SSH MCP Server
@yawlabs/ssh-mcp
AI 도구를 위한 SSH 환경을 구축하세요. SSH 환경을 관리하고, 문제를 진단 및 해결하며, 에이전트에게 모든 것에 대한 원격 액세스 권한을 부여하는 MCP 서버입니다.
Yaw Labs에서 구축 및 유지 관리합니다.
문제점
AI CLI 도구는 SSH가 지속적으로 끊기는 하위 프로세스에서 실행됩니다. 에이전트가 git pull을 시도하면 Permission denied (publickey) 오류가 발생합니다. 서버에 SSH로 접속하려고 하면 에이전트 소켓이 만료되어 있습니다. 배포를 시도하면 인스턴스가 재생성되어 호스트 키가 변경됩니다. 매번 AI는 무엇이 잘못되었는지 알지 못하고 헤매게 됩니다.
이러한 문제는 SSH 키가 필요한 모든 상황에서 발생합니다:
Git — clone, pull, push, fetch, submodules, LFS
패키지 관리자 — 비공개 저장소에서의
npm install,pip install,go get,cargo,composer서버 액세스 — SSH, SCP, SFTP, rsync
터널링 — 데이터베이스로의 포트 포워딩, SOCKS 프록시
배포 — Ansible, Terraform, Capistrano, 배포 스크립트
클라우드 — AWS EC2, GCP, Azure, DigitalOcean, 모든 VPS
ssh-mcp가 이 문제를 해결합니다. SSH 에이전트를 관리하고, 키를 로드하며, 오류 발생 시 실행 가능한 수정 명령어를 진단하고, 원격 작업을 제공합니다. 이 모든 것이 AI 에이전트가 호출할 수 있는 MCP 도구로 제공됩니다.
Related MCP server: Scout MCP
빠른 시작
npm install -g @yawlabs/ssh-mcpMCP 클라이언트 설정에 추가하세요:
{
"mcpServers": {
"ssh": {
"command": "ssh-mcp"
}
}
}도구
SSH 환경 관리
git, 배포, 터널링 등 모든 작업이 중단되지 않도록 로컬 SSH 설정을 수정하는 도구입니다.
도구 | 설명 |
| ssh-agent가 실행 중인지 확인합니다. 필요시 시작하고 세션에 대한 환경 변수를 설정합니다. |
| ~/.ssh/에 있는 모든 SSH 키를 유형, 지문, 에이전트 상태와 함께 나열합니다. |
| 실행 중인 에이전트에 키를 로드합니다. 먼저 에이전트가 시작되었는지 확인합니다. |
| 호스트에 대한 유효한 SSH 설정(호스트명, 사용자, 포트, 프록시, ID 파일)을 확인합니다. |
| 오래된 호스트 키를 제거하고 다시 스캔합니다. "host key verification failed" 오류를 수정합니다. |
| GitHub, GitLab, Bitbucket 등에 대한 Git-over-SSH 인증을 테스트합니다. |
| 타이밍 및 실행 가능한 오류 세부 정보와 함께 빠른 연결 테스트를 수행합니다. |
진단
도구 | 설명 |
| 전체 SSH 환경 진단. 에이전트, 키, 설정, known_hosts 및 연결 상태를 확인합니다. 모든 오류에 대해 정확한 수정 명령어를 반환합니다. |
원격 작업
도구 | 설명 |
| 원격 호스트에서 명령을 실행합니다. stdout, stderr 및 종료 코드를 반환합니다. |
| SFTP를 통해 원격 호스트에서 파일을 읽습니다. |
| SFTP를 통해 원격 호스트의 파일에 내용을 씁니다. |
| SFTP를 통해 로컬 파일을 원격 호스트에 업로드합니다. |
| 원격 호스트에서 로컬 파일 시스템으로 파일을 다운로드합니다. |
| 원격 호스트의 디렉토리에 있는 파일 목록을 확인합니다. |
상위 수준 작업
ssh_exec를 사용하여 에이전트가 구축하는 일반적인 패턴을 래핑하여 더 빠르고 오류가 적은 도구입니다.
