SSH MCP Server
Planned integration for personal password manager functionality, allowing secure credential storage and retrieval for SSH connections
Planned integration for secure credential storage and retrieval, enabling enterprise-grade secret management for SSH authentication
Planned integration for personal password manager functionality, allowing secure credential storage and retrieval for SSH connections
Planned integration with HashiCorp Vault for multi-cloud secret management and secure credential storage for SSH operations
Provides remote Linux server management capabilities including command execution, system administration, service management, and system monitoring via SSH
Uses macOS Keychain for secure credential storage with TouchID/password protection for SSH authentication
Enables running Puppet agent in no-op mode for configuration management and infrastructure automation on remote systems
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@SSH MCP Servercheck disk usage on server.company.local"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
SSH MCP Server
An MCP (Model Context Protocol) server that provides SSH client functionality for remote Linux server management. This server enables AI assistants to execute commands on remote Linux hosts via SSH, solving the limitations of built-in tools when working with remote systems.
Why SSH MCP Server?
Built-in MCP tools are limited to local operations. This server extends AI capabilities to remote Linux systems by providing:
Remote Command Execution: Execute any command on remote Linux hosts
System Administration: Manage services, check system health, monitor processes
Secure Authentication: Multiple secure credential storage options
Enterprise Integration: Works with domain-joined systems and enterprise environments
Related MCP server: TermPipe MCP
Features
SSH Command Execution: Execute arbitrary commands on remote Linux hosts
Sudo Support: Run commands with elevated privileges (secure password handling)
Installation
From PyPI (Recommended)
pip install ssh-mcp-serverFrom Source
git clone https://github.com/rorymcmahon/ssh-mcp-server.git
cd ssh-mcp-server
pip install -e .System Information: Get system stats, processes, disk usage, and services
Secure Credentials: Secure credential storage (currently macOS Keychain, expanding to other providers)
Connection Management: Automatic connection handling with timeouts
Error Handling: Comprehensive error reporting and recovery
Puppet Integration: Run Puppet agent in no-op mode for configuration management
Installation
From PyPI (when published)
pip install ssh-mcp-serverFrom Source
git clone https://github.com/rorymcmahon/ssh-mcp-server.git
cd ssh-mcp-server
pip install -e .Development Installation
git clone https://github.com/rorymcmahon/ssh-mcp-server.git
cd ssh-mcp-server
pip install -e ".[dev]"Configuration
MCP Client Configuration
Add to your MCP client configuration (e.g., Claude Desktop, Q CLI):
{
"mcpServers": {
"ssh": {
"command": "ssh-mcp-server",
"args": []
}
}
}Available Tools
Core SSH Operations
execute_ssh(hostname: str, command: str)
Execute a command on a remote Linux host via SSH.
Parameters:
hostname: Target hostname (e.g., "server.company.local")command: Command to execute
Returns:
{
"status": 0,
"stdout": "total 24\ndrwxr-xr-x 3 user user 4096 ...",
"stderr": ""
}Or on error:
{
"error": "SSH connection or authentication failed"
}execute_sudo(hostname: str, command: str)
Execute a command with sudo privileges. Automatically handles password input securely.
Returns: Same format as execute_ssh
System Information Tools
ssh_get_system_info(hostname: str)
Get basic system information (OS, kernel, memory, root disk usage).
get_running_processes(hostname: str)
Get top 10 CPU-consuming processes.
get_disk_usage(hostname: str)
Get disk usage for all mounted filesystems.
get_services(hostname: str)
Get top 20 running systemd services.
ssh_puppet_noop(hostname: str)
Run Puppet agent in no-op mode (dry run) with verbose output.
