Skip to main content
Glama
ssh-licco

ssh-licco

by Echoqili

🚀 SSH LICCO

PyPI version Python 3.10+ License: MIT MCP Registry

让 AI 帮你操作服务器! 通过自然语言对话,AI 可以帮你执行命令、管理文件、查看日志、部署应用等。


📚 文档导航

快速开始

核心功能

高级主题

开发资源


Related MCP server: remote-admin-mcp

✨ 特性亮点

  • 🎯 自然语言控制 - 用对话方式操作服务器

  • 🔐 多种认证方式 - 密码、密钥、Agent 转发

  • 🔗 长连接支持 - 自动保活(30 秒心跳),避免账户锁定

  • ⏱️ 可配置超时 - Banner 超时 (60s)、会话超时 (2 小时),支持自动重连

  • 📦 异步高性能 - 基于 Paramiko 的异步架构(线程池 + asyncio)

  • 🛡️ 完善的异常处理 - 统一的错误处理机制(7 层异常层次)

  • 📊 会话管理 - 支持多个并发 SSH 会话(最大 10 个,每主机 3 个)

  • 📁 SFTP 文件传输 - 上传、下载、目录管理

  • 🖊️ 远程文件编辑 - 直接写入/追加文件内容,无需下载再上传

  • 🔑 密钥管理 - 生成和管理 SSH 密钥对(RSA/Ed25519)

  • 📝 审计日志 - 完整的操作审计记录(JSON 结构化日志)

  • 🚀 连接池 - 高性能连接复用(PooledConnection + ConnectionPool)

  • 📊 批量执行 - 多主机并行命令执行(BatchExecutor + AsyncBatchExecutor)

  • 🐳 Docker 支持 - Docker 构建和状态监控

  • 📋 后台任务 - 可靠的后台进程启动(nohup + bash -c 包装,单次 SSH 调用无竞态)

  • 🖥️ screen/tmux 会话 - 持久化远程会话,SSH 断开后进程依然存活

  • 🪟 Windows 服务器支持 - 支持 Windows Server(OpenSSH for Windows)与 Linux/macOS 目标主机

  • 🔍 进程管理 - 启动/停止/查询远程进程、SSH 端口转发(tunnel)

  • 🔍 看门狗 - 任务监控、心跳检测、全局异常处理

  • 🛡️ 文件传输路径安全校验 - ssh_file_transfer delete 自动识别 Windows / Unix 路径风格并拦截敏感路径与路径遍历


🖥️ 目标主机支持

SSH-LICCO 基于标准 SSH/SFTP 协议,可连接以下目标主机:

操作系统

要求

备注

Linux

OpenSSH 7.0+

推荐,完整支持所有功能

Windows Server

OpenSSH for Windows / PowerShell Remoting over SSH

v2.1.3+ 支持 Windows 路径风格与安全校验

macOS

系统内置 OpenSSH

完整支持

提示:连接 Windows 服务器时,请使用 Windows 风格路径(如 C:\temp\file.txt),系统会自动识别并进行路径安全校验。


📦 快速安装

方式一:pip 安装(推荐)

pip install ssh-licco

方式二:从源码安装

git clone https://github.com/Echoqili/ssh-licco.git
cd ssh-licco
pip install -e .

Python 版本要求: Python 3.10+


🚀 快速开始

1️⃣ 配置 MCP 服务器

在 Trae / Cursor / Claude Desktop 中使用

打开设置 → MCP → 添加新服务器:

{
  "mcpServers": {
    "ssh": {
      "command": "python -m ssh_mcp.server"
    }
  }
}

2️⃣ 配置 SSH 连接(可选但推荐)

方式 A:环境变量配置(推荐)

{
  "mcpServers": {
    "ssh": {
      "command": "python -m ssh_mcp.server",
      "env": {
        "SSH_HOST": "192.168.1.100",
        "SSH_USER": "root",
        "SSH_PASSWORD": "your_password",
        "SSH_PORT": "22",
        "SSH_TIMEOUT": "60",
        "SSH_KEEPALIVE_INTERVAL": "30",
        "SSH_SESSION_TIMEOUT": "7200",
        "SSH_CLIENT_TYPE": "common"
      }
    }
  }
}

环境变量说明:

  • SSH_HOST: SSH 服务器地址

  • SSH_USER: 用户名

  • SSH_PASSWORD: 密码

  • SSH_PORT: 端口(默认 22)

  • SSH_TIMEOUT: 连接超时(秒)

  • SSH_KEEPALIVE_INTERVAL: 保活间隔(秒)

  • SSH_SESSION_TIMEOUT: 会话超时(秒)

  • SSH_CLIENT_TYPE: SSH 客户端类型(可选,默认 common)

    • common - paramiko(稳定可靠,推荐)⭐

    • performance - asyncssh(高性能,适合高并发)🚀

    • development - fabric(简化 API,适合快速开发)👨‍💻


🔐 安全配置

新增加固默认值与迁移说明见 安全边界与加固配置: 连接默认验证主机密钥,确认参数不再绕过命令策略,文件传输执行目录隔离。 下表是项目的模式说明,不是第三方平台的安全评分。

重要:从 v0.2.1 开始,ssh-licco 提供多级安全策略,可根据使用场景灵活配置。

多级安全策略

级别

名称

适用场景

防护强度

STRICT

严格模式

生产环境、公共服务器

最高 ⭐⭐⭐

BALANCED

平衡模式

开发环境、个人服务器(默认)

