ChatGPT Remote SSH MCP
This ChatGPT Web + MCP server lets you inspect and operate authorized Linux hosts over SSH/SFTP through ChatGPT, authenticated via GitHub OAuth.
Discover servers and groups: List configured SSH servers with groups/descriptions, or list all groups with member counts (
list_servers,list_groups).Execute on one server: Run shell commands on a single SSH host with optional working_dir, timeout, dry_run preview, and dangerous-command blocking (
execute).Execute on a group: Run one command across all servers in a group in parallel with per-server timeout and optional fail_fast (
execute_on_group).Upload files: Transfer local files to remote servers via SFTP, subject to a 100 MiB cap and transfer-root/path restrictions (
upload_file).Download files: Retrieve remote regular files via SFTP, with no-clobber local behavior and sensitive-path denylist enforcement (
download_file).Use from ChatGPT web: Connect as an MCP plugin/connector after GitHub OAuth; SSH/SFTP details are handled server-side.
Uses a Cloudflare Tunnel (the bundled cloudflared binary) to publish the local OAuth gateway on port 8200 as a public HTTPS endpoint, giving ChatGPT an HTTPS /mcp entry point to the SSH MCP service.
Uses GitHub OAuth as the identity provider for the MCP gateway: users sign in with GitHub, and only GitHub user IDs in the configured allowlist are permitted to obtain tokens and reach the SSH MCP tools.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@ChatGPT Remote SSH MCPrun hostname, whoami, and uptime on gpu-local"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
ChatGPT Web MCP
Codex 额度不够用了?通过 ChatGPT 网页版 + MCP 继续部分开发工作
当 Codex 额度暂时用尽,你仍然可以在 ChatGPT 网页版里完成一部分常见开发操作。
如果你平时使用 Codex 查看项目、修改代码、运行命令、执行测试或管理远程服务器,可以尝试用 ChatGPT 网页版 + MCP 完成其中的一部分:
查看与修改代码:读取文件、理解项目、调整实现
运行命令与测试:执行脚本、排查问题、检查测试结果
管理开发任务:查看日志与进程、检查 Git 状态、追踪实验
操作授权服务器:直接在聊天中执行常见远程操作
ChatGPT 负责理解需求与调用工具,MCP 负责将工具能力接入对话。本项目当前通过 SSH / SFTP 连接已授权的 Linux 主机;这些是底层实现,不需要用户在 ChatGPT 对话中手动输入 SSH 命令。
这是 Codex 之外的一种工作方式,不会增加或恢复 Codex 额度,也无法完整替代 Codex 的全部能力。 可用功能受当前 ChatGPT 工具权限、使用限制以及服务器配置影响。
Codex usage exhausted? Continue selected development tasks with ChatGPT Web + MCP
If you've hit your Codex usage limit, you can still handle some common development workflows in ChatGPT on the web.
Use ChatGPT Web + MCP to inspect and edit project files, run commands and tests, check logs, manage Git repositories, and operate authorized remote servers—all through chat. ChatGPT handles the conversation and tool calls; the MCP service supplies remote tools. Under the hood, this implementation uses SSH/SFTP to access Linux hosts.
This is an alternative workflow, not extra Codex quota or a full replacement for Codex. Availability depends on your ChatGPT tool access, usage limits, and server configuration.
