servidor-mcp
This MCP server lets an AI work on your remote Linux servers over SSH (via already-open sessions), with six tools:
List servers (
listar_servidores): show registered servers and whether their SSH session is open.Run commands (
ejecutar_comando): execute any non-interactive shell command on a server and get exit code, stdout and stderr (with optional timeout). Not for interactive prompts, passwords or editors.Check system health (
estado_sistema): uptime/load, memory, disk, top processes, failed systemd services and Docker containers.View logs (
ver_logs): last N lines from a systemd service, a Docker container, a log file, or the whole journal, with optional time range (desde) and grep-style filter.Read files (
leer_archivo): first or last N lines of a text file on the server.Write files (
escribir_archivo): create or replace a text file, with an automatic.bak.<date>backup if it exists (no sudo; only paths the SSH user can write).
All calls are shown to you and recorded in the audit log, and access ends immediately when you close the session (srv-mcp off).
Provides Docker visibility on remote servers through system status and container log inspection, allowing AI agents to check Docker containers and logs alongside other server state.
Enables AI agents to work on remote Linux servers over SSH, providing tools for system status, service and system logs, file reading/writing, and shell command execution.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@servidor-mcprevisa el estado del servidor dev y dime si hay servicios caídos"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
server-mcp
English | Español
Renamed from
servidor-mcp. If you installed the old plugin, remove it and install the new one:claude plugin uninstall servidor-mcp@servidor-mcp,claude plugin marketplace remove servidor-mcp, then follow Install. Your servers, sessions and~/.srv-mcp/config.tomlkeep working as they are.
MCP server that lets AIs (Claude Code, Claude Desktop, Cursor, VS Code…) work on your Linux servers over SSH, without giving them your password and without installing anything on the server.
You: srv-mcp on dev → type your password → SSH session open (8h)
AI: run_command(...) → uses that open session, no password
You: srv-mcp off dev → the AI loses access immediatelyTools the AI gets
Tool | What it does |
| Registered servers and whether their session is open |
| Load, memory, disk, top processes, failed services, Docker |
| journalctl for a service, |
| First or last N lines of a file |
| Creates/replaces a file, with an automatic |
| Any (non-interactive) shell command |
Every call shows up in your AI client with the exact command, and is recorded in the
audit log ~/.srv-mcp/logs/<server>.log (srv-mcp log <server>).
Related MCP server: ssh-pro-mcp
Before you start (done by the server admin)
Create a separate SSH user for each person on each server (don't share users: that way the audit log and permissions belong to each person, and one can be revoked without affecting the others).
Optional, so they can read service logs (
journalctl), on each server:sudo usermod -aG systemd-journal <user>
Step-by-step guide (each person, on their Mac or Linux)
Requirements: Python 3.11+, OpenSSH and git. The commands work from any folder.
1. Install
Option A: Claude Code plugin (recommended). Inside Claude Code:
/plugin install server-mcp --marketplace Daniel-Riv/server-mcpOn versions before 2.1.275, in two steps:
/plugin marketplace add Daniel-Riv/server-mcp and then
/plugin install server-mcp@server-mcp.
Or from the terminal (also works if you use the desktop app):
claude plugin marketplace add Daniel-Riv/server-mcpclaude plugin install server-mcp@server-mcpOpen a new session: on start, the plugin sets up Python by itself (a few seconds the
first time). To have the srv-mcp command in your terminal, create the shortcut once:
mkdir -p ~/bin && ln -sf ~/.claude/plugins/data/server-mcp-server-mcp/srv-mcp ~/bin/srv-mcp(if ~/bin is not in your PATH: echo 'export PATH="$HOME/bin:$PATH"' >> ~/.zshrc).
The command in Claude is /server-mcp:access-server. Update it with
/plugin update server-mcp.