高 ⭐⭐

RELAXED

宽松模式

测试环境、完全信任的服务器

中等 ⭐

快速配置

方式 1:环境变量(推荐)

Windows PowerShell:

$env:SSH_SECURITY_LEVEL = "balanced"
$env:SSH_EXTRA_ALLOWED_COMMANDS = "git,pip,npm"

Linux/Mac:

export SSH_SECURITY_LEVEL="balanced"
export SSH_EXTRA_ALLOWED_COMMANDS="git,pip,npm"

方式 2:MCP 配置文件

{
  "mcpServers": {
    "ssh": {
      "command": "python -m ssh_mcp.server",
      "env": {
        "SSH_SECURITY_LEVEL": "balanced",
        "SSH_EXTRA_ALLOWED_COMMANDS": "git,pip,npm",
        "SSH_BASE_DIR": "/home"
      }
    }
  }
}

📖 详细文档

🛡️ 硬拦截灾难性命令(v2.2.0 新增)

为防止任何误操作或越权调用直接打到远程 shell,ssh-licco 在所有安全级别下都无条件拦截以下灾难性命令模式,无法通过 confirm_dangerous=true、confirmation_layer=N、调整 SSH_SECURITY_LEVEL 等任何方式绕过:

  • rm -rf 作用于绝对路径(含 /、/*、/path、/path/*,-fr 变体同效)

  • mkfs.* 任意文件系统格式化

  • dd if=/dev/(zero|random|urandom) of=/dev/(sd|nvme) 覆写裸盘

  • bash fork-bomb(:(){ :|:& };: 及空白变体)

  • chmod -R 777 / / chmod -R 000 / 根目录递归改权限

  • > /dev/(sd|nvme) / >> /dev/(sd|nvme) 裸设备重定向

如确需执行上述操作,请直接通过 SSH 登录服务器(绕过 MCP 网关)进行。安全且可逆的替代方案:

# 旧做法(v2.2.0 之前):rm -rf /path/to/junk  ← 现已被硬拦截
# 推荐做法:mv 到回收站,约定时间后清理
mv /path/to/junk /tmp/.trash_$(date +%s)/

命中硬拦截时会输出 WARNING 审计日志(含 category 与命令),便于 SOC 监控。


🛠️ 可用工具(v2.2.0 维持 9 个;v2.1.0 曾增加的 3 个审批工具因流程闭环风险已下线)

工具

描述

核心能力

ssh_connect

连接管理

自动读取环境变量/配置,支持密码+密钥认证,可保存配置,登录后自动执行命令

ssh_execute

命令执行

自动连接、智能后台检测、长任务等待、超时控制,支持 nohup/screen/tmux 三种后台模式;v2.2.0 起对灾难性命令(rm -rf 绝对路径、mkfs、raw-disk dd、fork-bomb 等)做无条件硬拦截

ssh_disconnect

会话管理

断开指定会话 OR 列出所有活跃会话

ssh_file_transfer

文件传输

上传/下载/列表/写入/追加/删除/创建目录/查看元信息(8 种操作);v2.1.3+ delete 操作新增 Windows/Unix 敏感路径拦截与路径遍历防护

ssh_host

主机管理

action=list/add/remove 增删查主机配置

ssh_docker

Docker 管理

action=ps/images/build/logs 全生命周期管理

ssh_generate_key

密钥生成

RSA / Ed25519 密钥对

ssh_session

screen/tmux 会话

持久化远程会话管理(create/send/capture/list/kill),SSH 断开后进程依然存活

ssh_process

进程管理

启动/停止/查询远程进程,SSH 端口转发(tunnel_open/tunnel_close/tunnel_list)

关于 v2.1.0 引入的 3 个审批工具(ssh_request_approval / ssh_approve_command / ssh_list_approvals):已从 MCP list_tools() 移除,代码已在 v2.2.0 删除(ssh_mcp/approval.py、ssh_mcp/handlers/approval.py)。审批流程依赖 AI 自报命令、运维侧背书,存在闭环风险;v2.2.0 的硬拦截更直接——灾难性命令在 MCP 网关层就被拒绝,运维侧不需要再走"先申请再审批"流程。

📖 详细文档


💡 使用示例

示例 1:执行命令

用户:帮我查看服务器上的 Docker 容器
AI:调用 ssh_connect → ssh_execute "docker ps"

[执行结果]
CONTAINER ID   IMAGE     COMMAND   STATUS   PORTS
abc123         nginx     "nginx"   Up 2 days 80:80

示例 2:文件上传

用户:把这个文件上传到 /var/www/html
AI:调用 ssh_connect → ssh_file_transfer

[上传成功]
本地:./index.html
远程:/var/www/html/index.html
大小:2.3 KB

示例 3:Docker 构建(长任务)

用户:帮我构建 Docker 镜像
AI:调用 ssh_execute(background=True) 后台执行 docker build...