这是一个面向 ChatGPT 网页版的 远程开发 MCP 接入项目:包含 MCP 远程工具、GitHub OAuth 网关、Cloudflare HTTPS Tunnel、插件配置及必要测试。SSH / SFTP 仅用于底层远程执行与文件传输。核心实现基于 blackaxgit/ssh-mcp,许可证见 LICENSE。GitHub 更新不会自动部署到正在运行的服务器。
在 ChatGPT 中使用
在 ChatGPT 的 设置 → Plugins 中连接或启用本项目的 MCP 连接器(现有连接器显示名为 Remote SSH)。
如需重新建立自定义 MCP 连接,地址为
https://<你的 HTTPS 公网域名>/mcp,选择 OAuth 并通过 GitHub 登录。在会话中选择现有连接器 @Remote SSH,直接提出请求,例如:
“列出可用 SSH 服务器。”
“在
gpu-local执行hostname、whoami和uptime。”“只读检查
/home/test/Double下项目的 Git 状态和运行进程。”“修改指定文件,运行测试通过后再提交。”
已接入的工具:list_servers、list_groups、execute、execute_on_group、upload_file、download_file。请只连接有权管理的服务器,避免在未经确认的情况下执行有破坏性的操作。
Related MCP server: ssh-mcp-server
运行架构
ChatGPT 网页版通过 HTTPS MCP 调用远程工具。实线表示工具请求,虚线表示 GitHub OAuth 登录授权;SSH / SFTP 是服务器侧的底层执行方式。
flowchart TB
subgraph EXTERNAL["用户与身份验证"]
direction LR
CHAT["ChatGPT 网页版<br/>MCP 工具调用"]
GH["GitHub OAuth<br/>身份验证"]
end
CF["Cloudflare Tunnel<br/>公网 HTTPS 入口"]
subgraph SERVER["Linux / GPU 服务器"]
direction TB
GW["8200 · OAuth 网关<br/>授权与请求转发"]
MCP["8000 · MCP 服务<br/>6 个远程工具"]
SSH["gpu-local · 目标主机<br/>命令执行与文件传输"]
GW -->|"Bearer 认证"| MCP
MCP -->|"SSH / SFTP"| SSH
end
CHAT -->|"HTTPS / MCP"| CF
CF --> GW
GW -. "GitHub 登录" .-> GH
GH -. "授权回调" .-> GW
classDef main fill:#EAF4FD,stroke:#A6CEE3,color:#164D72,stroke-width:1px;
classDef oauth fill:#F0F5FA,stroke:#A6BCCD,color:#274A63,stroke-width:1px;
class CHAT,CF,GW,MCP,SSH main;
class GH oauth;
style SERVER fill:#F8FAFC,stroke:#CDD7E1,stroke-width:1px
style EXTERNAL fill:transparent,stroke:transparent各组件负责什么?
组件 | 主要职责 |
ChatGPT 网页版 + MCP | 理解指令、发起 MCP 工具调用、展示结果 |
Cloudflare Tunnel | 提供公网 HTTPS 通道,将请求安全转发到本地 8200 端口 |
GitHub OAuth | 确认允许登录的 GitHub 用户身份;不负责运行 SSH 命令 |
8200 OAuth 网关 | 处理授权码与 Token、校验访问权限,把 MCP 请求转给内部服务 |
8000 SSH MCP | 提供 |
gpu-local | 通过 SSH 执行命令或使用 SFTP 传输文件的目标主机 |
调用顺序可以记作:ChatGPT → Cloudflare → 8200 网关 → 8000 MCP → SSH 主机。首次连接或令牌失效时,才需要额外进行 GitHub OAuth 授权。
仓库主要内容:
src/ssh_mcp/:SSH / SFTP / MCP 核心源码gateway/app.py:GitHub OAuth、ChatGPT 授权及 MCP 代理cloudflared/cloudflared:Cloudflared Linux x86_64 v2026.10.1 二进制cloudflared/run-oauth-tunnel.sh:把 HTTPS Tunnel 指向 8200 网关deploy/:启动、安装和诊断脚本;config/:服务器清单示例plugin/:插件清单、MCP 配置和skills/remote-ssh/SKILL.mdscripts/build_plugin.py:生成插件 ZIPtests/、integration/tests/:功能与打包回归测试pyproject.toml、uv.lock、LICENSE:构建与许可
实际配置和密钥不提交 Git:~/.config/ssh-mcp/servers.toml、SSH 私钥、Bearer Token、GitHub OAuth Secret、网关运行日志均位于私有运行环境。
首次部署到 Linux(Conda)
需要已安装并初始化的 Conda、SSH 可用、GitHub OAuth App 以及公网 HTTPS 通道。本项目正式部署使用 chatgpt-ssh-mcp Conda 环境,不需要创建 Python venv。请在目标 Linux 主机上运行。仓库目录名与现有 Conda 环境名相互独立;旧环境 chatgpt-ssh-mcp 保持不变:
git clone https://github.com/Double-wk/chatgpt-web-mcp.git
cd chatgpt-web-mcp
# 默认创建/复用名为 chatgpt-ssh-mcp 的 Conda 环境;
# 自动安装项目、生成缺失的内部 Token,已有 Token 不会被覆盖。
export SSH_MCP_PROJECT_DIR="$PWD"
bash deploy/setup-conda.sh
# 获取环境的实际路径,覆盖启动脚本预置的原服务器绝对路径。
export SSH_MCP_CONDA_PREFIX="$(conda run -n chatgpt-ssh-mcp python -c 'import sys; print(sys.prefix)' | tail -n 1)"
