remote-ssh-mcp
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@remote-ssh-mcpcheck memory, disk, and load on web1"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
remote-ssh-mcp
给 AI agent 用的远程运维工具(一个 MCP 服务)。agent 只要说出 ~/.ssh/config 里的主机别名,比如 web1,就能在那台服务器上跑命令、查容器、改配置、看服务状态,效果等同于 ssh web1 …,但不用 agent 自己拼 ssh 命令和多层引号。
能做什么
在
~/.ssh/config里配好的任意主机上跑命令,结果直接返回给 agent。读写远端文件,覆盖前自动备份到
~/ops-backups/。看服务器的内存、磁盘、负载和监听端口,查 systemd 服务和 docker 容器。
测主机能不能访问某个网址、出口 IP 是多少,调用 x-ui 面板的接口。
重启关机、装包卸包这类危险命令默认拦下,交给你手动执行。
Related MCP server: ssh-for-agents
工具一览
一共 11 个工具:
想做什么 | 工具 | 会不会改东西 |
跑任意命令 |
| 会 |
读文件 |
| 不会 |
覆盖或追加写文件 |
| 会,覆盖前自动备份 |
备份文件或目录 |
| 会,在远端生成备份 |
列出容器 |
| 不会 |
在容器里跑命令 |
| 会 |
看容器日志 |
| 不会 |
看内存、磁盘、负载、端口 |
| 不会 |
查 systemd 服务状态和日志 |
| 不会 |
测网址连通性和出口 IP |
| 不改主机,但会从主机发网络请求 |
调 x-ui 面板接口 |
| 看调的接口,可能会改面板配置 |
每个工具的完整参数用 npm run call -- --list --json 查看。工具返回的第一行是 exit= 加退出码,后面是命令输出;输出太长时只保留开头和结尾。
适用范围
适合在
~/.ssh/config里配好的 Linux 主机上排查问题、改配置。Windows 和 Termux 主机只能用
exec,其余工具都按 Linux 命令写。需要交互式终端的操作(
top、vim、要输密码的sudo)请直接开 ssh。非 root 账号的主机上,写
/etc或运行 docker 可能没有权限,工具不提供 sudo 参数。
环境要求
Node.js 20 或更新。
本机装有 OpenSSH 客户端,
~/.ssh/config里配好主机别名,并且能用密钥免密登录。远端要有工具用到的命令:docker 类工具要 docker,
http_probe和xui_api要 curl,xui_api还要 sqlite3。
安装
先在仓库里构建:
npm install && npm run build然后把下面的配置加进你的 MCP 客户端,路径换成仓库所在位置:
{
"mcpServers": {
"remote-ssh": {
"command": "node",
"args": ["/path/to/remote-ssh-mcp/dist/index.js"]
}
}
}claude mcp add remote-ssh -s user -- node /path/to/remote-ssh-mcp/dist/index.js要放开某类危险命令时加 -e,如 claude mcp add remote-ssh -s user -e SSH_MCP_ALLOW_PKG=1 -- node …。
把上面的配置加进 ~/.cursor/mcp.json。要放开某类危险命令时,在 remote-ssh 里加 "env": { "SSH_MCP_ALLOW_PKG": "1" }。
装好后可以先在仓库里试一次调用,看到的就是 agent 拿到的结果。下面的输出是示例,主机名、端口和进程已经换成通用值:
npm run call -- sys_snapshot '{"host":"web1"}'exit=0
== mem (MB)
used 471 / 973, available 501
swap used 0 / 0
== disk /
used 2.1G / 30G (8%), avail 27G
== load
03:49:36 up 10 days, 3:55, 0 user, load average: 0.00, 0.02, 0.00
== listening tcp
0.0.0.0:22 sshd
*:443 nginx
127.0.0.1:8080 app
...配置
用环境变量配置,写在客户端配置的 env 里(Claude Code 用 -e)。
环境变量 | 说明 |
| 默认不设, |
| 默认不设,拦截装包类命令:apt / apt-get / aptitude / yum / dnf / apk 的 install、remove、purge、upgrade 等,以及 |
安全
只连
~/.ssh/config里的主机别名,直接写 IP 或user@ip会被拒绝。危险命令被拦时,工具提示 agent 让你自己 ssh 上去执行。
开发
npm install
npm run build
npm test
npm run call -- --list
npm run call -- exec '{"host":"web1","cmd":"uptime"}'npm run call 用来在本地直接调用工具,运行前要先 npm run build。
许可证
MIT,详见 LICENSE。
Available Tools
11 toolsbackup_fileA
Back up a remote file or directory (tar.gz) to ~/ops-backups/-/ with a sha256 file. Use before editing via exec.