Option B: clone the repo (no plugins, or to use the MCP with other AIs):
git clone https://github.com/Daniel-Riv/server-mcp.git ~/server-mcp && ~/server-mcp/install.shThe installer creates .venv with the dependencies, puts the srv-mcp command in ~/bin
(and adds it to PATH) and installs the skill as /access-server.
Don't use both options at once (you'd get the skill twice). Open a new terminal
when it finishes. Check with srv-mcp: it should print the help.
2. Register each server
srv-mcp setupIt asks these questions (type the answer and press Enter):
Question | What to answer |
Short name | An alias without spaces, e.g. |
IP or domain | The server's address |
SSH user | Your user on that server |
SSH port | Enter if it is 22 |
Do you reach it through another server? | Enter if you connect directly from your machine. If you first have to log into another server, type that server's alias (it must be registered first) |
Read-only? |
|
Example with a main server and two internal machines (dev and prod) reached through it:
Your Mac ──▶ main (public IP) ──▶ dev (internal IP)
└──▶ prod (internal IP)Server | IP | Through another? | Read-only? |
| public IP | Enter (direct) |
|
| internal IP |
|
|
| internal IP |
|
|
Register the main one first, then the others. Check with srv-mcp list.
3. Open the session
srv-mcp on devThe first time it asks
Are you sure you want to continue connecting (yes/no)?→yes.It asks for your password. Nothing shows while you type it, that's normal; Enter at the end.
If the server goes through another one, it first asks for that one's password (if it wasn't open).
The session lasts 8 hours.
srv-mcp statusshows which ones are open (●).
Check that it works without asking for a password:
srv-mcp run dev "hostname && uptime"4. Use it with Claude Code
In a new Claude session:
/server-mcp:access-server check the status of dev(With option B the command is /access-server.) Claude only touches servers when you
type that command. It shows you each command before running it and asks before any
change. When you are done:
srv-mcp log dev # what the AI ran
srv-mcp off dev # cut accessUpdate
Plugin: /plugin update server-mcp. Option B:
cd ~/server-mcp && git pull && ./install.shWhere can you connect from?
srv-mcp reaches any server your machine can reach over SSH: if ssh user@ip works
from your computer, srv-mcp works too. Nothing is installed on the server.
Server situation | What you need | What to enter in |
Public IP (VPS, cloud, server with its own IP) | Nothing else | The public IP; "through another": Enter |
Private IP, but there is a server with a public IP on that network | Register that entry server first | The private IP; "through another": the entry server's alias |
Private IP, no entry server | A VPN into that network (company VPN, WireGuard, Tailscale) | With the VPN connected, the private or VPN IP; "through another": Enter |
Same network (office, same Wi-Fi) | Nothing else | The private IP; "through another": Enter |
If it doesn't connect, check: the firewall or cloud "security group" allows the SSH port from your IP; the port (if not 22); and that your user exists and can log in.
Servers on Tailscale: install Tailscale on your computer, join the same tailnet (or
have the owner share the server with you), and find the server's address with
tailscale status (100.x.y.z or its MagicDNS name). Use that address in srv-mcp setup
with "through another": Enter. Tailscale must be connected while you use it. If the
server uses Tailscale SSH, srv-mcp on won't ask for a password.
sudo
sudo with a password doesn't work through the AI (it's not interactive, and the AI never
sees your password). Two options:
You run it yourself (safest). The AI gives you the command and you run it in your terminal with
ssh -t, which reuses the open session; onlysudoasks for your password:ssh -t dev "sudo systemctl restart nginx"NOPASSWDfor specific commands, configured by the admin on the server (sudo visudo -f /etc/sudoers.d/<user>):<user> ALL=(root) NOPASSWD: /usr/bin/systemctl restart nginx, /usr/bin/docker psDon't add editors or pagers (
vim,less), interpreters (bash,python), commands that copy or write files (cp,tee) or broad wildcards (systemctl *): they allow getting a root shell or overwriting any file.