# Gateway 使用同一个 Conda 环境(不安装到系统 Python)。
"$SSH_MCP_CONDA_PREFIX/bin/python" -m pip install uvicorn httpx starlette python-multipartdeploy/setup-conda.sh 在私有目录 ~/.config/ssh-mcp/ 创建或保留 servers.toml 和 http-token。修改 servers.toml,并在 ~/.ssh/config 配置可访问的 SSH 主机,先验证 SSH 连通。gateway-token 也是必需的私有文件,仅在不存在时创建:
install -d -m 700 "$HOME/.config/ssh-mcp"
if [ ! -f "$HOME/.config/ssh-mcp/gateway-token" ]; then
umask 077
"$SSH_MCP_CONDA_PREFIX/bin/python" -c 'import secrets; print(secrets.token_urlsafe(48))' > "$HOME/.config/ssh-mcp/gateway-token"
fi
chmod 600 "$HOME/.config/ssh-mcp/http-token" "$HOME/.config/ssh-mcp/gateway-token"
# 启动内部 MCP(127.0.0.1:8000)
bash deploy/run-http.sh已有部署的服务器请保留原有 Token 和配置,不要重新生成或覆盖。现有实例的 Conda 环境路径为 /mnt/tcm_agent_data/Double/envs/chatgpt-ssh-mcp,仓库目录为 /home/test/Double/chatgpt-web-mcp;deploy/run-http.sh 与 deploy/chatgpt-ssh-mcp.service 使用该运行环境。迁移到新机器时请设置 SSH_MCP_PROJECT_DIR 和 SSH_MCP_CONDA_PREFIX。
OAuth 和 HTTPS 网关
在 GitHub Developer Settings 创建 OAuth App,授权回调 URI 为 https://<公网域名>/oauth/github/callback。在服务器私有环境中设置 GITHUB_CLIENT_ID、GITHUB_CLIENT_SECRET、GITHUB_ALLOWED_IDS(允许登录的 GitHub 数字用户 ID,逗号分隔)和 GATEWAY_PUBLIC_BASE(公网 HTTPS 根地址,不含 /mcp)。GITHUB_ALLOWED_IDS 必须非空:精简版网关在白名单缺失时会拒绝授权,不会放行所有 GitHub 用户。
通过环境变量 CHATGPT_OAUTH_CLIENT_ID 和 CHATGPT_OAUTH_REDIRECT_URI 设置 ChatGPT 连接器的客户端 ID 与完整回调 URI。默认客户端 ID 是 chatgpt-remote-ssh,默认回调 URI 仅对应先前创建的连接器;创建新连接后必须使用页面显示的实际值,不应复制旧值。内部 MCP 应已在 8000 运行,然后在另一个终端启动:
PYTHONPATH="$PWD" "$SSH_MCP_CONDA_PREFIX/bin/python" -m uvicorn gateway.app:app --host 127.0.0.1 --port 8200再开启 Cloudflare Tunnel:
./cloudflared/run-oauth-tunnel.sh仓库保留 Linux x86_64 的 cloudflared v2026.10.1(约 39 MB),这是实际部署依赖。其他系统或架构使用相应官方版本并设置 CLOUDFLARED_BIN。Quick Tunnel 域名可能变化,届时须同步更新网关公开基地址、GitHub OAuth 回调 URI、ChatGPT MCP URL。长期部署建议固定 HTTPS 域名。
Gateway 连接堆积修复与安全升级
故障特征:8000 端口接近 256 条已建立连接、出现 Exceeded concurrency limit、初始化和工具请求返回 HTTP 503。原 Gateway 的 httpx.AsyncClient(timeout=None).request() 会等待整个 SSE 响应结束;新的代理使用 send(..., stream=True) + StreamingResponse 实时转发,并在正常结束、下游断开或任务取消时关闭上游响应和 HTTP 客户端。保留 OAuth、MCP Session ID、原有 6 个工具。新的实现降低了连接堆积风险,但不等于已证明所有生产网络故障都能自动恢复。
不要直接在运行目录 git pull:本仓库曾重写为单个根提交,旧目录与 GitHub main 的历史可能不兼容。请在新目录检出并测试,旧的 MCP 8000、Gateway 8200、私有 Token、Conda 环境和正在运行的实验保持不变。
cd /home/test/Double
git clone https://github.com/Double-wk/chatgpt-web-mcp.git chatgpt-web-mcp
cd chatgpt-web-mcp
PY=/mnt/tcm_agent_data/Double/envs/chatgpt-ssh-mcp/bin/python
"$PY" -m unittest discover -s integration/tests -p 'test*.py' -v
# 仅在确认 8202 未被使用后,在单独终端启动测试网关:
ss -ltnp | grep ':8202' || true
PYTHONPATH="$PWD" "$PY" -m uvicorn gateway.app:app --host 127.0.0.1 --port 8202从另一个终端测试独立网关的真实 MCP 初始化和只读工具调用(不打印 Token):
cd /home/test/Double/chatgpt-web-mcp
PY=/mnt/tcm_agent_data/Double/envs/chatgpt-ssh-mcp/bin/python
SSH_MCP_HTTP_PORT=8202 \
SSH_MCP_HTTP_TOKEN_FILE="$HOME/.config/ssh-mcp/gateway-token" \
"$PY" deploy/doctor-mcp.py --probe-execute