도구 | 설명 |
| 여러 호스트에서 동시에 명령을 실행합니다. 호스트별 결과를 반환합니다. |
| 구조화된 매개변수(이름, 유형, 크기, 깊이)를 사용하여 원격으로 파일을 검색합니다. |
| 파일의 마지막 N줄을 읽으며, 선택적으로 grep 패턴으로 필터링합니다. |
| systemd 서비스 상태(활성, PID, 가동 시간, 설명)를 확인합니다. |
자동 진단
원격 작업이 실패하면 ssh-mcp가 자동으로 진단을 실행하고 오류 응답에 결과를 포함합니다. 에이전트가 별도로 ssh_diagnose를 호출할 필요가 없으며, 오류 메시지에서 바로 무엇이 잘못되었고 어떻게 수정해야 하는지 알 수 있습니다.
연결 풀링
원격 작업은 SSH 연결을 자동으로 재사용합니다. 에이전트가 동일한 호스트에 여러 번 호출하면 첫 번째 호출이 연결을 열고 후속 호출은 이를 재사용합니다. 연결은 마지막 사용 후 60초 동안 유지된 다음 자동으로 닫힙니다.
SSH 설정 지원
모든 연결은 ~/.ssh/config를 준수합니다. 호스트 별칭, 사용자 지정 포트, 사용자 이름, ID 파일 및 ProxyJump 설정이 자동으로 사용됩니다. SSH 설정에 Host myserver가 구성되어 있다면 host: "myserver"만 전달하면 ssh-mcp가 모든 것을 해결합니다.
ProxyJump / 배스천 호스트는 자동으로 지원됩니다. SSH 설정에 호스트에 대한 ProxyJump bastion이 있는 경우, ssh-mcp는 배스천을 통해 투명하게 연결합니다. 체인 프록시도 작동합니다.
호스트 키 확인
모든 원격 작업은 서버의 호스트 키를 ~/.ssh/known_hosts와 비교하여 확인합니다:
알려진 호스트, 키 일치 — 수락.
알려진 호스트, 키 변경됨 — 거부 (MITM 보호).
알려지지 않은 호스트 — 첫 연결 시 수락 (TOFU). 향후 불일치 감지를 위해 키를 고정하려면
ssh_known_hosts_fix를 사용하세요.
더 엄격한 환경의 경우 SSH_MCP_STRICT_HOST_KEY=1을 설정하여 알려지지 않은 호스트를 거부하세요. 먼저 ssh_known_hosts_fix를 사용하여 명시적으로 추가하십시오.
진단 도구(ssh_test, ssh_diagnose)는 프로브 명령에 StrictHostKeyChecking=no를 사용합니다. 이러한 프로브는 echo SSH_OK만 실행하며 자격 증명이나 데이터가 전달되지 않으므로 연결 테스트에 안전합니다. 실제 작업은 항상 hostVerifier를 거칩니다.
Windows 지원
Windows에서 ssh-mcp는 OpenSSH 인증 에이전트 서비스를 자동으로 감지합니다(\.pipeopenssh-ssh-agent 명명된 파이프를 통해). SSH_AUTH_SOCK이 필요하지 않으며, OpenSSH 에이전트 서비스가 실행 중인지 확인하기만 하면 됩니다.
인증
모든 원격 작업은 연결 매개변수를 허용합니다:
매개변수 | 설명 | 기본값 |
| SSH 호스트명 또는 IP (필수) | — |
| SSH 포트 | SSH 설정 또는 |
| SSH 사용자 이름 | SSH 설정 또는 현재 사용자 |
| SSH 개인 키 경로 | 자동 감지 |
| SSH 비밀번호 (키 권장) | — |
인증 해결 순서: ssh-mcp는 이 목록에서 첫 번째 일치 항목을 선택하며 이후 항목으로 넘어가지 않으므로 인증 방법이 결정론적이고 예측 가능합니다.
명시적
privateKeyPath명시적
passwordssh-agent (Unix의
SSH_AUTH_SOCK, Windows의\.pipeopenssh-ssh-agent)호스트에 대한
~/.ssh/config의 ID 파일기본 키 경로 (
~/.ssh/id_ed25519,id_rsa,id_ecdsa)
예시 워크플로우
에이전트가 git pull을 할 수 없는 경우
Agent calls ssh_git_check → "Permission denied. Your SSH key is not registered with github.com."