[后台任务已启动]
Session ID: a1b2c3d4
命令:docker build -t myapp .
使用 ssh_execute(session_id="a1b2c3d4", command="cat /tmp/build.log") 查看进度

示例 4:数据库检查

用户:检查 PostgreSQL 是否正常运行
AI:调用 ssh_execute "pg_isready -h localhost -p 5432"

[检查结果]
localhost:5432 - accepting connections
✅ PostgreSQL 运行正常

📖 更多示例


📋 完整配置示例

场景 1:Web 开发者

{
  "mcpServers": {
    "ssh": {
      "command": "python -m ssh_mcp.server",
      "env": {
        "SSH_SECURITY_LEVEL": "balanced",
        "SSH_EXTRA_ALLOWED_COMMANDS": "git,npm,docker,composer,pm2",
        "SSH_BASE_DIR": "/var/www",
        "SSH_HOST": "192.168.1.100",
        "SSH_USER": "deploy",
        "SSH_PASSWORD": "your-password"
      }
    }
  }
}

场景 2:Python 开发者

{
  "mcpServers": {
    "ssh": {
      "command": "python -m ssh_mcp.server",
      "env": {
        "SSH_SECURITY_LEVEL": "balanced",
        "SSH_EXTRA_ALLOWED_COMMANDS": "pip,poetry,python3,pytest,black",
        "SSH_HOST": "192.168.1.100",
        "SSH_USER": "developer",
        "SSH_PASSWORD": "your-password"
      }
    }
  }
}

场景 3:数据库管理员

{
  "mcpServers": {
    "ssh": {
      "command": "python -m ssh_mcp.server",
      "env": {
        "SSH_SECURITY_LEVEL": "balanced",
        "SSH_EXTRA_ALLOWED_COMMANDS": "psql,mysql,mongosh,pg_isready",
        "SSH_HOST": "192.168.1.100",
        "SSH_USER": "dbadmin",
        "SSH_PASSWORD": "your-password"
      }
    }
  }
}

场景 4:系统管理员

{
  "mcpServers": {
    "ssh": {
      "command": "python -m ssh_mcp.server",
      "env": {
        "SSH_SECURITY_LEVEL": "relaxed",
        "SSH_EXTRA_ALLOWED_COMMANDS": "sudo,apt,yum,systemctl,journalctl,docker,kubectl",
        "SSH_HOST": "192.168.1.100",
        "SSH_USER": "root",
        "SSH_PASSWORD": "your-password"
      }
    }
  }
}

场景 5:生产环境(最高安全)

{
  "mcpServers": {
    "ssh": {
      "command": "python -m ssh_mcp.server",
      "env": {
        "SSH_SECURITY_LEVEL": "strict",
        "SSH_HOST": "192.168.1.100",
        "SSH_USER": "app-user",
        "SSH_PASSWORD": "your-password",
        "SSH_BASE_DIR": "/home/app-user"
      }
    }
  }
}

📖 更多配置

🌐 完整环境变量速查(v2.3.0)

下表所有变量均被代码读取。注意:

  • SSH_RATE_LIMIT 是 bool 总开关(true/false),SSH_RATE_LIMIT_MAX 才是次数上限,两者分开配置

  • 主机密钥检查(strict_host_key_checking)不通过 env 配置,请用 ssh_connect 工具参数或 hosts.json

分类

变量

默认

说明

安全

SSH_SECURITY_LEVEL

balanced

安全级别:strict / balanced / relaxed

SSH_BASE_DIR

/home

Unix 远程 SFTP 路径校验基目录

SSH_LOCAL_BASE_DIR

当前工作目录

本地文件上传源与下载目标的允许目录

SSH_EXTRA_ALLOWED_COMMANDS

(空)

额外允许的命令(逗号分隔)

SSH_ALLOWED_COMMANDS_FILE

(空)

命令白名单 JSON 文件路径

SSH_AUDIT_LOG_PATH

(空)

审计日志文件路径

限流

SSH_RATE_LIMIT

true

限流总开关(bool)

SSH_RATE_LIMIT_MAX

30

限流次数上限

SSH_RATE_LIMIT_WINDOW

60

限流窗口(秒)

硬拦截

(无 env)

—

灾难性命令硬拦截,零配置零绕过

连接默认

SSH_HOST / SSH_PORT / SSH_USER / SSH_PASSWORD

127.0.0.1 / 22 / root / (空)

单 host 模式默认连接参数

SSH_TIMEOUT

60

连接超时(秒)

SSH_KEEPALIVE_INTERVAL

30

keepalive 间隔(秒)

SSH_SESSION_TIMEOUT

7200

会话超时(秒)

SSH_CLIENT_TYPE

paramiko

SSH 客户端实现:paramiko / asyncssh

SSH_FORCE_ENV_CONFIG

false

强制 env 配置覆盖 hosts.json

SSH_SUDO_PASSWORD

(空)

sudo 密码,配合 use_sudo=true 走 sudo -S


⚠️ 依赖版本兼容性

已知依赖冲突

以下依赖版本冲突已在测试环境中验证,不影响 ssh-licco 的正常使用:

1. starlette 版本冲突

fastapi 需要 starlette<0.51.0
但安装了 starlette 0.52.1

影响范围:

  • ✅ ssh-licco: 无影响,正常工作

  • ⚠️ fastapi: 可能存在兼容性问题(如果同时使用 fastapi)

解决方案:

  • 如果只使用 ssh-licco,可以忽略此警告

  • 如果同时使用 fastapi,建议:

    pip install starlette==0.50.0

2. cryptography 版本冲突

pyopenssl 需要 cryptography<45
但安装了 cryptography 46.0.5

影响范围:

