Skip to main content
Glama
safe-ssh-mcp

safe-ssh-mcp

by Areso

get_sshd_effective_config

Collects the effective sshd configuration from a remote Linux host via SSH, showing final values after defaults, includes, and Match blocks are applied; uses passwordless sudo or doas when not root.

Instructions

Collects the effective sshd configuration (sshd -T) from a remote Linux host via SSH. Shows the final values after defaults, includes and Match blocks are applied. Requires root, since sshd -T reads the host keys: when the login user is not root, the command is run through passwordless sudo or doas (sudo -n / doas -n).

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "host": "<host>",
      "user": "<user>"
    },
    "name": "get_sshd_effective_config"
  }
}

Input Schema

NameRequiredDescriptionDefault
hostYes
portNo
userYes
timeoutNo
key_pathNo
passwordNo
accept_new_hostkeyNo

Output Schema

NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv0.1.16

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations at all, the description carries the full disclosure burden and does meaningful work: it states the root requirement, explains why (sshd -T reads host keys), and describes the escalation path (passwordless sudo -n / doas -n). The non-interactive flags imply failure if passwordless escalation is unavailable, though the description never states that failure mode or the read-only nature explicitly.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences with no filler: identity of the operation first, the meaning of 'effective' second, the privilege requirement third. Each sentence adds distinct information an agent needs.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The presence of an output schema means return values need not be described, and the privilege/escalation behavior is well covered. However, for a 7-parameter connection tool with zero schema descriptions, omitting all parameter guidance — especially key_path vs password and accept_new_hostkey — leaves a real gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All 7 parameters have 0% schema description coverage, so the description must compensate and largely does not. It never mentions port, timeout, key_path, password, or accept_new_hostkey — the last being a security-relevant trust decision an agent should understand before invoking. Only 'login user' indirectly gestures at the user parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource ('Collects the effective sshd configuration (sshd -T)'), along with the mechanism (remote Linux host via SSH). The second sentence clarifies that 'effective' means resolved values after defaults, includes and Match blocks — a distinction that separates this from a plain config-file read. An agent can tell exactly what this returns without consulting the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear implied usage: call this when you want the resolved sshd configuration rather than the raw file, since it explains what 'effective' means. It does not name alternatives or state exclusions (e.g., when to prefer reading the config file directly), so it falls short of a 5, but the context is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.