Agent calls ssh_key_list → finds id_ed25519 exists but is not loaded
Agent calls ssh_key_load("~/.ssh/id_ed25519") → "Key loaded"
Agent calls ssh_git_check → "Git SSH authentication to github.com succeeded as username"
Agent runs git pull → works인스턴스 재생성 후 호스트 키가 변경된 경우
Agent calls ssh_exec on server → error: "Host key verification failed"
(auto-diagnostics included in error: "Fix with ssh_known_hosts_fix")
Agent calls ssh_known_hosts_fix("my-server") → "Host key refreshed"
Agent calls ssh_exec → works새 서버에 대한 첫 연결
Agent calls ssh_test("new-server") → "Connection refused at new-server:22"
Agent calls ssh_diagnose("new-server") → full report showing agent running, keys loaded, but host unreachable
Agent reports: "SSH server isn't running on new-server or port 22 is blocked"프로그래밍 방식 사용
import { connect, exec, diagnose, ensureAgent, listSshKeys, checkGitSsh, ConnectionPool } from '@yawlabs/ssh-mcp';
// Fix SSH environment
const agent = ensureAgent();
console.log(agent.message);
// Check git access
const git = checkGitSsh('github.com');
console.log(git.message);
// List available keys
const keys = listSshKeys();
for (const key of keys) {
console.log(`${key.name} (${key.type}) - ${key.loadedInAgent ? 'loaded' : 'not loaded'}`);
}
// Run a remote command (one-off)
const client = await connect({ host: 'my-server', username: 'deploy' });
const result = await exec(client, 'uptime');
console.log(result.stdout);
client.end();
// Run multiple commands with connection pooling
const pool = new ConnectionPool();
await pool.withConnection({ host: 'my-server' }, async (client) => {
const r1 = await exec(client, 'uptime');
console.log(r1.stdout);
});
// Connection stays open for 60s — next call reuses it
await pool.withConnection({ host: 'my-server' }, async (client) => {
const r2 = await exec(client, 'df -h');
console.log(r2.stdout);
});
pool.drain(); // close all connections when done
// Diagnose issues
const report = diagnose('my-server');
console.log(report.overall); // "ok" | "warning" | "error"
for (const check of report.checks) {
console.log(`[${check.status}] ${check.name}: ${check.message}`);
}요구 사항
Node.js 18+
SSH 클라이언트 설치됨 (진단 및 환경 관리용)
라이선스
MIT
Available Tools
21 toolsssh_agent_ensureA
Ensure ssh-agent is running and reachable. Starts a new agent if needed and sets environment variables so subsequent SSH operations work. Use this FIRST when SSH operations fail with agent-related errors.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the full burden of behavioral disclosure. It reveals that it starts a new agent if needed and sets environment variables, which is the core behavior. However, it does not elaborate on potential side effects (e.g., environment persistence, failure handling, or whether it modifies the current shell or system-wide settings). This is adequate but not fully transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the primary purpose ('Ensure ssh-agent is running and reachable'), followed by a concise explanation and usage trigger. No wasted words; every sentence adds necessary information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no parameters and no output schema, the description fully covers what it does and when to use it. It explains the action (starting agent, setting env vars) and the trigger condition. There are no missing details that an agent would need to correctly select and call this tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. The description adds no parameter-specific detail (none needed), and the schema already has full coverage with an empty properties object. No additional semantic clarification is required.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: ensuring ssh-agent is running and reachable, starting a new agent if needed, and setting environment variables. The verb 'ensure' and resource 'ssh-agent' are specific, and it distinguishes from sibling tools that focus on file operations, execution, or diagnostics.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides an explicit trigger condition: 'Use this FIRST when SSH operations fail with agent-related errors.' This gives clear context for when to invoke the tool, though it does not explicitly mention when not to use it or suggest alternatives (e.g., other diagnostics).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_config_lookupARead-only
Resolve the effective SSH configuration for a host. Shows hostname, user, port, identity files, proxy settings, and all other options from ~/.ssh/config. Use this to understand how SSH will connect to a host.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | SSH hostname or IP address |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so safety is covered. The description adds real information beyond them: the data source (~/.ssh/config) and the fact that it reports the *effective* merged configuration, which tells the agent it is a local, non-mutating resolution rather than a live connection test.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the action and the returned fields. The trailing 'and all other options from ~/.ssh/config' is slightly redundant after the enumeration, but nothing is bloat.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
A single-parameter, read-only, no-output-schema tool; the description plus annotations plus fully documented schema cover what an agent needs to call it correctly. Only the alias-vs-hostname resolution semantics are unstated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single required `host` parameter, so baseline is 3. The description does not clarify whether `host` must be a literal Host alias from config or can be an arbitrary hostname/IP subject to wildcard matching — the one semantic point that would add value here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Resolve the effective SSH configuration for a host') and enumerates the returned fields (hostname, user, port, identity files, proxy settings), which separates it from the exec/file-oriented siblings. It does not, however, explicitly distinguish itself from the closest conceptual neighbor, ssh_diagnose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Use this to understand how SSH will connect to a host' gives an implied context but largely restates the purpose sentence. There is no when-not guidance and no mention of ssh_diagnose or ssh_test as alternatives for connection problems.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_deleteADestructive