  • ✅ ssh-licco: 无影响,正常工作

  • ⚠️ pyopenssl: 可能存在兼容性问题(如果同时使用 pyopenssl)

解决方案:

  • 如果只使用 ssh-licco,可以忽略此警告

  • 如果同时使用 pyopenssl,建议:

    pip install cryptography==44.0.0

测试环境

测试通过的配置:

  • ✅ starlette 0.52.1 + ssh-licco 0.4.1

  • ✅ cryptography 46.0.5 + ssh-licco 0.4.1

  • ✅ mcp 1.26.0 + ssh-licco 0.4.1

测试场景:

  • ✅ SSH 连接和执行命令

  • ✅ 文件上传和下载

  • ✅ 后台任务执行

  • ✅ Docker 构建和监控

  • ✅ 多语言后台命令自动检测

为什么允许这些冲突?

ssh-licco 的核心依赖是:

  • mcp - MCP 协议实现

  • asyncssh - SSH 客户端

  • paramiko - SSH 客户端(稳定模式)

  • pydantic - 数据验证

而 starlette 和 cryptography 是通过 mcp 间接引入的。ssh-licco 本身不直接使用这些库的 API,因此版本冲突不会影响 ssh-licco 的功能。


🔧 故障排查

常见问题

1. 连接失败

错误: Connection refused

解决:

  • 检查 SSH 服务是否运行:systemctl status sshd

  • 检查防火墙设置:ufw status

  • 确认端口正确:默认 22

2. 认证失败

错误: Authentication failed

解决:

  • 检查用户名和密码

  • 尝试使用密钥认证

  • 查看 SSH 日志:/var/log/auth.log

3. 命令被阻止

错误: 命令 'xxx' 不在允许列表中

解决:

{
  "SSH_SECURITY_LEVEL": "balanced",
  "SSH_EXTRA_ALLOWED_COMMANDS": "被阻止的命令"
}

📖 详细文档


🎓 学习资源

Skills 文档

配置文档

API 文档


🔗 相关链接

项目资源

文档索引

文档

描述

位置

📖 配置指南

完整配置选项和场景

MCP_CONFIG_GUIDE.md

🔐 安全指南

安全配置详解

SECURITY_CONFIG_GUIDE.md

📊 API 参考

完整 API 文档

docs/API_REFERENCE.md

🎓 Skills

开发、运维、安装指南

docs/skills/

📦 发布指南

版本发布流程

docs/skills/RELEASE_SKILL.md


🧪 测试

测试状态

指标

状态

测试用例

311 passed, 0 skipped

覆盖率

16 个源模块全覆盖

测试框架

pytest + pytest-asyncio

测试模块覆盖

源模块

测试文件

用例数

exceptions.py

test_exceptions.py

7

connection_config.py

test_connection_config.py

8

security.py

test_security.py

24

logging_config.py

test_logging_config.py

8

audit_logger.py

test_audit_logger.py

12

executor.py

test_executor.py

8

watchdog.py

test_watchdog.py

18

key_manager.py

test_key_manager.py

6

config_manager.py

test_config_manager.py

10

clients/interface.py

test_factory.py

10

clients/paramiko_client.py

test_paramiko_client.py

18

clients/factory.py

test_factory.py

10

session_manager.py

test_session_manager.py

18

connection_pool.py

test_connection_pool.py

10

batch_executor.py

test_batch_executor.py

10

server.py

test_server.py

30+

service.py

test_service.py

14

运行测试

# 运行全部测试
pytest tests/ -v

# 运行特定模块测试
pytest tests/test_security.py -v

# 查看覆盖率
pytest --cov=ssh_mcp --cov-report=term-missing

📦 发布流程

先在独立分支同步版本并运行测试:

python sync_version.py 2.8.1 --no-commit --no-tag
python sync_version.py --check
python -m pytest tests -q
node --test tests/install.test.cjs

代码合并后推送 vX.Y.Z 标签,现有发布流程依次执行版本校验、测试、打包、 PyPI 上传、公开安装源码核验,再创建或补齐 GitHub Release。 不需要向 npm 注册表发布;Node 安装包通过 GitHub Release 下载。

支持手动只验证,以及针对原标签恢复中断的发布。网络查询失败时停止上传; 已有 PyPI 文件和 Release 安装包不会重复覆盖。 详细操作及凭据配置见 发布与失败恢复。


📊 版本历史

Available Tools

9 tools
ssh_connectB

Establish an SSH connection to a remote server. If no parameters are provided, auto-connects using environment variables or saved config. Supports password, private key, and agent authentication. Optionally save the config and/or execute a command after connecting.

NameRequiredDescriptionDefault
hostNoSSH server hostname or IP. If omitted, auto-reads from env vars or saved config.
nameNoUse a pre-configured host from hosts.json by name.
portNoSSH port
commandNoOptional command to execute immediately after connecting.
passwordNoSSH password for password-based auth.
usernameNoSSH username. If omitted, auto-reads from env vars.
passphraseNoPassphrase for encrypted private key.
auth_methodNoAuthentication method.private_key
save_configNoSave connection settings to local config file for future use.
sudo_passwordNoSudo password (optional). When set, ssh_execute with use_sudo=true will auto-wrap commands with sudo -S, avoiding plaintext password in process list.
known_hosts_pathNoOptional trusted known_hosts file, in addition to the user's default known_hosts.
private_key_pathNoPath to private key file for key-based auth.
accept_new_host_keyNoExplicitly opt in to accepting unknown host keys. Disabled by default; provision trusted known_hosts before connecting.
strict_host_key_checkingNoReject hosts absent from known_hosts. Keep enabled in production.