# 多次测试后核对连接是否回落,不应持续攀升至 256:
ss -Htn state established '( sport = :8000 )' | wc -l此诊断探针只会执行固定的 hostname 命令,且当前版本仅检查本机配置的 gpu-local。还应在测试环境验证 SSE 被客户端取消、异常退出时连接被释放;CI 回归测试覆盖这些模拟场景。
切换生产 8200 之前:确认现有 Gateway 是如何注入 GITHUB_CLIENT_ID、GITHUB_CLIENT_SECRET、GITHUB_ALLOWED_IDS、GATEWAY_PUBLIC_BASE 及 ChatGPT OAuth 回调配置;在新服务中保留完全相同的私有设置。先确认 8202 探针通过,再在维护窗口仅替换 8200 Gateway 进程,切勿重启 8000 MCP 或修改训练数据。切换后重跑探针、检查公网 OAuth,并持续观察连接数与 503;发生异常则回滚到原目录启动的 Gateway。切勿把密钥内容、实际 OAuth 回调 code/state 粘贴到聊天或 Git。
自检和插件打包
# 先检查本机端口与网关
curl -sS -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8200/healthz
curl -sS -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8200/.well-known/oauth-authorization-server
curl -sS -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8200/mcp
# 检查工具发现及只读远程 hostname(默认 gpu-local)
"$SSH_MCP_CONDA_PREFIX/bin/python" deploy/doctor-mcp.py --probe-execute
# 测试插件打包,并为已部署的 HTTPS MCP 生成 ZIP
"$SSH_MCP_CONDA_PREFIX/bin/python" -m unittest discover -s integration/tests -p 'test*.py' -v
"$SSH_MCP_CONDA_PREFIX/bin/python" scripts/build_plugin.py --web-url "https://<你的域名>/mcp" --output /tmp/remote-ssh.zip正常结果:前两个接口返回 200;未认证的 /mcp 返回 401;doctor 显示 MCP initialize OK、6 个工具和 MCP execute OK。该诊断脚本会检查当前示例的 gpu-local 别名和固定主机名;迁移到别的服务器后,要相应更新诊断目标。
OAuth 正常链路为 /oauth/authorize(302)→ /oauth/github/callback(302)→ POST /oauth/token(200)→ POST /mcp(200/202)。如果出现“缺少回调数据”,分别检查 GitHub 和 ChatGPT 回调是否携带 code/state,不要将这些实际参数打印到公开日志。
开源致谢与许可证
本仓库并非从零实现所有组件。项目在开源软件基础上做了 ChatGPT 接入、GitHub OAuth 网关与部署集成,应保留原作者署名并明确修改范围:
blackaxgit/ssh-mcp:SSH MCP 核心实现、SSH/SFTP 工具、配置及相关测试的重要上游来源。感谢原项目贡献者。本仓库保留其源码,遵循 Mozilla Public License 2.0(MPL-2.0),见根目录 LICENSE。本项目的 OAuth 网关、ChatGPT 插件配置与部署集成为额外工作,不代表原作者为这些修改背书。
Cloudflare/cloudflared:提供 Cloudflare Tunnel 可执行程序,负责 HTTPS 访问通道。感谢 Cloudflare 维护开源项目。其开源许可证为 Apache License 2.0,参见 Cloudflare 项目的许可证 和仓库随附的
cloudflared/LICENSE。仓库保留 Linux x86_64 版本的二进制文件,方便恢复部署。Model Context Protocol:本项目遵循 MCP 协议与工具交互规范。
开源代码的许可证与本项目自定义部署配置不是同一回事:服务器私钥、GitHub OAuth Secret、Bearer Token 和访问日志不属于公开仓库内容,也不应提交到 Git。
Git 管理与安全
仓库目标是保留最小可部署的完整项目,旧的 Docker/Compose 模板、无认证测试通道、冗余文档已剔除,核心源码与 cloudflared 仍保留。OAuth 临时状态和令牌目前保存在网关进程内存中,因此重启可能需要重新授权。不要把私钥、Token、GitHub Secret 或日志提交 Git,也不要对在线部署目录进行未经验证的文件覆盖。
Git main 已整理为一个根提交;旧提交在其他克隆或缓存中可能仍然存在。特别注意:本机已将工作目录迁移为 /home/test/Double/chatgpt-web-mcp;Conda 环境仍使用 chatgpt-ssh-mcp。既有 systemd 服务文件已同步到新工作目录,迁移部署时请按目标机器设置对应路径,避免直接覆盖运行中的工作树。
Available Tools
6 toolsdownload_fileA
Download a file from a remote server via SFTP.
Args:
server: Server name (e.g. 'pro-dicentra').
remote_path: Path to the remote file — normally absolute, though a
relative path is not rejected, just resolved by the remote SFTP
server against the SSH login directory. Must be a regular file —
symlinks, devices, FIFOs, and other non-regular remote
files are refused. Rejected if it contains .. anywhere or
matches the same sensitive-path denylist upload_file enforces.
Size is NOT capped here (upload's 100 MiB limit has no download