Delete a file or empty directory on a remote host via SFTP. Auto-detects the path type and calls the right SFTP op (unlink for files/symlinks, rmdir for empty dirs). Recursive directory delete is intentionally NOT supported -- for that, use ssh_exec with rm -rf explicitly so the destructive intent is visible in the tool trace. If the connection pool is full (SSH_MCP_MAX_POOL_SIZE, default 100), waits up to 30s for a free slot before starting. NOT gated by SSH_MCP_COMMAND_WHITELIST / SSH_MCP_COMMAND_BLACKLIST: command policy applies only to ssh_exec and ssh_multi_exec, so a blacklist such as ^rm does NOT block this tool.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | SSH hostname or IP address | |
| path | Yes | Absolute path of the file or empty directory to delete. Must start with /. | |
| port | No | SSH port (default: 22) | |
| password | No | SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process. | |
| username | No | SSH username (default: current user) | |
| privateKeyPath | No | Path to SSH private key |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and openWorldHint=true, and the description adds context annotations cannot express: path-type auto-detection, the deliberate refusal to recurse, and the 30s pool-wait behavior when SSH_MCP_MAX_POOL_SIZE is exhausted. The only gap is that it does not say what happens on failure (e.g., whether a non-empty directory is rejected with a specific error), so a 4 rather than 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action, then the failure-mode caveat, then the routing alternative, then the operational footnote. Every sentence carries non-redundant information an agent needs: none is filler, and length is justified by the number of distinct behavioral traits disclosed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description must carry the full behavioral picture for a destructive SFTP operation, and it does: what is deleted, what is refused, where to go for recursion, pool-wait behavior, and policy exemption. Nothing an agent needs to call it safely and correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% -- host, path, port, username, password, and privateKeyPath are all documented with defaults and security warnings in the schema itself. The description adds only that the path type is auto-detected, which mildly supplements the `path` param but does not restate or extend the others. Baseline 3 applies when the schema carries this much detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Delete') and resource ('a file or empty directory on a remote host via SFTP') and immediately distinguishes itself from siblings by naming ssh_exec as the recursive-delete path and enumerating the exact SFTP ops used (unlink vs rmdir). An agent can separate this from ssh_mkdir, ssh_write_file, and ssh_exec without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit when/when-not pair: use this for files and empty dirs, do NOT use it for recursive deletes -- use ssh_exec with `rm -rf` instead. It also clarifies the scope of command policy (whitelist/blacklist apply only to ssh_exec and ssh_multi_exec), which prevents the agent from wrongly assuming a blacklist guards this call.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_diagnoseARead-only
Diagnose SSH connectivity issues. Checks ssh-agent status, loaded keys, known_hosts, SSH config, and attempts a test connection. Use this BEFORE attempting SSH operations if you suspect connectivity issues, or AFTER a failed SSH operation to understand why it failed.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | SSH hostname or IP address | |
| port | No | SSH port (default: 22) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true and openWorldHint=true; the description is consistent with that, disclosing that it opens a live connection ("attempts a test connection") and enumerates every probe it runs, which is real value beyond the annotations. It does not say whether the tool always returns diagnostics rather than erroring on a failed connection, nor whether it has notable latency from the network probe.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences: the first names the purpose, the second enumerates what is checked, the third gives the when-to-use conditions. The intent is front-loaded and no sentence is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With only two parameters, one required, and a clear enumeration of probes, the description is sufficient to call it correctly. The one gap is that no output schema exists, so the agent is not told the shape of the diagnostics (per-check pass/fail vs. free-form) nor what is returned when the test connection fails.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and both parameters (host, port) are documented with defaults in the schema, so the schema carries the burden. The description adds no host/port semantics such as whether to pass a hostname from config or whether the port affects all checks, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Diagnose SSH connectivity issues") and enumerates the concrete checks performed (agent status, keys, known_hosts, config, test connection), so an agent knows exactly what it does. It does not, however, distinguish itself from overlapping siblings such as ssh_test, ssh_agent_ensure, ssh_config_lookup, or ssh_known_hosts_fix, which cover a subset of the same ground.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly gives both timing conditions: use BEFORE SSH operations when connectivity is suspect, or AFTER a failure to diagnose. That is a clear, actionable trigger. It stops short of naming alternatives (e.g. "use ssh_test for a single quick reachability check; use ssh_agent_ensure if you only need the agent running").