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses auto-connect behavior, supported auth methods, and optional saving/command execution, but omits important traits: session persistence, return value or connection handle, failure behavior, and side effects of save_config writing to disk.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four sentences, front-loaded with the main action. Each sentence contributes information, and there is no filler. It could be slightly more structured or scannable, but it is efficient overall.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 14 parameters, no annotations, and no output schema, the description covers the main behavior but leaves gaps. It does not explain what the tool returns, how the session lifecycle works, or how it interacts with siblings like ssh_disconnect and ssh_execute, which an agent would need for confident use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents all 14 parameters. The description repeats the auto-read behavior for host/username and lists auth methods, but adds no syntax, format, or interaction details beyond what the schema provides. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Establish an SSH connection to a remote server.' The purpose is clear, but it does not explicitly distinguish itself from siblings such as ssh_execute or ssh_disconnect, leaving the agent to infer the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Mentions auto-connection when no parameters are provided and optional command execution after connecting, which gives some usage context. However, it never explicitly says when to use this tool versus ssh_execute or ssh_disconnect, and offers no exclusions or alternative-routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_disconnectA

Close an active SSH session. If no session_id is provided, lists all currently active sessions with connection details.

NameRequiredDescriptionDefault
session_idNoSession ID to disconnect. If omitted, lists all active sessions.

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral disclosure burden. It discloses both the destructive close action and the conditional list-all-sessions behavior, including that connection details are returned. It does not mention side effects or permission requirements, but covers the core observable behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with no filler. The primary action is front-loaded, and the conditional behavior is stated efficiently in the second sentence.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a low-complexity tool with a single optional parameter and no output schema. The description fully explains how to invoke both modes and what to expect when listing, so an agent has enough information to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the parameter description already states 'Session ID to disconnect. If omitted, lists all active sessions.' The tool description adds no new parameter-level meaning beyond what the schema provides, so the baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Close') and resource ('active SSH session'), and adds a conditional listing behavior when no session_id is given. This clearly distinguishes ssh_disconnect from sibling connection, execution, and file-transfer tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context: use this to close an active SSH session, and if no id is supplied it lists active sessions. It does not explicitly name alternatives or exclusion criteria, but the use case is unambiguous from the stated behavior.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_dockerA

Manage Docker on the remote server. Supports ps (list containers), images (list images), build (build an image in background), and logs (view container logs).

NameRequiredDescriptionDefault
hostNoSSH server hostname or IP. Alternative to session_id/name, can override hosts.json entry.
nameNoUse a pre-configured host from hosts.json by name. Alternative to session_id.
portNoSSH port (used with host).
tailNoNumber of log lines to retrieve.
actionYesDocker action: ps=list containers, images=list images, build=build an image, logs=view container logs.
contextNoBuild context directory for build..
passwordNoSSH password (used with host).
usernameNoSSH username (used with host).
image_nameNoDocker image name. Required for build, optional filter for images.
session_idYesActive SSH session ID. If omitted, connects via name/host/env vars.
container_nameNoContainer name or ID. Required for logs.
dockerfile_pathNoPath to Dockerfile for build../Dockerfile

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral burden. It does disclose that build runs in the background and implies ps/images/logs are read-oriented actions, but it omits details like auth requirements, side effects of build, and failure behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two focused sentences with no filler: the first states scope and the second lists the supported actions. It is front-loaded and every phrase earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a multi-action tool with 12 parameters, the action list plus fully described schema is largely sufficient to invoke correctly. It lacks explicit usage guidance and output details, but no output schema is present and the schema supplies most invocation information.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so every parameter is already documented. The tool description adds no extra parameter-level meaning, so it stays at the baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific scope – Docker on a remote server – and enumerates the four supported actions (ps, images, build, logs). It is clear enough to distinguish this tool from the SSH sibling tools, though 'Manage' is somewhat broad.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes it clear this is the Docker-specific remote tool, but it never explicitly says when to prefer it over alternatives like ssh_execute, or when not to use it. Usage context is implied rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_executeB

Execute a command on a remote server. If session_id is omitted, auto-connects using environment variables. Supports background execution for long-running tasks (auto-detected or manual). Use session_type='screen' or 'tmux' for persistent sessions that survive SSH disconnect.