Common problems
Symptom | Cause and fix |
| The terminal was opened before installing. Open a new one (or use |
| The session isn't open or expired: |
| That alias doesn't exist; check |
| It is waiting for your answer: type it in the terminal and press Enter. |
| Your user is not in the |
The AI says "is in 'read-only' mode" | That server is read-only; change it in |
The command doesn't show up in Claude | Open a new session. Plugin: check it is enabled in |
| Plugin: open a new session so it sets itself up (needs Python 3.11+). Option B: run |
| See sudo. |
Other AIs (Claude Desktop, Cursor…): MCP server
The skill uses srv-mcp run/health/logs/read/write, with the same rules and audit log as
the MCP server. If you'd rather Claude Code use it without /, install with
./install.sh --mcp.
For other clients, the server command is the absolute path to .venv/bin/server-mcp.
In the client's MCP config file:
{
"mcpServers": {
"server-mcp": { "command": "/path/to/server-mcp/.venv/bin/server-mcp" }
}
}Claude Desktop:
~/Library/Application Support/Claude/claude_desktop_config.jsonCursor:
~/.cursor/mcp.json
Command reference
srv-mcp setup # register a server
srv-mcp list # registered servers
srv-mcp on <server> # open session (asks for password)
srv-mcp status # which sessions are open
srv-mcp log <server> # what the AIs ran
srv-mcp off <server> # close session
srv-mcp run <server> "command" # run by hand with the same rulesTo remove a server, delete its block (# srv-mcp: <alias> … # srv-mcp: end <alias>)
from ~/.ssh/config and its section in ~/.srv-mcp/config.toml, if any.
Permissions (~/.srv-mcp/config.toml)
Everything is allowed by default. Each user changes it in their own file (see config.example.toml):
mode = "read-only" # "full" (default) or "read-only"
blocked = ['\breboot\b', 'rm -rf'] # regexes that are always rejected
timeout = 120 # seconds per command
[servers."prod"] # per-server settings (setup creates it if you choose read-only)
mode = "read-only"
blocked = ['virsh destroy']Changes apply on the next call; nothing needs restarting. Config files from versions
≤ 0.2 (in Spanish: modo = "lectura", [servidores."prod"], bloqueados) still work.
"read-only" mode rejects commands that look like they modify the server (rm, mv,
systemctl restart, apt install, docker stop/rm/down, > redirects…). It is a
safety net against AI mistakes, not a security boundary. The real boundary is the SSH
user: for truly restricted access, create a user without sudo on the server and register
it with srv-mcp setup.
Security
Only you type the password, in your terminal; a local socket stays in
~/.ssh/cm/that only your user on the Mac can use.Only servers registered with
srv-mcp setupare accepted.While the session is open, the AI can do anything your SSH user can do. Close it with
srv-mcp offwhen you're done.sudowith a password doesn't work (not interactive). See sudo.
Development
.venv/bin/pip install -e ".[dev]" && .venv/bin/pytestThe tests use a fake ssh (tests/fake_ssh) that runs commands locally.
Available Tools
6 toolsejecutar_comandoADestructive
Ejecuta un comando de shell en el servidor y devuelve código de salida, stdout y stderr.
No es interactivo: comandos que piden datos (contraseñas, confirmaciones, editores) fallan o se cancelan al agotar el tiempo. Usa flags como -y o --no-pager.