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_downloadA
Download a file from a remote host to local filesystem via SFTP. If the connection pool is full (SSH_MCP_MAX_POOL_SIZE, default 100), waits up to 30s for a free slot before starting.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | SSH hostname or IP address | |
| port | No | SSH port (default: 22) | |
| password | No | SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process. | |
| username | No | SSH username (default: current user) | |
| localPath | Yes | Local path to save the downloaded file | |
| remotePath | Yes | Absolute path to the remote file. Must start with /. | |
| privateKeyPath | No | Path to SSH private key |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It usefully discloses connection pool behavior: waiting up to 30s when the pool is full and honoring SSH_MCP_MAX_POOL_SIZE. However, it does not disclose other important behavioral traits such as whether an existing local file is overwritten, authentication requirements beyond the schema, or failure/error behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no filler. The core purpose is front-loaded, and the operational detail about pool wait behavior is separated cleanly. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no annotations, the description should cover key operational behavior. It covers purpose and pool waiting, and the schema handles parameter semantics, but it omits what happens on local file conflicts, return values, and explicit guidance for choosing between download and read/upload alternatives. This leaves moderate gaps for an agent deciding how to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 7 parameters including defaults, required fields, the absolute path constraint for remotePath, and the password plaintext warning. The description adds no parameter-level detail beyond indicating the source and destination, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a precise action: 'Download a file from a remote host to local filesystem via SFTP.' It specifies both direction (remote to local) and transport (SFTP), which clearly distinguishes it from siblings like ssh_upload, ssh_read_file, and ssh_write_file.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool—whenever a file needs to be downloaded from a remote host—but provides no explicit guidance about alternatives or when not to use it. It does not mention that ssh_read_file or ssh_exec might be better for reading file contents without copying to local disk.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_execA
Execute a command on a remote host via SSH. The command is interpreted by the remote login shell — pipes, redirects, globs, and other shell metacharacters work as expected. Returns up to three content blocks in this order: the status ([exit code: N], plus the signal and any truncation), then [stderr], then [stdout]. Status comes first so a proxy that cuts long results (Yaw MCP keeps about 100 KB) never drops the exit code; for big output, filter or page on the remote (head, tail, grep). Use env to set environment variables for this call without modifying the command string. Subject to SSH_MCP_COMMAND_WHITELIST / SSH_MCP_COMMAND_BLACKLIST if configured (policy is checked against the env-prefixed command).