counterpart) — an oversized transfer only logs a warning, after
the bytes are already on disk.
local_path: Destination path, RELATIVE to the configured
transfer_root (see [settings] in servers.toml, or the
SSH_MCP_TRANSFER_ROOT environment variable). Absolute
paths, .., . components and embedded NUL bytes are
rejected, as is a symlink at any component of the path.
Sub-directories are allowed,
but every intermediate directory must already exist under
transfer_root. NO-CLOBBER: if a file already exists at
the destination, the download fails rather than silently
overwriting it — remove or rename the existing file first.
A failed or cancelled download unlinks the partial file it
created, so a retry is not blocked by its own leftovers.
Returns: Confirmation message with file size.
| Name | Required | Description | Default |
|---|---|---|---|
| server | Yes | ||
| local_path | Yes | ||
| remote_path | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, but the description thoroughly discloses side effects: no-clobber behavior, unlink of partial files on failure/cancellation, rejection of symlinks and sensitive paths, and path validation. This gives full transparency about what the tool will and will not do.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is lengthy but every sentence adds essential detail about path handling, security, and failure semantics. It is well-structured with clear parameter labels and a concise Returns section, avoiding redundancy and staying focused on actionable information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complete absence of annotations and schema-level descriptions, the tool description provides all necessary context: parameters, constraints, side effects, and return value. An agent can safely and correctly invoke this tool based solely on the description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite the input schema having no descriptions (0% coverage), the description text fully explains each parameter: server, remote_path, and local_path, including their path constraints, security restrictions, and behavior (e.g., no-clobber). This effectively compensates for the schema's lack of descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('Download a file from a remote server via SFTP') and resource (file). It is distinguishable from sibling tools like upload_file and execute, as it focuses specifically on downloading a single file.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The usage scenario is implied by the purpose and the detailed constraints (e.g., path rules, no-clobber, partial file cleanup). It does not explicitly contrast with alternatives, but the unambiguous operation and constraints make the appropriate usage clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
executeA
Execute a shell command on a single SSH server.
Args:
server: Server name (e.g. 'web-prod-01'). Must match a configured server.