NameRequiredDescriptionDefault
hostNoSSH server hostname or IP. Alternative to session_id/name, can override hosts.json entry.
nameNoUse a pre-configured host from hosts.json by name. Alternative to session_id.
portNoSSH port (used with host).
waitNoWait for background task to complete.
commandYesShell command to execute on the remote server (required).
timeoutNoCommand timeout in seconds. Default 120s. For long tasks (docker pull, pg_basebackup), set higher or use background=true.
workdirNoWorking directory for background tasks./tmp
log_fileNoLog file path for background task output./tmp/background_task.log
passwordNoSSH password (used with host).
use_sudoNoWrap command with sudo -S using sudo_password from ssh_connect. Password is passed via stdin, not visible in process list.
usernameNoSSH username (used with host).
backgroundNoRun in background for long-running tasks. Auto-detected if not specified.
session_idNoSession ID from ssh_connect. If omitted, connects via name/host/env vars.
session_typeNoBackground session type: nohup (default), screen, or tmux (persistent).nohup
wait_timeoutNoMax wait time in seconds when wait=True.
confirm_dangerousNoAcknowledge a risky operation. Does not bypass the command allowlist, shell syntax restrictions, or hard blocks.
backup_before_deleteNoFor recursive deletion commands (rm -r/rf), explicitly choose whether to backup targets before deleting. Set true to backup to /tmp/ssh_mcp_backup_<timestamp>/ then delete; set false to delete directly. Required when a recursive deletion is detected.

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It usefully discloses auto-connection behavior, background auto-detection, and survival across SSH disconnect. It omits the most consequential traits — the command allowlist and hard blocks, sudo password delivery, and the mandatory backup decision for recursive deletion — all of which exist only in the schema, not the prose.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences, front-loaded with the core action and followed by the two most agent-relevant behaviors. No filler, though for a tool this complex the brevity trades away needed coverage.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 17-parameter remote-execution tool with no annotations and no output schema, the description covers connection resolution and background/persistence but says nothing about safety gating, sudo semantics, or what a call returns. Adequate to invoke a simple command, insufficient to invoke it safely or correctly in the risky cases the schema anticipates.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description reinforces the session_id fallback chain and background auto-detection, but adds little syntax or semantics the schema doesn't already state for its 17 parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Execute a command on a remote server.' The connection-fallback and background/persistent-session clauses clarify its scope relative to ssh_connect and ssh_session, though it never explicitly contrasts with ssh_docker or ssh_process, whose command surfaces overlap.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear conditional guidance for several modes: omit session_id to auto-connect via env vars, use session_type='screen'/'tmux' for persistence, use background for long tasks. However, it offers no exclusion rules or alternatives — an agent cannot tell from the description when to reach for ssh_docker or ssh_process instead, nor when this tool should not be used.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_file_transferA

Transfer and manage files between local and remote server via SFTP. Supports upload, download, list, write (write content directly to remote file), append, delete, mkdir, stat, and remote_copy (server-to-server direct transfer via scp/rsync, avoiding local relay).

NameRequiredDescriptionDefault
hostNoSSH server hostname or IP. Alternative to session_id/name, can override hosts.json entry.
nameNoUse a pre-configured host from hosts.json by name. Alternative to session_id.
portNoSSH port (used with host).
contentNoContent to write/append to remote file. Required for write/append.
passwordNoSSH password (used with host).
usernameNoSSH username (used with host).
directionYesAction: upload, download, list, write (content->remote file), append, delete, mkdir, stat, remote_copy (server-to-server direct transfer).
use_rsyncNoremote_copy: Use rsync instead of scp (better for large directories, supports resume).
local_pathNoLocal file path. Required for upload/download.
session_idYesActive SSH session ID. If omitted, connects via name/host/env vars.
remote_pathNoRemote file/directory path. Required for all directions. For remote_copy, this is the source path on the connected server.
target_hostNoremote_copy: Target server hostname/IP.
target_pathNoremote_copy: Destination path on target server.
target_portNoremote_copy: Target SSH port.
target_userNoremote_copy: Target SSH username.root
target_passwordNoDeprecated: password-based remote_copy is disabled. Configure key-based authentication on the source server.

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden, yet it says nothing about the destructive/irreversible nature of delete, whether upload overwrites existing files, whether mkdir creates parent directories, or what authentication constraints apply. Only the remote_copy relay behavior is disclosed, and that detail is already repeated in the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core purpose is front-loaded in the first clause, and the long operation enumeration is dense but informative rather than filler. It is appropriately sized for a nine-direction tool, though the list partially duplicates the direction enum.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 16 parameters, no annotations, and no output schema, the description is complete on the 'what operations exist' axis but silent on results (what stat or list returns) and on safety semantics for delete/upload. The rich schema covers parameter-level details, so the gap is behavioral rather than structural.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents every parameter including the remote_copy target_* set and the deprecated target_password. The description adds modest value by clarifying that write accepts content directly and that remote_path is the source path for remote_copy, but goes no further than the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ('Transfer and manage files ... via SFTP') and enumerates all nine supported operations, including the non-obvious remote_copy variant. It is clearly distinguishable from the ssh_execute/ssh_process siblings, which run commands rather than move files.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives real selection guidance inside the tool: remote_copy is for server-to-server, 'avoiding local relay', which tells the agent not to chain upload+download. It does not say when to prefer this tool over ssh_execute or when a direction is inappropriate, so it stops short of explicit when-not guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_generate_keyB

Generate a new SSH key pair (RSA or Ed25519) for secure key-based authentication. Optionally save to a file path.

NameRequiredDescriptionDefault
commentNoOptional comment to identify the key.
key_sizeNoKey size for RSA.
key_typeNoKey algorithm type.ed25519
save_pathNoOptional path to save the generated key files.