| Name | Required | Description | Default |
|---|---|---|---|
| comando | Yes | ||
| servidor | Yes | ||
| timeout_segundos | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and openWorldHint=true, so the risk profile is known. The description adds genuinely non-obvious behavior: it will hang or fail on any prompt for input and hit the timeout. It still doesn't mention privilege level of the remote shell or that output of destructive commands is unrecoverable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose and return values, then a short second paragraph for the non-interactive caveat. Two sentences plus one, every one earning its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values are covered structurally. But for a destructive open-world tool with 0% parameter coverage, the description leaves meaningful gaps: the timeout parameter is unexplained and there is no signal about the privileges the remote command runs with.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% — none of the three parameters is documented anywhere. The description only obliquely references 'el servidor' and says nothing about timeout_segundos, which is exactly the parameter most relevant to the timeout behavior it describes. Given the coverage gap, the description needed to compensate and does not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Ejecuta un comando de shell en el servidor") and even names the return payload (exit code, stdout, stderr). It never positions itself against the more specific siblings (leer_archivo, ver_logs, estado_sistema), so the agent must infer that this is the generic escape hatch.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives operational guidance (must be non-interactive, use -y/--no-pager) but no selection guidance: nothing says when to prefer this over escribir_archivo or ver_logs, or when it should be avoided. Usage is implied rather than directed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
escribir_archivoADestructive
Crea o reemplaza un archivo de texto en el servidor.
Si el archivo existe y respaldo=True, primero lo copia a .bak.. No usa sudo: solo funciona en rutas donde el usuario SSH puede escribir.
| Name | Required | Description | Default |
|---|---|---|---|
| ruta | Yes | ||
| respaldo | No | ||
| servidor | Yes | ||
| contenido | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already flag destructiveHint=true, readOnlyHint=false and openWorldHint=true, so the safety profile is known. The description adds real context beyond that: existing files are replaced, a backup named '<ruta>.bak.<fecha>' is made when respaldo=True, and writes require SSH-user permissions because sudo is not used. It does not explicitly warn that respaldo=False makes the overwrite irreversible.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short lines, front-loaded with the core action, followed by the backup condition and the permission constraint. No filler sentences; each line adds operational information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive file-write tool with annotations and an output schema present, the description covers the key operational facts: overwrite semantics, backup behavior, and permission requirements. The main gaps are the meaning/format of 'servidor' and any encoding or size notes for 'contenido'.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry parameter meaning. It does well for 'respaldo' (default true, backup naming convention) and implies 'ruta' is the target path, but 'servidor' and 'contenido' are left unexplained in both schema and description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Crea o reemplaza un archivo de texto en el servidor.' That clearly distinguishes it from the read-oriented siblings like leer_archivo and listar_servidores. It stops short of naming a sibling or clarifying boundaries against ejecutar_comando, which could also write files.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The conditional 'Si el archivo existe y respaldo=True' gives a concrete behavioral rule for the backup path, and the sudo note implies a permission prerequisite. But there is no explicit when-to-use vs. alternatives guidance, such as when to prefer ejecutar_comando or leer_archivo first.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
estado_sistemaBRead-only
Resumen de salud: uptime/carga, memoria, disco, procesos que más consumen, servicios systemd caídos y contenedores Docker.
| Name | Required | Description | Default |
|---|---|---|---|
| servidor | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false and openWorldHint=true, so the safety profile is covered. The description adds the breadth of collection (systemd + Docker + process sampling), which hints at a potentially slow aggregation call, but it never says so outright, nor does it mention auth or failure behavior for unreachable hosts.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One dense sentence that front-loads the purpose ('Resumen de salud') and then lists payload contents; nothing is redundant. The comma-spliced list is slightly harder to scan than a structured breakdown but wastes no words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be spelled out, and annotations cover the read-only profile. What remains missing is the only input parameter's semantics and any note about cost/latency of a multi-subsystem probe — a real gap for a one-required-param tool with 0% schema coverage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the single required parameter 'servidor' is documented nowhere — the schema only carries the title 'Servidor'. The description never mentions the parameter, so an agent gets no help on expected format (hostname vs. IP vs. alias from listar_servidores) for the one input it must supply.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific resource (health summary) and enumerates exactly what is gathered: uptime/load, memory, disk, top processes, failed systemd services and Docker containers. That inventory distinguishes it well from siblings like ver_logs or leer_archivo, though it never names an alternative explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The enumerated data categories imply the use case (a diagnostic snapshot of a machine), but there is no explicit 'use this when…' statement, no exclusion of when to prefer ver_logs or ejecutar_comando, and no prerequisites such as needing a reachable server.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
leer_archivoBRead-only
Lee un archivo de texto del servidor (las primeras o últimas N líneas).
