-based command validation
Change ticket requirements - Approval workflow for risky operations
Time-based restrictions - Session timeboxing and TTL enforcement

📊 Compliance & Audit

SOC2 Ready - Comprehensive audit trails and controls
ISO27001 Compatible - Information security management
GDPR Compliant - Data protection and privacy controls
Regulatory Ready - HIPAA, PCI-DSS, and more

🧪 Testing & Quality Assurance

# Run all tests with coverage
pytest --cov=openaccess_mcp --cov-report=html

# Run specific test suites
pytest tests/unit/ -v                    # Unit tests
pytest tests/integration/ -v             # Integration tests
pytest tests/performance/ -v             # Performance tests

# Run with different Python versions
tox

# Security scanning
bandit -r openaccess_mcp/
safety check

📦 Deployment Options

Docker Deployment

# Build the image
docker build -t openaccess-mcp .

# Run with profiles and secrets
docker run -d \
  --name openaccess-mcp \
  -v $(pwd)/profiles:/profiles \
  -v $(pwd)/secrets:/secrets \
  -p 8080:8080 \
  openaccess-mcp start \
  --profiles /profiles \
  --secrets-dir /secrets

Kubernetes Deployment

# Deploy with Helm
helm install openaccess-mcp ./charts/openaccess-mcp \
  --set vault.addr=https://vault.example.com \
  --set otel.endpoint=http://otel-collector:4317 \
  --set ingress.enabled=true \
  --set ingress.host=openaccess-mcp.example.com

Cloud Deployment

# AWS ECS
aws ecs create-service \
  --cluster openaccess-cluster \
  --service-name openaccess-mcp \
  --task-definition openaccess-mcp:1

# Google Cloud Run
gcloud run deploy openaccess-mcp \
  --image gcr.io/PROJECT_ID/openaccess-mcp \
  --platform managed \
  --region us-central1

🤝 Contributing & Community

Development Setup

# Install pre-commit hooks
pre-commit install

# Run code quality checks
ruff check .                    # Linting
mypy openaccess_mcp/           # Type checking
black openaccess_mcp/           # Code formatting
isort openaccess_mcp/           # Import sorting

Community & Support

💬 Discussions: GitHub Discussions
🐛 Bug Reports: GitHub Issues
🔒 Security Issues: security@openaccess-mcp.dev
📖 Documentation: docs/ (comprehensive guides)
📋 Code of Conduct: CODE_OF_CONDUCT.md
🎯 Roadmap: ROADMAP.md (development plans)

📄 License & Legal

This project is licensed under the Apache License 2.0 - see the LICENSE file for details.

🆘 Support & Help

Getting Help

Security Issues: Report to security@openaccess-mcp.dev
Bug Reports: Use GitHub Issues
Discussions: Join our GitHub Discussions
Documentation: Comprehensive guides in docs/

Professional Support

Enterprise Support: Available for enterprise deployments
Training & Consulting: Custom implementation and training
Security Audits: Third-party security assessments
Compliance Help: SOC2, ISO27001, and regulatory guidance

🗺️ Development Roadmap

✅ Completed (v1.0)

Core MCP Tools - SSH, SFTP, rsync, tunneling
Policy Engine - RBAC, allowlists, change tickets
Audit System - Hash-chained logs, Ed25519 signatures
OpenTelemetry - Comprehensive observability
Security Model - Zero trust, policy enforcement

🚧 In Progress (v1.1)

VPN Management - WireGuard and OpenVPN integration
RDP Brokering - Secure remote desktop access
Web UI - Audit browsing and policy testing
Performance Optimization - High-throughput operations

🔮 Planned (v2.0+)

Fleet Operations - Multi-target execution with concurrency
Plugin System - Custom protocol providers
Advanced Analytics - ML-powered anomaly detection
Multi-Cloud Support - AWS, GCP, Azure integration

🚫 What We Don't Do - Clear Expectations

To set clear expectations and avoid confusion:

❌ Full Interactive Shells: We provide command execution, not unrestricted shell access
❌ GUI Streaming: No VNC/RDP streaming — we broker connections only
❌ Raw Credential Exposure: Secrets are resolved server-side and never exposed to clients
❌ Bypass Security Controls: All operations must pass policy enforcement
❌ Root Access: We enforce least-privilege principles
❌ Persistent Sessions: All sessions are timeboxed and audited

🌟 Star History & Community Growth

📊 Project Statistics

GitHub stars GitHub forks GitHub issues GitHub pull requests

🎯 Ready to Get Started?

OpenAccess MCP is the most comprehensive and secure MCP server for remote access operations. Whether you're building AI assistants, automating infrastructure, or securing enterprise access, we've got you covered.

Quick Links:

🚀 Quick Start - Get running in 5 minutes
📖 Documentation - Comprehensive guides and examples
🛠️ Examples - Ready-to-use configurations
🤝 Contributing - Join our community
🔒 Security - Security policy and reporting

OpenAccess MCP - Secure remote access, policy-driven, audit-ready, MCP-powered.

Built with ❤️ for the AI and DevOps communities

This server cannot be installed

security - not tested

license - not found

quality - not tested

How are these scores calculated?

remote-capable server

The server can be hosted and run remotely because it primarily relies on remote services or has no dependency on the local environment.

Enables secure remote access operations through SSH, SFTP, rsync, VPN, and tunneling with enterprise-grade policy enforcement and audit logging. Provides AI assistants with secure, policy-driven access to remote systems while maintaining comprehensive audit trails and zero-trust security.

Related MCP Servers

MCP Server Enhanced SSH
8bit-wraith
-
security
F
license
-
quality
A robust SSH server facilitating secure remote command execution with TMUX session management, multi-window support, and smart session recovery for improved AI-human interaction.
Last updated -
4
Shell MCP Server
blazickjp
A
security
A
license
A
quality
A secure server that enables AI applications to execute shell commands in specified directories, supporting multiple shell types (bash, sh, cmd, powershell) with built-in security features like directory isolation and timeout control.
Last updated -
1
10
Apache 2.0
MCP Server for FTP/SSH
vini1994
-
security
F
license
-
quality
Allows users to connect to and manipulate files on FTP, SFTP, and SSH servers directly from Cursor AI, facilitating WordPress hosting and remote server management.
Last updated -
Ubuntu MCP Server
pazuzu1w
-
security
A
license
-
quality
A secure protocol server that allows AI assistants to safely interact with Ubuntu systems through controlled file operations, command execution, package management, and system information retrieval.
Last updated -
8
MIT License

View all related MCP servers