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry behavioral disclosure. It mentions optional file saving, but fails to state whether keys are returned when no path is given, whether existing files are overwritten, or security-related behaviors like passphrases and file permissions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence with no filler, front-loading the action and resource, then compactly mentioning options. Every clause adds information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema, no annotations, and 4 optional parameters, the description omits critical operational details: what the response contains, what happens if save_path is omitted, and whether the generated key is available immediately or only on disk.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema already documents all 4 parameters (100% coverage), so the description adds little beyond naming RSA/Ed25519 and the optional save path. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states a specific verb ('Generate'), a specific resource ('new SSH key pair'), supported algorithms (RSA or Ed25519), and purpose (authentication). It is clearly distinct from sibling tools focused on sessions, connections, execution, and file transfer.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'for secure key-based authentication' implies use when creating SSH credentials, but there is no explicit guidance on when to use this tool over alternatives, prerequisites, or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_hostA

Manage SSH server configurations in hosts.json. Use action=list to view all hosts, action=add to register a new server, action=remove to delete a server.

NameRequiredDescriptionDefault
hostNoServer hostname or IP. Required for add.
nameNoFriendly name for the server. Required for add and remove.
portNoSSH port number.
actionYesAction: list all hosts, add a new host, or remove a host.
timeoutNoConnection timeout in seconds.
passwordNoSSH password (optional for key auth).
usernameNoSSH login username.root

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the transparency burden. It does disclose that removal deletes a server and that the tool manages the persistent hosts.json file. However, it does not describe side effects, permission requirements, return format, or clarify that this tool does not itself establish an SSH connection.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences with no filler. The resource and the action pattern are front-loaded, making it easy for an agent to quickly understand the tool's core behavior.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The full parameter documentation and explicit action examples make the invocation requirements mostly clear despite the absence of an output schema. The main gap is that the return/result shape is unspecified, but for a simple configuration-management tool this does not prevent correct selection or invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so parameter semantics are already fully documented by the input schema. The description only restates the action enum values, adding no new parameter-level meaning beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description anchors on a specific resource ('SSH server configurations in hosts.json') and enumerates concrete actions (list/add/remove). This clearly distinguishes it from operational siblings like ssh_connect, ssh_execute, and ssh_session.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides action-level usage guidance ('use action=list', 'action=add', 'action=remove') but does not explicitly state when to select this tool over alternatives such as ssh_connect or ssh_session. The intended context is implied through 'hosts.json' and configuration management, not directly contrasted with sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_processA

Manage background processes and SSH tunnels on the remote server. Actions: start (launch a detached background process, returns PID), stop (stop a process by PID), status (check if a PID is running), list (list tracked background tasks), tunnel_open (local port forward to remote host:port), tunnel_close (close a tunnel), tunnel_list (list active tunnels).

NameRequiredDescriptionDefault
pidNoProcess ID (stop/status).
hostNoSSH server hostname or IP. Alternative to session_id/name, can override hosts.json entry.
nameNoUse a pre-configured host from hosts.json by name. Alternative to session_id.
portNoSSH port (used with host).
actionYesProcess/tunnel action.
signalNoSignal to send on stop (TERM, KILL, INT, etc.).TERM
commandNoCommand to run (start).
task_idNoTask ID (stop/status, alternative to pid).
workdirNoWorking directory (start)./tmp
log_fileNoLog file path (start). Default /tmp/bg_<taskid>.log
passwordNoSSH password (used with host).
usernameNoSSH username (used with host).
local_portNoLocal listen port (tunnel_open).
session_idYesActive SSH session ID. If omitted, connects via name/host/env vars.
remote_hostNoRemote target host (tunnel_open).
remote_portNoRemote target port (tunnel_open).

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description must carry the full burden. It discloses that start launches a detached background process and returns a PID, and that stop uses a PID, but omits details on error handling, idempotency, side effects, authentication requirements, or whether actions are destructive. The behavior is partially transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single paragraph with the purpose front-loaded, followed by a concise action list. It is efficiently structured, though the list of actions could be slightly more compact without losing clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 16 parameters and 7 actions, the description covers the actions but does not specify which parameters are required for each action, nor does it clarify connection options (session_id vs host/name vs environment variables). No output schema exists, so return formats for actions like list, status, or tunnel_list remain undefined, leaving gaps for an agent to fill.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers 100% of parameters, but the description adds crucial meaning by mapping actions to their relevant parameters (e.g., start uses command, stop uses pid, tunnel_open uses local_port/remote_host/remote_port). This goes beyond the generic schema descriptions and aids correct invocation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it manages background processes and SSH tunnels on a remote server, enumerating seven specific actions. This distinguishes it from siblings like ssh_execute (likely foreground execution) and ssh_session (session lifecycle management).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the action list but there is no explicit guidance on when to use this tool versus alternatives like ssh_execute for foreground commands or ssh_session for session management. No when-not-to-use conditions are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_sessionA

Manage persistent screen/tmux sessions on the remote server for long-running interactive tasks (deploy, build, test, REPL). Sessions survive SSH disconnect. Actions: create (new detached session running a command), send (send keys/command to a session), capture (read current screen), list (list sessions), kill (kill a session).