| Name | Required | Description | Default |
|---|---|---|---|
| tag | Yes | Short name, e.g. xray-chain | |
| host | Yes | ||
| path | Yes | Absolute remote path |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It usefully reveals that a tar.gz archive and sha256 file are created under a date-tag directory, but it omits important operational details such as permissions, whether existing backups are overwritten, and failure behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two tightly written sentences with no wasted text. The core operation and destination are front-loaded, followed by a concise usage note.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a three-parameter tool with no output schema, the description covers the essential purpose, destination layout, and invocation context. Minor gaps remain around host semantics and backup-overwrite behavior, but the definition is largely sufficient to call the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 67%, and the description adds some meaning by showing that tag is embedded in the backup directory name and that path refers to a remote file or directory. However, host remains unexplained in both schema and description, leaving a notable gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: backing up a remote file or directory. It also specifies the archive format (tar.gz), destination pattern, and accompanying sha256 file, making the operation distinct from sibling tools like exec or file_write.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly says to use this before editing via exec, giving a clear triggering context and naming the relevant sibling tool. It does not describe when not to use it or mention alternative backup approaches, so it falls short of full when/when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
docker_execC
Run cmd inside a container with sh -c; write it as you would inside the container, the tool does the quoting.
| Name | Required | Description | Default |
|---|---|---|---|
| cmd | Yes | ||
| host | Yes | ||
| timeout | No | Seconds, default 60 | |
| container | Yes | Container name or id | |
| max_chars | No | Per-stream output cap, default 8000 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It usefully discloses shell wrapping and automatic quoting, but omits permissions/security implications, container-running preconditions, output truncation behavior, timeout behavior, and mutation side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One front-loaded sentence with no wasted words. The execution mechanism and quoting behavior are stated efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an arbitrary container command-execution tool with no annotations and no output schema, the description is too sparse. It should at least clarify host/container targeting, timeout/output-cap behavior, and the fact that commands may mutate container state.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Adds useful meaning for `cmd` by explaining it is shell text and that the tool handles quoting. However, schema coverage is only 60%, and `host` is undocumented in both schema and description; timeout and max_chars are also not addressed in the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: running a command inside a container via `sh -c`. This clearly separates it from docker_ps/docker_logs, though it does not explicitly distinguish it from the sibling `exec` tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explains how to phrase the command but not when to use this tool instead of `exec` or other command-running siblings. No preconditions, exclusions, or alternative-selection guidance are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
docker_logsC
Tail a container's logs (stdout and stderr merged).
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | ||
| tail | No | ||
| since | No | e.g. 30m, 2h, 2026-10-26T10:00 | |
| container | Yes | Container name or id | |
| max_chars | No | Per-stream output cap, default 8000 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It usefully states that stdout and stderr are merged, but it does not disclose whether the call streams/follows, blocks, requires Docker permissions, is read-only, or how output is capped.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no wasted words. Its brevity is efficient, though it is arguably too sparse for a tool with five parameters.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a five-parameter tool with no annotations and no output schema, the description is incomplete. It does not explain return behavior, whether logs are followed, permission requirements, or the roles of the remaining parameters.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds no parameter meaning beyond the schema. With only 60% schema description coverage, important parameters such as host and tail are undocumented in both the schema and the description, and the description does not compensate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Tail') and resource ('container's logs') and clarifies that stdout and stderr are merged. It does not differentiate this from sibling tools such as docker_exec or exec, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool instead of docker_exec, exec, or other siblings, nor are prerequisites or exclusions mentioned. The intended use is only implied by the word 'Tail'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
docker_psC
List containers on a host as name, image, status (tab separated).