| Name | Required | Description | Default |
|---|---|---|---|
| ruta | Yes | ||
| lineas | No | ||
| servidor | Yes | ||
| desde_el_final | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false and openWorldHint=true, so the safety profile is covered. The description adds the meaningful behavioral detail that reads are truncated to a first-or-last N-line window rather than returning the whole file. It does not mention behavior on a missing/unreadable path, encoding, or size limits, so it is additive but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler and the key scoping detail in parentheses. It is efficient, though the extreme brevity shifts work into the undocumented parameters rather than being optimally sized for a 4-parameter tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need no explanation, and annotations cover safety and open-world behavior. Still, for a tool with 4 parameters at 0% schema coverage and a crowded sibling set (ver_logs, ejecutar_comando), the description lacks the routing guidance and parameter semantics an agent needs to call it correctly the first time.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the full explanatory burden, and it does map conceptually onto all four parameters (servidor, ruta, lineas as N, desde_el_final as first-vs-last). However, it adds nothing about path format (absolute vs relative), what a valid servidor identifier looks like, or that lineas affects how desde_el_final behaves, leaving gaps the agent must infer.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a concrete verb and resource ("Lee un archivo de texto del servidor") plus a clear scope qualifier ("las primeras o últimas N líneas"), so an agent knows exactly what operation this performs. It does not name or differentiate itself from siblings such as ver_logs, which is the closest ambiguity in the set.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description contains no when-to-use or when-not-to-use guidance; nothing tells the agent to prefer leer_archivo over ver_logs or ejecutar_comando for inspecting remote content. The only usable cue is the implicit read-only nature of the operation, which the annotations already state.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
listar_servidoresARead-only
Lista los servidores registrados y si su sesión SSH está abierta.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false and openWorldHint=true, so the safety profile is covered. The description adds the useful behavioral detail that it reports live SSH session state, but says nothing about whether it actively probes each server, latency, or permission requirements for a network-touching (openWorld) read.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero waste that names both the resource and the key returned signal. Nothing to trim and nothing buried.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value explanation is not required, and with zero parameters and clear read-only annotations the description is nearly sufficient. The only missing piece is a hint about when to reach for this versus estado_sistema, which is minor for such a simple tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is no parameter semantics to explain and the baseline of 4 applies. The description correctly implies no input is needed to obtain the server list.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Lista los servidores registrados") and adds the returned attribute (whether the SSH session is open). This is clearly a discovery/enumeration tool, distinguishable from execution siblings like ejecutar_comando or escribir_archivo, though it never names them explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use, when-not-to-use, or prerequisite guidance is given. The usage is only implied by the purpose: an agent would infer it should call this first to discover available servers before invoking ejecutar_comando. The routing is inferable but not stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ver_logsBRead-only
Últimas líneas de logs.
tipo: "servicio" (unidad systemd, ej. nginx), "docker" (nombre del contenedor), "archivo" (ruta, ej. /var/log/nginx/error.log) o "sistema" (journal completo). filtro: texto o regex para grep -iE. desde: solo para servicio/sistema/docker, ej. "1 hour ago" o "2026-10-28 08:00" (docker usa formato como "1h").