Use list_servers to see available servers.
command: Shell command to execute on the remote server (exactly as it
would be typed at a bash prompt). Rejected if it exceeds
max_command_bytes (default 65536 encoded UTF-8 bytes).
timeout: Command timeout in seconds. Default 30. Not range-checked,
and NOT authoritative: a timeout set on the server's entry
in servers.toml overrides this argument outright, so a
per-server 30 wins over a caller-supplied 600.
working_dir: Absolute remote directory to cd into before running the
command. Uses the server's default_dir from servers.toml
if omitted, or the SSH login directory if neither is set.
force: If True, bypass the dangerous-command detection patterns. Use
only for audited bulk operations. The block list is ~25 regexes
and is broader than "obviously destructive": besides rm -rf /,
mkfs, dd-to-disk, chmod 777 /, redirects into /dev/sd* and
/etc/{passwd,shadow,gshadow,sudoers}, find -delete / -exec rm,
shred / wipefs / blkdiscard / sgdisk on /dev/, partition-table
edits, and fork bombs, it also rejects ordinary interpreter
wrappers — bash -c ..., python3 -c ... (also perl/ruby
-c/-e), eval "...", and base64 -d | sh. Harmless
commands in those forms need force=True too. Default False.
dry_run: If True, do NOT connect or execute. Return a preview describing
what would run (server, command, working_dir, timeout, force).
Dangerous-command detection still runs so rejection can be
previewed. Useful for LLM plans that want to validate intent
before committing. Default False.
Returns:
Formatted command execution result with stdout, stderr, and exit code.
Long output is truncated at max_output_bytes (default 50 KiB) PER
STREAM — stdout and stderr get independent budgets, so the combined
worst case is 2x that setting. A truncated stream ends with
[... output truncated at N bytes], and hitting the cap TERMINATES
the remote process rather than letting it keep writing.
| Name | Required | Description | Default |
|---|---|---|---|
| force | No | ||
| server | Yes | ||
| command | Yes | ||
| dry_run | No | ||
| timeout | No | ||
| working_dir | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and succeeds. It discloses dangerous-command detection and force bypass behavior, timeout override from servers.toml, dry_run's no-execution preview behavior, per-stream output truncation limits, and that hitting the output cap terminates the remote process. These are non-obvious behaviors essential for safe invocation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long, but it is well-structured with Args and Returns sections, and the one-sentence purpose is front-loaded. The detailed force list and timeout caveats are high-value for a command-execution tool where the agent could otherwise invoke it incorrectly; no section is redundant with the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex 6-parameter tool with no annotations, the description is complete: it covers server discovery, command size limits, defaulting behavior, dangerous-command safety, dry-run behavior, output truncation, and process termination. The Returns section also explains what the agent can expect clearly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description documents every parameter with meaning beyond the schema: server must match a configured entry, command size limits, timeout precedence semantics, working_dir fallbacks, force safety implications, and dry_run preview behavior. It fully compensates for the schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening sentence uses a specific verb ('Execute') with a resource ('shell command') and scope ('single SSH server'), immediately distinguishing this tool from sibling execute_on_group. The parameter documentation further clarifies that server must be a configured server name discoverable via list_servers.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: use this for a single SSH server, and tells the agent to call list_servers to discover valid server names. It stops just short of explicitly saying 'for multiple servers, use execute_on_group instead', so it lacks a fully explicit alternative statement.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
execute_on_groupA
Execute a shell command on all servers in a group in parallel.
Concurrency is capped by the max_parallel_hosts setting (default 10;
configure in [settings] of servers.toml, range 1–100). The semaphore is
PROCESS-WIDE, not per call: concurrent execute_on_group calls share the same
slots and therefore serialise against each other for their share of them.
Args:
group: Group name (e.g. 'production', 'web'). Use list_groups to see
available groups.
command: Shell command to execute on every server in the group.
Rejected if it exceeds max_command_bytes (default 65536
encoded UTF-8 bytes).
timeout: Per-server command timeout in seconds. Default 30. Not
range-checked, and overridden per server by a timeout set
on that server's entry in servers.toml.
Each server has its own timer; slow servers do NOT extend the
per-server limit for others.
working_dir: Absolute remote directory to cd into on each server.
Uses each server's default_dir if omitted.
fail_fast: If True, cancel remaining tasks as soon as any server
returns a non-zero exit code or errors. Default False —
run all servers to completion and report each result.
force: If True, bypass the dangerous-command detection patterns. Use
only for audited bulk operations. The same broad block list
described under execute applies here — including plain
bash -c / python3 -c / eval wrappers. Default False.
dry_run: If True, do NOT connect or execute anywhere. Return a
per-server preview describing what would run. Dangerous-
command detection still applies. Useful for previewing
fleet-wide rollouts before committing. Default False.