| Name | Required | Description | Default |
|---|---|---|---|
| all | No | Include stopped containers | |
| host | Yes | ||
| filter | No | Case-insensitive regex on the line |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It discloses the tab-separated output format, but does not mention permissions, read-only nature, error behavior, or how host connectivity is handled.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence that states the action, resource, and output shape with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only listing tool, the description covers the output columns but leaves the required host parameter ambiguous and does not explain defaults or filtering behavior. It is minimally adequate but misses important context for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 67%, but the required 'host' parameter has no description in either the schema or the description. The description adds output formatting but does not clarify what 'host' expects, nor does it explain how 'filter' interacts with the returned line format.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('List containers on a host') and specifies the returned fields. It is clear what the tool does, though it does not explicitly differentiate itself from siblings like docker_logs or docker_exec.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives such as docker_logs or docker_exec. The default behavior of including stopped containers is only visible in the schema, not explained in usage terms.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
execB
Run a shell command on a host, same as ssh <host> '<cmd>'; write cmd without the outer quotes. Prefer a dedicated tool when one fits. Hosts:
| Name | Required | Description | Default |
|---|---|---|---|
| cmd | Yes | ||
| host | Yes | ||
| timeout | No | Seconds, default 60 | |
| max_chars | No | Per-stream output cap, default 8000 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the full behavioral disclosure burden. It says this is equivalent to SSH and explains command quoting, but it does not disclose permissions, destructive potential, side effects, authentication requirements, or output behavior for an arbitrary remote shell execution tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short and front-loads the key invocation model, which is good. However, the trailing incomplete fragment 'Hosts: ' is a structural defect that wastes space and leaves promised host information missing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a high-risk arbitrary command execution tool with no annotations and no output schema, so the description should be more complete. It omits safety implications, host list details, permissions context, and output behavior, leaving the agent without enough information to invoke it confidently in a multi-tool environment.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50%, so the description needs to compensate for the undocumented `host` and `cmd` parameters. It partially does so by mapping them to the SSH analogy and specifying that `cmd` should be written without outer quotes, but the host enumeration is truncated at 'Hosts: ' and `timeout`/`max_chars` are left entirely to the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Run a shell command on a host,' and clarifies the execution model with the `ssh <host> '<cmd>'` analogy. It hints at sibling alternatives with 'Prefer a dedicated tool when one fits,' but does not name any sibling tool, so differentiation is only partial.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives a minimal usage rule: prefer a dedicated tool when one fits, implying `exec` is the fallback for arbitrary shell commands. However, it does not name which siblings fit which cases, nor does it state when-not to use this tool beyond that vague preference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
file_readC
Read a remote text file, optionally a line range.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | ||
| path | Yes | Absolute remote path | |
| lines | No | Line count from start_line | |
| max_chars | No | Per-stream output cap, default 8000 | |
| start_line | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, yet it discloses only that the target must be a text file. It says nothing about truncation behavior, the max_chars cap, permission/error behavior, or what happens when the file is large or binary.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler. It is efficient, though the terseness pushes detail burdens onto other dimensions rather than being a structure flaw.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 5-parameter remote-read tool with no annotations and no output schema, the description omits return shape, truncation signaling, and binary/encoding handling. An agent can guess how to call it but not what to expect back.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 60%, and 'optionally a line range' loosely maps to start_line/lines, but the interaction between lines and start_line is not explained. The host and max_chars parameters get no added meaning from the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Read a remote text file') and scopes it to text files with an optional line range. It is easy to distinguish from the sibling file_write, but the description never names or contrasts with any sibling explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this versus alternatives such as exec or http_probe for retrieving content, and no prerequisites (host reachability, auth) are stated. Usage is only implied by the verb.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
file_writeA
Write content to a remote file verbatim (no escaping). overwrite first backs up the old file to ~/ops-backups/-auto/, then replaces it atomically, keeping mode and owner; append adds to the end.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | ||
| mode | No | overwrite | |
| path | Yes | Absolute remote path | |
| backup | No | Back up before overwrite | |
| content | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does most of it well: it discloses the backup location (~/ops-backups/<date>-auto/), atomic replacement, preserved mode and owner, and that append appends rather than replaces. Missing are prerequisite/privilege requirements on the remote host and failure behavior — the main remaining gaps for an unannotated mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single dense sentence with the core write guarantee front-loaded, followed by the mode-specific behavior. No filler, and each clause adds operational information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a five-parameter mutation tool with no annotations and no output schema, the description covers the risky parts (backup, atomicity, permissions preservation) well. It stops short of explaining the host parameter and error/return behavior, which an agent would still need to guess at.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 40%, so the description must compensate. It does explain mode values and the backup-before-overwrite behavior, and clarifies that content is written without escaping, but it says nothing about the 'host' parameter (SSH target? inventory name?) or path semantics, leaving two undocumented params unaccounted for.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Write content to a remote file') plus a distinctive behavioral qualifier ('verbatim, no escaping') that separates it from shell-based alternatives like exec. An agent can tell immediately this is a direct remote file writer.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implicitly tells you to pick overwrite vs append, and the existence of file_read and backup_file siblings implies the read/backup split. But it never states when to prefer this over exec or whether it should be used for new files, so usage is only implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