Usage Examples
Basic Command Execution
# Execute a simple command
result = execute_ssh("server.company.local", "uptime")
if "error" not in result:
print(result["stdout"]) # System uptime informationSystem Administration
# Check system health
system_info = ssh_get_system_info("server.company.local")
disk_usage = get_disk_usage("server.company.local")
processes = get_running_processes("server.company.local")
# Restart a service with sudo
result = execute_sudo("server.company.local", "systemctl restart nginx")Error Handling
result = execute_ssh("server.company.local", "invalid_command")
if "error" in result:
print(f"Error: {result['error']}")
elif result["status"] != 0:
print(f"Command failed with exit code {result['status']}")
print(f"Error output: {result['stderr']}")Security Considerations
Credential Storage: Uses secure credential storage (Keychain, future: Vault, AWS Secrets Manager)
Network Security: Ensure SSH connections are over secure networks
Access Control: Limit SSH user permissions on target hosts
Audit Logging: Monitor SSH access and command execution
TouchID Protection: macOS Keychain integration requires TouchID/password for access
Password Security: Sudo passwords are passed securely via stdin, not visible in process lists
Development
Running Tests
pytestCode Formatting
black src/ tests/
isort src/ tests/Type Checking
mypy src/Coverage Report
pytest --cov=ssh_mcp_server --cov-report=htmlContributing
Fork the repository
Create a feature branch (
git checkout -b feature/amazing-feature)Make your changes
Add tests for new functionality
Ensure all tests pass (
pytest)Format code (
blackandisort)Commit changes (
git commit -m 'Add amazing feature')Push to branch (
git push origin feature/amazing-feature)Open a Pull Request
Roadmap
SSH key-based authentication
AWS Secrets Manager credential provider
HashiCorp Vault credential provider
Azure Key Vault credential provider
Connection pooling and reuse
File transfer operations (SCP/SFTP)
Interactive shell sessions
Connection health monitoring
Batch command execution
Custom SSH client configuration
Windows support (additional credential providers)
License
This project is licensed under the MIT License - see the LICENSE file for details.
Support
Issues: GitHub Issues
Discussions: GitHub Discussions
Changelog: CHANGELOG.md
Available Tools
15 toolscache_credentialsD
Legacy compatibility - Pre-cache credentials
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses only that the tool is legacy, saying nothing about whether credentials are stored persistently, security implications, required permissions, or whether the cache can expire or be cleared — all critical for a credential-handling operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is short and front-loaded, but the brevity comes from omission rather than efficiency — the single fragment conveys almost no actionable information, so the sentence does not fully earn its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, but for a security-sensitive credential caching tool with an undocumented required parameter and no differentiation from credential siblings, the description leaves major gaps an agent needs filled.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single required parameter `domain` has 0% schema description coverage, and the description does not explain what a domain means in this context (host, DNS realm, auth domain). The only parameter is left entirely undocumented in both places.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"Pre-cache credentials" essentially restates the tool name cache_credentials, adding only the vague qualifier "Legacy compatibility." It never states what caching means here (in memory, on disk, per-session) or how it differs from the many credential-related siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use, when-not-to-use, or prerequisite guidance is given, even though siblings ssh_setup_credentials and ssh_clear_credentials clearly overlap. "Legacy compatibility" hints at deprecation but never says whether new callers should avoid it or what to use instead.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
execute_sshC
Legacy compatibility - Execute command on remote Linux host via SSH
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | ||
| hostname | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, yet it omits that this runs arbitrary commands with remote execution power (effectively destructive), how authentication is established, whether sudo is available, or any timeout/rate behavior. 'Legacy compatibility' hints at deprecation status but is left unexplained.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short sentence with no padding, and the legacy/deprecation caveat is front-loaded. It is perhaps too terse for a tool that executes arbitrary remote commands, but there is no wasted text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained. But for an SSH execution tool in a family with credential setup, sudo, and duplicate execute variants, the description says nothing about auth prerequisites, privilege level, or why a near-identical sibling exists — key gaps an agent needs resolved before invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate; it only restates the two parameter names via 'command' and 'remote Linux host'. It does not specify hostname format (IP vs. FQDN, user@host?) or whether the command is run through a shell, which matters for quoting and multi-command strings.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb + resource: 'Execute command on remote Linux host via SSH', which tells the agent exactly what happens. However, it does not differentiate from the near-identical siblings ssh_execute_ssh and execute_sudo, so an agent still cannot tell which of the three to pick from the description alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The prefix 'Legacy compatibility' weakly implies a preference for other tools, but no alternative is named and no condition for choosing this over ssh_execute_ssh, ssh_execute_sudo, or execute_sudo is given. No prerequisites (e.g., credentials must be set up first via ssh_setup_credentials) are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
execute_sudoC
Legacy compatibility - Execute command with sudo on remote Linux host
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | ||