Returns: Formatted summary showing per-server results, success/failure counts, and aggregate exit status.
| Name | Required | Description | Default |
|---|---|---|---|
| force | No | ||
| group | Yes | ||
| command | Yes | ||
| dry_run | No | ||
| timeout | No | ||
| fail_fast | No | ||
| working_dir | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral burden and does so thoroughly. It discloses parallel execution, the process-wide concurrency semaphore, per-server timeout independence, fail_fast semantics, dangerous-command detection, and dry_run's no-connect guarantee. This gives the agent a strong model of side effects and resource behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose and the most important concurrency behavior, then organized into clean Args and Returns sections. It is long, but every sentence adds operational value, and the structure makes the details scannable for an agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity — 7 parameters, fleet-wide parallel execution, failure modes, and safety controls — the description is complete. It covers behavior, defaults, parameter semantics, edge cases like serializer sharing, and the return format, leaving no significant operational gap for the agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must fully explain all 7 parameters, and it does. Every parameter receives its own Args entry with default values, constraints, and behavioral nuance, such as max_command_bytes for command, per-server timeout overrides, and force bypassing dangerous-command detection.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Execute a shell command on all servers in a group in parallel.' This clearly distinguishes it from the sibling 'execute' tool, which presumably targets a single server, and it orients the agent immediately to the group-scoped behavior.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: commands run fleet-wide across a group, and it points to list_groups to discover valid group names. It also explains when dry_run is useful for previewing rollouts. However, it does not explicitly state when to prefer this tool over the sibling 'execute' tool or when not to use it, so it stops short of fully explicit usage routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_groupsB
List all server groups with descriptions and member counts.
Returns: Formatted table of groups with name, description, and server count.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the return format ('Formatted table') and what columns to expect, which is helpful. However, it doesn't mention important behavioral aspects like whether this requires authentication, has rate limits, returns all groups at once or uses pagination, or if there are any access restrictions. The description adds some value but leaves significant gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately concise with two clear sentences. The first sentence states the core functionality, and the second describes the return format. There's no wasted text, though the structure could be slightly improved by combining the two sentences more fluidly or adding a brief introductory phrase.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has zero parameters, 100% schema coverage, and an output schema exists, the description is reasonably complete for a simple read operation. However, with no annotations and a read operation that likely has behavioral considerations (authentication, data scope, etc.), the description should ideally mention at least basic context about access or limitations. The output schema will handle return structure details, but behavioral transparency remains a gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters (schema coverage 100%), so the description doesn't need to explain parameters. The baseline for zero parameters is 4, as there's no parameter documentation burden. The description appropriately focuses on what the tool does rather than parameter details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('List') and resource ('server groups'), including what information is returned (descriptions and member counts). It distinguishes from sibling 'list_servers' by focusing on groups rather than individual servers. However, it doesn't explicitly differentiate from other potential group-related operations that might exist in the future.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. While it implicitly suggests this is for viewing group information rather than executing operations (like 'execute_on_group'), there are no explicit when/when-not instructions or references to sibling tools. The agent must infer usage context from the tool name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_serversA
List all configured SSH servers with their groups and descriptions.
Args: group: Optional group name to filter by. Shows all servers if omitted. Use list_groups to see available group names.
Returns:
Formatted table of servers with name, groups, and description. An
unknown group is reported as a plain "Error: ..." string
rather than raised as a tool error, and a group with no members
returns "No servers found in group '<name>'".
| Name | Required | Description | Default |
|---|---|---|---|
| group | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description transparently details the return format as a formatted table and documents both error behavior for unknown groups and the message for empty results. Even without annotations, the outcome is clearly described.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured, with clear sections for purpose, argument, and return behavior. No unnecessary information is included.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description provides all necessary context for calling the tool: what it returns, how the parameter behaves, and how errors are surfaced. It is complete even without relying on the output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although the schema itself has no description, the tool description fully explains the only parameter: group is optional, filters by group name, and omitting it shows all servers. This fully compensates for the schema coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists all configured SSH servers along with their groups and descriptions. The scope is specific and the verb 'list' accurately conveys the read-only nature.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains how to use the optional group filter and points to list_groups for valid group names, but it does not explicitly contrast when to use this tool versus the sibling execution or file-transfer tools. Some inference is required to determine the appropriate context among the alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
upload_fileA
Upload a file to a remote server via SFTP.