http_probeA
From a host, fetch a URL (optionally via a proxy) and report HTTP code, time and the egress IP.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | ||
| host | Yes | ||
| proxy | No | curl -x value, e.g. http://127.0.0.1:10809 or socks5h://127.0.0.1:1080 | |
| timeout | No | ||
| egress_ip | No | Also look up the egress IP via api.ipify.org |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It does disclose the returned payload and that the probe performs an outbound call (egress IP lookup), which hints at an external dependency, but it says nothing about request method, redirect handling, failure/timeout behavior, or what privileges the 'host' requires.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, zero filler, with the host scope and the proxy option front-loaded and the outputs listed last. Nothing repeats the title and nothing could be cut without losing information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With five parameters, no annotations, and no output schema, the description should be doing more work. It summarizes the return values, which is helpful, but omits error behavior, request method, and what the timeout actually bounds, so an agent cannot fully predict what a call will do or return in edge cases.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 40%: proxy and egress_ip are already documented in the schema, and the description only restates them ('optionally via a proxy', 'report ... the egress IP'). It does add one useful semantic — that 'host' is the machine the fetch originates from — but leaves url format and the timeout parameter (default 15, max 120) entirely to the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description pairs a specific verb (fetch) with a specific resource (a URL) and a scoping qualifier ('from a host'), then names the outputs. That is far more precise than a generic 'run command', though it never explicitly contrasts itself with the sibling exec tool, which could also perform an HTTP fetch.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: 'from a host' and 'via a proxy' suggest remote connectivity testing, so an agent can infer this is the structured probe rather than a shell command. There is no explicit when-to-use, no when-not-to-use, and no named alternative among exec/docker_exec/xui_api.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
service_statusC
systemd unit state (load/active/enabled) plus its recent journal lines.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | ||
| unit | Yes | ||
| lines | No | Journal lines, 0 for none | |
| since | No | journalctl --since, e.g. "2 hours ago" |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose the return payload (state fields plus journal lines), which is valuable since there is no output schema. However it says nothing about read-only semantics, required privileges, whether the host must be reachable, or behavior when the unit is missing or the journal is empty.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact sentence with no filler; the returned data is front-loaded. It is perhaps overly terse given the missing guidance, but nothing in it is wasteful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 4-parameter remote-execution tool with no annotations and no output schema, the description should clarify host addressing, privilege requirements, and unit naming. It provides only a one-line summary of what comes back, leaving the agent to guess how to construct a valid call.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only half the schema has descriptions (`lines` and `since`), while `host` and `unit` are bare. The description does not clarify what `host` accepts (hostname vs. SSH target vs. localhost) or that `unit` expects a systemd unit name like `nginx.service`, so it fails to compensate for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific resource (a systemd unit) and the exact data returned (load/active/enabled state plus recent journal lines). That is enough to separate it from siblings such as docker_logs or exec. It lacks an explicit verb and never names the sibling it substitutes for, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no statement of when to use this versus exec or docker_logs, no prerequisites such as SSH access or sudo, and no exclusions. The agent must infer usage entirely from the tool name and required parameters.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sys_snapshotC
Memory, root disk, load and listening TCP ports of a Linux host in one call.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It implies a read-only metrics collection, but says nothing about how the 'host' is reached (SSH? agent? credentials?), whether it requires the host to be reachable, or what happens on failure — significant omissions for a remote-host tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One dense sentence with zero filler; the enumerated metrics are front-loaded and the scope ('of a Linux host', 'in one call') is clear. It is appropriately sized for a single-parameter tool, though it could spend one more clause on the host parameter.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter, no-output-schema tool, the enumeration of returned metric categories does double duty as a return-value summary, which is genuinely useful. However, the ambiguity about the host parameter's format and connection semantics leaves a real gap for an agent trying to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single required parameter 'host' has 0% schema description coverage and the description never clarifies its expected format (hostname, IP, user@host, SSH alias). With the only parameter undocumented in both schema and prose, the agent is left guessing at the most important input.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the exact resource set (memory, root disk, load, listening TCP ports) scoped to a Linux host, which is specific enough that an agent can tell it apart from siblings like service_status or http_probe. It lacks an explicit verb ('gathers'/'reads'), so the operation is implied rather than stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to call this versus alternatives such as exec or service_status. The phrase 'in one call' hints at consolidation value but never names a competing tool or exclusion, so the agent must infer usage from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
xui_apiB
Call the host's x-ui/3x-ui panel API with its Bearer token injected on the remote side (panel address read from x-ui.db). path is relative to the panel base path, e.g. "panel/api/server/status", "panel/api/inbounds/list".