| hostname | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, yet it only implies privilege escalation without saying whether credentials or a sudo password are required, whether commands can mutate or destroy state, or what happens on failure. 'Legacy compatibility' is the one piece of useful behavioral context, signaling this may be deprecated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no padding, which is structurally sound. However, brevity here comes at the cost of under-specification for a privileged, annotation-free tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described, but the definition omits credential prerequisites, permission scope, and the relationship to the duplicate ssh_execute_sudo. For a sudo-level mutation tool with zero annotations, that is a substantial gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate and does not: it says nothing about the format of 'hostname' (alias vs FQDN vs inventory name) or how 'command' is interpreted (shell, quoting, multi-line). Both required parameters are left semantically opaque.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Execute command with sudo on remote Linux host'), which separates it from the plain execute_ssh sibling. It does not distinguish itself from the near-identical ssh_execute_sudo, leaving the agent to guess which sudo executor is intended.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Legacy compatibility' faintly hints that a newer path is preferred, but no alternative tool is named and no condition for choosing this over ssh_execute_sudo or execute_ssh is given. The agent must infer everything about when to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_disk_usageC
Legacy compatibility - Get disk usage information from Linux host
| Name | Required | Description | Default |
|---|---|---|---|
| hostname | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, so the description carries the full disclosure burden. 'Get' implies a read-only operation, but there is no mention of required credentials, whether an SSH session must be pre-established, behavior on unreachable hosts, or any other trait beyond the bare purpose.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short sentence with the key qualifier ('Legacy compatibility') front-loaded and no filler. It is efficient, though the brevity is partly under-specification rather than disciplined editing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described, but with no annotations, an undocumented parameter, and a sibling (ssh_get_disk_usage) that appears to overlap almost exactly, the description does not give an agent enough to choose or invoke confidently.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single required parameter, hostname, has 0% schema description coverage, and the description adds nothing about its expected format (FQDN vs inventory alias) or resolution behavior. With one undocumented parameter, the schema-plus-description pair leaves real ambiguity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a concrete verb and resource (get disk usage from a Linux host), which is more specific than the title alone. The 'Legacy compatibility' prefix hints at how it differs from the ssh_get_disk_usage sibling, but it never names that sibling, so the differentiation is only implied.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Legacy compatibility' implies this is a fallback to be used only for older setups, which is weak but real usage guidance. It does not name the preferred alternative (ssh_get_disk_usage) or state the condition that should select one over the other.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_running_processesC
Legacy compatibility - Get running processes from Linux host
| Name | Required | Description | Default |
|---|---|---|---|
| hostname | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. 'Get' implies a read, but it says nothing about prerequisites (e.g. whether ssh_setup_credentials must be called first), whether access is via SSH or local, or any failure modes; the presence of an output schema excuses it from describing return values.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short sentence, front-loaded with the legacy status and then the action, with no wasted words. It is efficient, though the brevity is partly under-specification rather than pure concision.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema covering return shape and only one parameter, the minimum is nearly met, but for a legacy tool sitting beside an ssh_ prefixed replacement, the description should explain which to prefer and what setup is required.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. 'from Linux host' partially clarifies that hostname identifies a Linux target, but no format, resolution rules, or remote-vs-local semantics are given for the single required parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource — 'Get running processes from Linux host' — and flags itself as 'Legacy compatibility', which hints at the newer sibling ssh_get_running_processes. It is clear what the tool does, but the differentiation from the sibling is implied rather than stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'Legacy compatibility' prefix hints that this is a fallback, but it never names ssh_get_running_processes or any condition for choosing between them. An agent has no explicit when-to-use or when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_servicesC
Legacy compatibility - Get systemd services status from Linux host
| Name | Required | Description | Default |
|---|---|---|---|
| hostname | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It implies a read-only status lookup via 'Get', but does not disclose authentication requirements, privilege needs, or any behavior beyond the basic purpose.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single efficient sentence with no wasted words, and the 'Legacy compatibility' context is front-loaded. The terseness is appropriate structurally, even though the content is under-specified.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The output schema exists, but the input schema is undocumented and the tool overlaps with ssh_get_services. For a legacy duplicate, the description should at minimum explain when this tool is appropriate and what hostname means.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single required hostname parameter has 0% schema description coverage, and the description only says 'from Linux host'. It does not clarify hostname format, target resolution, or credential expectations, so it fails to compensate for the schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: get systemd services status from a Linux host. The 'Legacy compatibility' prefix adds lifecycle context, but the description does not explicitly differentiate this tool from the sibling ssh_get_services.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Mentions 'Legacy compatibility' but gives no explicit when-to-use guidance, no exclusions, and does not name ssh_get_services as the modern alternative. An agent must infer usage from the sibling list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_clear_credentialsB