NameRequiredDescriptionDefault
hostNoSSH server hostname or IP. Alternative to session_id/host_name, can override hosts.json entry.
nameNoSession name. Required for create/send/capture/kill. Only letters, digits, _, ., - allowed.
portNoSSH port (used with host).
linesNoNumber of lines to capture (tmux capture-pane -S).
actionYescreate=new detached session, send=send keys/command to a session, capture=read current screen content, list=list sessions, kill=kill a session.
commandNoCommand to run initially (create) or to send (send).
passwordNoSSH password (used with host).
usernameNoSSH username (used with host).
host_nameNoUse a pre-configured host from hosts.json by name. Alternative to session_id.
session_idYesActive SSH session ID. If omitted, connects via name/host/env vars.
session_typeNoUse screen or tmux backend.screen

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description must carry the behavioral burden. It discloses persistence and action meanings (create is detached, capture reads current screen), but does not mention the destructive irreversibility of kill, authentication needs, session/host precedence, or edge-case behavior on nonexistent sessions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences: the first front-loads purpose and context, the second compactly enumerates all actions. Every sentence earns its place with no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The schema is rich and fully covers parameters, and the description covers the tool's overall behavior and all actions. However, with no output schema, it leaves gaps around return format for capture/list, which connection identity (session_id vs host_name vs host) takes precedence, and whether kill requires confirmation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with each parameter already documented in the input schema. The description's action list essentially restates the action enum values without adding new parameter-level meaning, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific purpose ('Manage persistent screen/tmux sessions... for long-running interactive tasks') and enumerates the five actions with concrete semantics. Differentiates from siblings by emphasizing persistence and surviving SSH disconnect, which clearly separates it from one-off ssh_execute.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear context: use for long-running interactive tasks like deploy, build, test, and REPL, and notes sessions survive disconnect. Stops short of explicitly naming alternatives or stating when not to use this tool, so it misses the full when/when-not guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 3 tool updatesv2.8.0
    • Changedssh_connect4 fields changed
      • changedInput schema / properties / accept_new_host_key / default
        Previous value: -trueNew value: +false
      • changedInput schema / properties / accept_new_host_key / description
        Previous value: -"Auto-accept new host keys."New value: +"Explicitly opt in to accepting unknown host keys. Disabled by default; provision trusted known_hosts before connecting."
      • addedInput schema / properties / known_hosts_path
        Added value: +{
        +  "description": "Optional trusted known_hosts file, in addition to the user's default known_hosts.",
        +  "type": "string"
        +}
      • addedInput schema / properties / strict_host_key_checking
        Added value: +{
        +  "default": true,
        +  "description": "Reject hosts absent from known_hosts. Keep enabled in production.",
        +  "type": "boolean"
        +}
    • Changedssh_execute1 field changed
      • changedInput schema / properties / confirm_dangerous / description
        Previous value: -"Bypass security validation for known-dangerous commands (e.g. rm -rf /path). Use with caution — only for operations you explicitly intend to perform."New value: +"Acknowledge a risky operation. Does not bypass the command allowlist, shell syntax restrictions, or hard blocks."
    • Changedssh_file_transfer1 field changed
      • changedInput schema / properties / target_password / description
        Previous value: -"remote_copy: Target server password (uses sshpass). If omitted, assumes key-based auth is configured."New value: +"Deprecated: password-based remote_copy is disabled. Configure key-based authentication on the source server."
  2. 9 tool updatesv2.7.2
    • First observedssh_connect
    • First observedssh_disconnect
    • First observedssh_docker
    • First observedssh_execute
    • First observedssh_file_transfer
    • First observedssh_generate_key
    • First observedssh_host
    • First observedssh_process
    • First observedssh_session

TDQS

A3.8/5.0

Scored across 9 tools

Disambiguation3/5

Most tools are clearly distinct (connect, disconnect, keygen, file_transfer, docker, host), but three tools overlap on running things remotely in the background: ssh_execute (background/screen/tmux execution), ssh_process (start detached background process), and ssh_session (persistent screen/tmux sessions). The descriptions help differentiate them, but the boundaries between 'run in background', 'detached process', and 'persistent session' remain fuzzy and invite misselection.

Naming Consistency5/5

Every tool uses a consistent ssh_<noun> snake_case pattern (ssh_connect, ssh_execute, ssh_file_transfer, ssh_generate_key, etc.). The uniform prefix and naming style make the set highly predictable.

Tool Count5/5

Nine tools is well-scoped for an SSH management server. Each covers a distinct concern (connection, execution, transfer, keys, hosts, docker, processes, sessions) without padding.

Completeness4/5

The surface covers the full SSH lifecycle: connect/disconnect, command execution, file transfer, key generation, host config, plus docker/process/session/tunnel management. Minor gaps like listing or deleting generated keys and dedicated port-forward config outside ssh_process are workarounds rather than blockers.

Maintenance

ActivityMaintained
ResponsivenessOutdated data

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables AI assistants to maintain persistent SSH terminal sessions and transfer files to/from remote servers. Allows stateful command execution, natural language server management, and seamless file operations through SSH connections.
    6 npm
    36
    MIT
  • A
    license
    A
    quality
    B
    maintenance
    Enables AI assistants to manage remote servers via SSH with agentless command execution, file operations, and service management.
    9
    21 PyPI
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI agents to SSH into Linux servers, run commands, deploy code, and manage servers via natural language, also doubles as a CLI for manual use.
    3
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI agents to manage remote servers via SSH, including command execution, multi-host batch operations, SFTP file transfer, background job handling, DevOps diagnostics, port tunneling, and safety guardrails like high-risk command blocking and read-only mode.
    MIT