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON request body | |
| host | Yes | ||
| path | Yes | ||
| method | No | GET | |
| max_chars | No | Per-stream output cap, default 8000 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose meaningful behavior: the Bearer token is injected server-side and the panel address is read from x-ui.db, so the agent does not need to supply credentials. However, it says nothing about the consequences of POST/PUT/DELETE on a live panel, whether changes are applied immediately, or how errors and truncation (max_chars) surface in the response.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence plus inline examples, front-loaded with the core action and the auth/address-resolution detail. Nothing is wasted, though the parenthetical about x-ui.db slightly interrupts the flow before the path examples.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a five-parameter tool with no annotations, no output schema, and write-capable methods, the description covers the auth/resolution mechanics but omits return-shape expectations, what max_chars truncation looks like, and error behavior. It is adequate to start an invocation but not to predict outcomes safely.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 40% (host, path, and method are undocumented in the schema), so the description needs to compensate. It clarifies that path is relative to the panel base path and supplies two examples, but leaves host's accepted format, method's semantics, and body expectations to inference — partial compensation only.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (call) and resource (the host's x-ui/3x-ui panel API), and gives two concrete path examples that make the target unambiguous. It implicitly separates itself from the generic http_probe sibling by handling auth and resolving the panel address from x-ui.db, though it never names http_probe explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied: reach for this when you need the x-ui panel API rather than a raw HTTP probe, since tokens and panel address are handled for you. There is no explicit when-to-use/when-not statement, no mention of prerequisites (a running x-ui instance, a configured panel base path), and no guidance on choosing between this and http_probe.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
11 tool updates
v0.1.0- First observed
backup_file - First observed
docker_exec - First observed
docker_logs - First observed
docker_ps - First observed
exec - First observed
file_read - First observed
file_write - First observed
http_probe - First observed
service_status - First observed
sys_snapshot - First observed
xui_api
TDQS
Scored across 11 tools
Each dedicated tool has a clearly bounded purpose (docker_ps vs docker_logs vs docker_exec, sys_snapshot vs service_status vs http_probe), and exec explicitly instructs the agent to prefer a specialized tool. Minor overlaps remain: exec can do anything its peers do, docker_exec mirrors exec semantics on a container, and backup_file duplicates the automatic backup that file_write already performs on overwrite.
The dominant pattern is domain_action (file_read, file_write, docker_ps, docker_exec, docker_logs, http_probe, xui_api), which reads predictably and groups related tools by prefix. Deviations are small but real: exec is a bare verb, and backup_file inverts the order (verb_resource) relative to the rest.
Eleven tools is squarely in the well-scoped band for a remote-ops server, and each one maps to a recurring day-to-day task rather than a redundant variation. The broad exec escape hatch keeps the specialized set from needing to grow further.
Read/write/backup for files, container inspection and exec, system and service diagnostics, egress probing, and panel API access cover the core remote-ops lifecycle with no dead ends. Gaps are minor: no directory listing, file copy/move, or container lifecycle controls (restart/stop), all of which must fall back to exec.
Maintenance
Related MCP Connectors
Operate Linux, macOS and Windows from your LLM. Every action runs through an auditable allowlist.
Work on your own computers from Claude or ChatGPT: run commands, edit and search files.
Linux VMs for AI agents: create VMs, run commands, edit files and open preview URLs.
- emisarOAuthdev.emisar
Let AI operate servers without SSH. Choose actions, approve risky changes, and audit every step.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceEnables AI coding agents to securely execute shell commands on remote SSH servers with granular per-host permission controls. Automatically discovers hosts from ~/.ssh/config and exposes dedicated tools for each allowed host to ensure proper authorization before remote execution.1,420 npmApache 2.0
- AlicenseAqualityDmaintenanceEnables AI agents to execute SSH commands, read files, and list directories on remote hosts with a configurable command-safety policy.5MIT
- AlicenseNot gradedqualityCmaintenanceEnables AI agents to manage remote servers via SSH, including command execution, multi-host batch operations, SFTP file transfer, background job handling, DevOps diagnostics, port tunneling, and safety guardrails like high-risk command blocking and read-only mode.MIT
- AlicenseAqualityBmaintenanceEnables AI agents to securely connect to and manage remote servers via SSH, with tools for running commands, file operations, log inspection, service management, and system monitoring under configurable access controls and audit logging.1211 npm1MIT