Clear all cached SSH credentials
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. 'Clear all' conveys scope but says nothing about whether this is destructive, whether active SSH sessions are affected, whether confirmation is needed, or what auth state remains afterward — all critical for a cache-invalidating operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no waste. It is perhaps too short to be useful, but it is not padded or buried.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The output schema covers return values, but for a zero-argument operation that wipes all cached credentials with no annotations, the description should disclose side effects and reversibility. That gap leaves the agent unable to predict consequences of calling it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Zero parameters, so there is nothing for the description to disambiguate and baseline 4 applies. The schema is empty and fully consistent with the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('clear') and resource ('cached SSH credentials') with the scope qualifier 'all'. It is not confused with siblings like cache_credentials or ssh_setup_credentials, though it never names them explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No indication of when to clear credentials versus when to set them up or cache them, despite siblings ssh_setup_credentials and cache_credentials sitting adjacent. The agent must infer the trigger condition entirely.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_execute_sshC
Execute command on remote Linux host via SSH
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | ||
| hostname | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, yet it says nothing about authentication requirements, timeouts, exit-code handling, or the fact that this is an arbitrary-command tool with unbounded side effects on the remote host (and a sudo variant exists for privileged work). A single sentence covering only the transport is thin for a mutation-capable tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short, front-loaded sentence with no filler. The issue is underspecification rather than verbosity, so conciseness itself is good.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, but for an SSH execution tool the missing pieces are significant: credential setup expectations, sudo variant relationship, and error/exit behavior. The description leaves the agent without enough context to call this safely alongside a large sibling set.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It only implies that 'command' is a shell command and 'hostname' identifies the target; it does not specify format (e.g., IP vs FQDN, port/user handling) or shell semantics, leaving required parameters undocumented in both places.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource (execute a command on a remote Linux host over SSH), which is clear on its own. However, with many near-identical siblings (execute_ssh, ssh_execute_sudo, execute_sudo, ssh_puppet_noop), the description does nothing to distinguish this tool from them, leaving the agent to guess which entry point to pick.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus ssh_execute_sudo or execute_ssh, nor any mention of prerequisites such as credentials first having to be established via ssh_setup_credentials. Usage must be inferred entirely from the name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_execute_sudoC
Execute command with sudo on remote Linux host
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | ||
| hostname | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It reveals that execution is privileged (sudo) on a remote host, but says nothing about sudo password handling, whether credentials must be pre-cached, failure/error behavior, or that this performs arbitrary mutation on a remote machine — a significant gap for a high-privilege operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with no filler, which is structurally clean. But the brevity is under-specification rather than discipline: the same one sentence could have carried the sudo/credential caveat that the agent actually needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained. But for a privileged remote-execution tool with zero annotations and zero parameter documentation, the description omits credential prerequisites, safety/risk posture, and any differentiation from the several overlapping ssh/execute siblings — insufficient for correct selection.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%: neither 'hostname' nor 'command' has any description. The description adds no meaning beyond what the bare property names convey — no format hints (FQDN vs alias, shell syntax, multi-command support, quoting) to compensate for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (execute) plus resource (command) and the distinguishing qualifier 'with sudo on remote Linux host', which separates it from ssh_execute_ssh. However, it never mentions the near-duplicate sibling execute_sudo, so the agent cannot tell those two apart from the description alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use guidance, no prerequisites, and no exclusions. The agent must infer that sudo is required from the name, and cannot know whether credentials must first be set up via ssh_setup_credentials/cache_credentials or when to prefer execute_sudo or ssh_execute_ssh.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_get_disk_usageC
Get disk usage information from Linux host
| Name | Required | Description | Default |
|---|---|---|---|
| hostname | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full behavioral burden. It implies a read-only remote operation but does not disclose authentication requirements, whether credentials must be pre-configured, timeouts, or side effects, leaving the agent with only the tool name to infer behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no filler. It is appropriately sized for the basic action, though it is too sparse elsewhere rather than too verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described, but the definition still lacks required context: credential prerequisites, host format, and differentiation from the non-SSH disk usage sibling. For a remote-execution tool with no annotations, this is insufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage, and the description does not explain the 'hostname' parameter at all. It does not clarify whether hostname is an IP, DNS name, inventory alias, or how credentials are associated with it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('Get disk usage information') and adds the target ('Linux host'), so the agent can tell what the tool does. However, it does not distinguish this SSH-based tool from the sibling 'get_disk_usage', which appears to cover similar functionality.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus the many sibling tools, especially 'get_disk_usage' or 'ssh_get_system_info'. It also omits prerequisites such as whether SSH credentials must be configured first via 'ssh_setup_credentials'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_get_running_processesC