| Name | Required | Description | Default |
|---|---|---|---|
| tipo | Yes | ||
| desde | No | ||
| filtro | No | ||
| lineas | No | ||
| nombre | No | ||
| servidor | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the read-only, non-destructive, open-world profile, and the description adds non-obvious behavior: filtro is applied as grep -iE, and the time format differs per tipo (docker wants "1h" while others accept "1 hour ago" or a timestamp). It does not say what happens with an invalid nombre or whether lineas truncates output, so it stops short of full disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose is front-loaded in one line, followed by compact per-parameter notes with no filler. The only structural weakness is that the tipo notes and the target-name examples are merged into one line, which is where the ambiguity comes from.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 6-parameter tool with a required "nombre"/"servidor" pair and zero schema descriptions, the definition leaves too much unsaid. The output schema excuses it from explaining return values and annotations cover safety, but the missing meaning of nombre, lineas and servidor is a genuine gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description carries the whole burden, and it only documents tipo, filtro and desde. Worse, it attaches the unit/container/path examples (nginx, /var/log/nginx/error.log) to "tipo", which is an enum — it never explains that those values belong in the required "nombre" parameter. "lineas" and "servidor" are left entirely undefined, inviting a malformed call.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"Últimas líneas de logs" states a concrete verb+resource (tail recent log lines) and the tipo enumeration makes the scope of log sources explicit. It is distinguishable from siblings like leer_archivo or estado_sistema, though it never names those alternatives directly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives useful per-tipo guidance and correctly restricts "desde" to servicio/sistema/docker (implying archivo ignores it), which is real usage guidance. However, it never says when to prefer this over leer_archivo or estado_sistema, nor does it state preconditions such as the server needing to be reachable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v0.2.0- First observed
ejecutar_comando - First observed
escribir_archivo - First observed
estado_sistema - First observed
leer_archivo - First observed
listar_servidores - First observed
ver_logs
TDQS
Scored across 6 tools
Each tool targets a distinct operation (listing servers, running commands, health summary, logs, file read, file write) and the boundaries are explained in the descriptions. There is some functional overlap, since ejecutar_comando could technically do log tailing or file reads, but the specialized tools exist as safer/easier conveniences and are clearly named.
Names follow a Spanish verb_noun pattern consistently (listar_servidores, ejecutar_comando, ver_logs, leer_archivo, escribir_archivo), with snake_case throughout. The one deviation is estado_sistema, which is a noun phrase rather than verb_noun, but it remains readable and predictable.
Six tools is a well-scoped set for remote server administration: connectivity, command execution, health overview, logs, and file read/write. No tool feels redundant or gratuitous.
The core lifecycle for operating a remote server is covered: discover servers, run commands, inspect health and logs, read and write files. The main gap is the lack of a directory-listing or file-transfer operation, so agents must guess paths or fall back to ejecutar_comando with ls/cat, which is a workable but indirect path.
Maintenance
Related MCP Connectors
Let AI operate servers without SSH. Choose actions, approve risky changes, and audit every step.
Operate Linux, macOS and Windows from your LLM. Every action runs through an auditable allowlist.
Scoped, audited SSH exec, sessions, and SFTP on your saved servers without exposing credentials
Linux VMs for AI agents: create VMs, run commands, edit files and open preview URLs.
Related MCP Servers
- AlicenseAqualityCmaintenanceEnables AI assistants to securely execute remote SSH commands, perform file transfers, and monitor system status through a standardized interface. It features robust security controls including command whitelisting, blacklisting, and credential isolation to prevent unauthorized operations.1016 npmMIT
- AlicenseNot gradedqualityCmaintenanceEnables AI agents to manage remote servers via SSH, including command execution, multi-host batch operations, SFTP file transfer, background job handling, DevOps diagnostics, port tunneling, and safety guardrails like high-risk command blocking and read-only mode.MIT
- AlicenseAqualityBmaintenanceEnables AI agents to securely connect to and manage remote servers via SSH, with tools for running commands, file operations, log inspection, service management, and system monitoring under configurable access controls and audit logging.1215 npm1MIT
- FlicenseNot gradedqualityAmaintenanceEnables AI-controlled administration of remote Linux hosts and containers, including bounded shell execution, persistent PTY sessions, durable jobs/tasks, hardened filesystem access, process/service control, and resumable transfers.-