Files larger than 100 MiB are refused outright — use rsync or scp for those.
Args:
server: Server name (e.g. 'pro-dicentra').
local_path: Path to the local file, RELATIVE to the configured
transfer_root (see [settings] in servers.toml, or the
SSH_MCP_TRANSFER_ROOT environment variable). Absolute
paths, .., . components and embedded NUL bytes are
rejected, as is a symlink at ANY component of the path.
Sub-directories are allowed (e.g. 'reports/q1.csv'),
but every intermediate
directory must already exist under transfer_root —
upload_file does not create them. transfer_root itself must
be a real directory owned by the running user with mode 0700,
or every transfer fails.
remote_path: Destination path on the remote server — normally absolute,
though a relative path is not rejected, just resolved by the
remote SFTP server against the SSH login directory. Rejected if
it contains .. anywhere (even inside an otherwise legitimate
filename) or matches the sensitive-path denylist
(/etc/shadow, /etc/passwd, .ssh/*,
.aws/credentials, .kube/config, .netrc, …). An
existing REGULAR file at the destination is silently
OVERWRITTEN — unlike download_file, upload does not no-clobber;
an existing non-regular target (symlink, device, FIFO) is
refused.
Returns: Confirmation message with file size.
| Name | Required | Description | Default |
|---|---|---|---|
| server | Yes | ||
| local_path | Yes | ||
| remote_path | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Despite no annotations, the description fully discloses side effects: silent overwrite of regular files, refusal of non-regular targets, rejection of symlinks, NUL bytes, and denylisted paths, as well as the exact return message.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with Args and Returns sections. Every sentence adds meaningful constraints or behavior details; no fluff or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description includes return behavior, error scenarios, and path resolution rules. Combined with the presence of an output schema (implied by 'Has output schema: true'), the agent has complete information to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although the input schema has no property descriptions, the tool description covers all three parameters (server, local_path, remote_path) with detailed constraints and examples, fully compensating for the schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose ('Upload a file to a remote server via SFTP') and distinguishes it from siblings by contrasting overwrite behavior with download_file and recommending rsync/scp for large files.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use alternatives (files >100 MiB → rsync/scp), and details preconditions (transfer_root existing, directories must already exist) and path restrictions, leaving no ambiguity about appropriate usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v0.1.0- First observed
download_file - First observed
execute - First observed
execute_on_group - First observed
list_groups - First observed
list_servers - First observed
upload_file
TDQS
Scored across 6 tools
Each tool targets a clearly distinct purpose: group discovery, server discovery, single-host command execution, fleet command execution, upload, and download. There is no meaningful overlap between listing, executing, and transferring operations.
All names are snake_case and follow a readable verb pattern. The main minor deviation is that 'execute' is not verb_noun while 'execute_on_group', 'upload_file', and 'download_file' are more explicitly shaped.
Six tools are well-scoped for an SSH MCP server. Each tool earns its place without redundant coverage or obvious filler.
The surface covers discovery, single and fleet command execution, and both directions of file transfer. Minor gaps remain around remote file management, such as deleting, listing, or creating remote directories.
Maintenance
Related MCP Connectors
Scoped, audited SSH exec, sessions, and SFTP on your saved servers without exposing credentials
Manage remote servers, SSH terminals, files, databases and proxies with scoped access and approvals.
1Work on your own computers from Claude or ChatGPT: run commands, edit and search files.
Operate Linux, macOS and Windows from your LLM. Every action runs through an auditable allowlist.
Related MCP Servers
- AlicenseAqualityCmaintenanceEnables AI assistants to securely connect to and manage remote servers via SSH, supporting command execution, file transfers via SFTP, and multi-server management with both password and SSH key authentication.938 npm2MIT
- AlicenseAqualityCmaintenanceEnables AI assistants to securely execute remote SSH commands, perform file transfers, and monitor system status through a standardized interface. It features robust security controls including command whitelisting, blacklisting, and credential isolation to prevent unauthorized operations.1011 npmMIT
- AlicenseAqualityBmaintenanceEnables AI assistants to execute shell commands and transfer files via SFTP across remote servers using existing SSH configurations. It supports parallel execution on server groups and provides built-in safety warnings for potentially destructive commands.6234 PyPI4Mozilla Public 2.0
- AlicenseAqualityDmaintenanceEnables LLMs to interact with remote servers via SSH, supporting command execution, file upload/download, and directory listing.7MIT