Get running processes from Linux host
| Name | Required | Description | Default |
|---|---|---|---|
| hostname | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden and offers almost nothing: it doesn't say the call is read-only, whether it requires prior credential setup, whether sudo is needed, or how it behaves on unreachable hosts. Only the implicit 'get' signals a non-mutating read.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short, front-loaded sentence with no wasted words, which is structurally sound. But the terseness is under-specification rather than efficiency, leaving obvious gaps unaddressed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values needn't be explained. Still, for an SSH tool in a family with explicit credential setup/clear and sudo variants, omitting the credential precondition and the local-vs-remote choice leaves the agent without information it needs to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for the single required 'hostname' parameter, and the description adds no meaning — it doesn't clarify whether hostname is a cached SSH target, an IP, or an FQDN, nor how it relates to the credential cache. With low coverage, the description should compensate but does not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Get running processes") and scopes it to a Linux host, which is clear enough on its own. It does not, however, distinguish itself textually from the sibling get_running_processes; the differentiation rests entirely on the 'ssh_' name prefix.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this versus get_running_processes (local) or ssh_execute_ssh, and no mention of any precondition such as credentials being set up via ssh_setup_credentials. The agent must infer all routing from the tool name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_get_servicesC
Get systemd services status from Linux host
| Name | Required | Description | Default |
|---|---|---|---|
| hostname | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. 'Get' implies a read operation, but the description does not disclose authentication requirements, whether credentials must be configured via ssh_setup_credentials, permission needs, or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no wasted words. Its brevity is appropriate structurally, even though separate dimensions cover its missing detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple and an output schema exists, so return values need not be explained. However, for an SSH-based operation with no annotations, the description omits critical operational context such as credential prerequisites and expected host reachability.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description adds no meaning beyond the parameter name 'hostname'. It does not describe the expected hostname format, connection target semantics, or any constraints, leaving the single required parameter under-specified.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Get') and resource ('systemd services status') scoped to a 'Linux host', which is clear and distinct from sibling tools like ssh_get_running_processes and ssh_get_disk_usage. It does not explicitly name alternatives, but the resource and transport context provide clear differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus alternatives, nor does it mention prerequisites such as required SSH credentials or whether setup is needed first. It only states what the tool retrieves.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_get_system_infoC
Get basic system information from Linux host
| Name | Required | Description | Default |
|---|---|---|---|
| hostname | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full behavioral burden, yet it only implies a read operation. It does not mention SSH authentication requirements, credential setup dependencies, failure behavior, or scope/limitations, despite sibling tools for credential management.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no wasted language. However, its brevity comes at the cost of useful detail rather than achieving efficient completeness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an SSH-based tool with no annotations, undocumented parameter semantics, and siblings that manage credentials, the description is insufficient. The existence of an output schema reduces the need to explain return values, but authentication prerequisites and hostname format are missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single hostname parameter has 0% schema description coverage, and the description does not explain its expected format or meaning beyond implying a Linux host target. It does not clarify whether hostname means an IP address, DNS name, or SSH config alias.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb and resource: get basic system information from a Linux host. It is understandable, but it does not differentiate itself from sibling tools such as ssh_get_running_processes, ssh_get_disk_usage, or ssh_get_services, and 'basic system information' remains somewhat vague.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus the many sibling SSH tools that retrieve specific system details. The only implied constraint is that the target is a Linux host, with no alternatives, prerequisites, or exclusions mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_puppet_noopA
Run Puppet agent in no-op mode (dry run) with verbose output
| Name | Required | Description | Default |
|---|---|---|---|
| hostname | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description does real work by disclosing that the run is non-mutating and verbose, which is the key behavioral fact. It says nothing about prerequisites (Puppet installed, root privileges, credentials set up via ssh_setup_credentials) or that Puppet returns a nonzero exit code when drift is detected despite applying nothing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One compact, front-loaded sentence that earns its place and wastes nothing. Slightly under-specified for the gaps it needs to close rather than over-long.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need no explanation, and the single parameter is self-naming. What remains missing is surrounding context — root/credential prerequisites and the fact that a nonzero exit may mean drift rather than failure — which keeps it below complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
One required parameter, hostname, with 0% schema description coverage. The name is self-explanatory and the description adds no syntax (FQDN vs alias vs IP) or format guidance, so this sits at the baseline for a trivial single-param schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb (run Puppet agent), resource (Puppet), and mode (no-op/dry run with verbose output). No sibling does anything Puppet-related, and the parenthetical '(dry run)' removes any ambiguity about what 'no-op' means.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the name and the dry-run framing — an agent can infer this is the safe preview before applying a real Puppet run. But no use cases, no exclusions, and no pointer to alternatives (e.g. use ssh_execute_sudo for a real apply) are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_setup_credentialsC
Setup credentials for a Linux host using GUI prompts
| Name | Required | Description | Default |
|---|---|---|---|
| hostname | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full behavioral disclosure burden. It does reveal that the tool uses interactive GUI prompts, which is valuable, but it says nothing about where credentials are stored, whether existing credentials are overwritten, whether the call blocks waiting for a human, or what permissions it needs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single front-loaded sentence with no wasted words. The brevity borders on under-specification rather than true conciseness, but from a structural standpoint it is efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, but for a credential-mutating, interactive tool with no annotations, the description omits critical facts for an agent: whether a human must be present to answer GUI prompts, whether the call blocks, and whether it affects stored state for other SSH tools. That is a significant gap for this complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for the single required parameter, and the description never mentions hostname or its expected format such as a DNS name or user@host. The word 'host' offers only a faint hint, so the description does not compensate for the undocumented parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb and resource, 'Setup credentials', scoped to a Linux host, and adds the useful detail that it works through GUI prompts. It does not distinguish itself from nearby tools such as cache_credentials or ssh_clear_credentials, which perform related credential operations, so it falls short of full sibling differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to call this instead of cache_credentials, or of when to call it at all relative to ssh_execute_ssh and the other siblings. The agent must infer that this tool is a prerequisite for other SSH operations and that it supersedes other credential-caching options.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
15 tool updates
v0.2.0- First observed
cache_credentials - First observed
execute_ssh - First observed
execute_sudo - First observed
get_disk_usage - First observed
get_running_processes - First observed
get_services - First observed
ssh_clear_credentials - First observed
ssh_execute_ssh - First observed
ssh_execute_sudo - First observed
ssh_get_disk_usage - First observed
ssh_get_running_processes - First observed
ssh_get_services - First observed
ssh_get_system_info - First observed
ssh_puppet_noop - First observed
ssh_setup_credentials
TDQS
Scored across 15 tools
Five of fifteen tools are explicit 'Legacy compatibility' duplicates of newer tools with near-identical descriptions (get_running_processes vs ssh_get_running_processes, execute_ssh vs ssh_execute_ssh, execute_sudo vs ssh_execute_sudo, cache_credentials vs ssh_setup_credentials). An agent must guess whether the legacy or ssh_-prefixed variant is the intended entry point, and the descriptions offer no behavioral difference to disambiguate.
All names are snake_case, but two competing prefix schemes coexist (bare verb_noun vs ssh_-prefixed), and verb ordering flips between pairs like execute_ssh and ssh_execute_ssh. The result is a set where the same action is spelled two different ways, which undermines predictability.
Fifteen tools is within a reasonable range for an SSH/remote-admin server, and the functional surface (execute, sudo, credentials, system info, processes, disk, services, puppet) is sensibly scoped. However, roughly a third of the count is pure legacy duplication, so the effective tool set is ~10 padded out with redundant entries.
Core remote-admin workflows are covered: command execution, privileged execution, credential lifecycle (setup/clear/cache), system info, processes, disk, services, and Puppet dry-run. Gaps exist around file transfer/scp and host inventory listing, but agents can work around these via the execute tools.
Maintenance
Related MCP Connectors
Connect AI assistants to your approved computer for files, commands, browser and desktop tasks.
- DNS-DATA RemoteDeprecatedcom.dns-data
Connect AI assistants to authorized Windows and macOS devices for files, commands, and management.
Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.
Image and video AI tools and your own pipelines, run from any AI assistant.
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceEnables AI assistants to safely perform actions on your computer including file system management, command execution, clipboard access, application launching, and local search with license-based monetization built in.-
- AlicenseNot gradedqualityDmaintenanceProvides AI assistants with direct terminal access to execute commands, manage files, and run persistent REPL sessions. It features automated installation scripts that educate AI assistants on its capabilities for seamless integration.MIT
- AlicenseAqualityBmaintenanceEnables AI assistants to control mobile and desktop devices with natural language, including running automation tasks, taking screenshots, and managing devices.65 npmMIT
- AlicenseNot gradedqualityDmaintenanceEnables AI assistants to control Windows systems through natural language commands, providing 200+ automation tools for system control, file operations, web automation, and more.60MIT