| Name | Required | Description | Default |
|---|---|---|---|
| env | No | Environment variables to set for this command. Injected as a `KEY='value' ...` prefix; works on any sshd regardless of AcceptEnv config. VALUES are POSIX-single-quoted, so any byte is safe in a value. KEYS cannot be quoted (a shell assignment prefix requires a bare name), so each key must match /^[A-Za-z_][A-Za-z0-9_]*$/ (the POSIX name grammar) — a key outside that grammar is rejected and the call fails before anything is sent to a host. Command policy is checked against the PREFIXED command, so a `^`-anchored whitelist pattern stops matching once this is set. | |
| host | Yes | SSH hostname or IP address | |
| port | No | SSH port (default: 22) | |
| command | Yes | Shell command to execute on the remote host (interpreted by the remote login shell) | |
| timeout | No | Command timeout in milliseconds (default: 30000). Also the longest the call waits for a free connection-pool slot (SSH_MCP_MAX_POOL_SIZE, default 100) before the command starts; the wait and the command are bounded separately. | |
| password | No | SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process. | |
| username | No | SSH username (default: current user) | |
| privateKeyPath | No | Path to SSH private key |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so well: it discloses the exact three-block return ordering, the rationale for status-first (proxy truncation near 100 KB), and that SSH_MCP_COMMAND_WHITELIST/BLACKLIST may reject the call. These are non-obvious behaviors an agent cannot get from schema or annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action, then layered with return format, truncation rationale, and policy notes — each sentence adds information. Slightly dense with implementation-specific detail (the ~100 KB Yaw MCP figure) that could be trimmed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 8-parameter, nested-object tool with no output schema and no annotations, the description covers what an agent needs: execution semantics, return block layout, truncation behavior, output-size mitigation, env injection, and policy enforcement. Nothing critical to a correct call is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents host, port, timeout, password, and the env quoting/grammar rules in detail. The description only adds the note that policy is checked against the env-prefixed command, which is largely duplicative of the env property's own text.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Execute a command on a remote host via SSH") and clarifies that the remote login shell interprets metacharacters. It never names a sibling, so an agent must infer that ssh_read_file/ssh_write_file/ssh_ls are the narrower alternatives for those operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage guidance is implied rather than explicit: it recommends remote-side filtering (head, tail, grep) for large output and explains `env` for per-call variables, but never says when to prefer ssh_exec over ssh_multi_exec, ssh_read_file, or ssh_tail. The agent gets operational hints but no routing rules.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_findBRead-only
Search for files on a remote host. Wraps the find command with structured parameters so you don't have to construct find syntax manually.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | SSH hostname or IP address | |
| name | No | Filename pattern with wildcards (e.g. '*.log', 'config.*') | |
| path | Yes | Directory to search in (e.g. /var/log, /home/user) | |
| port | No | SSH port (default: 22) | |
| type | No | File type: f=file, d=directory, l=symlink | |
| newer | No | Reference file path -- find matches files modified more recently than this file | |
| maxsize | No | Maximum file size (e.g. '10M', '500k') | |
| minsize | No | Minimum file size (e.g. '1M', '100k') | |
| timeout | No | Command timeout in milliseconds (default: 30000). Also the longest the call waits for a free connection-pool slot (SSH_MCP_MAX_POOL_SIZE, default 100) before the command starts; the wait and the command are bounded separately. | |
| maxdepth | No | Maximum directory depth to search (0 = the path itself only) | |
| password | No | SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process. | |
| username | No | SSH username (default: current user) | |
| privateKeyPath | No | Path to SSH private key |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true, so the safety and network profile is known. The description adds that the operation runs remotely via a wrapped find, but says nothing about result shape, permission failures, partial output, or how the timeout/pool behavior (documented only in the schema) affects the call.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two front-loaded sentences with no filler; the purpose arrives first and the rationale second. It is efficient, though it leaves the description thin relative to a 13-parameter tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With full schema coverage and read-only annotations, the description is minimally sufficient to invoke the tool correctly. However, for a search tool with no output schema, it omits the return format (matched paths? metadata?) and gives no guidance relative to the many sibling listing/inspection tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every one of the 13 parameters is already documented in structured data, including wildcard syntax, size units, and the timeout/pool note. The description adds no parameter-level meaning beyond that, which is the expected baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Search for files on a remote host') plus the underlying mechanism ('wraps the find command'), which separates it from siblings like ssh_ls or ssh_stat. It never names a sibling explicitly, so the differentiation is inferred rather than stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'so you don't have to construct find syntax manually' implies when this tool is preferable to raw ssh_exec, but there are no explicit when-to-use/when-not rules, no mention of ssh_ls as the lighter alternative for simple listing, and no prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_git_checkA
Test Git-over-SSH authentication to a hosting provider (GitHub, GitLab, Bitbucket, etc). Verifies your SSH key is registered and working. Use this when git clone/pull/push fails with SSH errors.
| Name | Required | Description | Default |
|---|---|---|---|
| host | No | Git hosting hostname (default: "github.com"). Omit for the default; an empty string is rejected. | |
| user | No | SSH user for the git host (default: "git"). Omit for the default; an empty string is rejected. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the behavioral disclosure burden. It accurately conveys that the tool performs a test/verification of SSH authentication, implying a non-destructive diagnostic. However, it does not explicitly state the absence of side effects, potential prerequisites (e.g., key loaded via ssh_agent_ensure), or failure modes. This is adequate but not comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, both information-dense without redundancy. The primary action and purpose are front-loaded, followed by a concrete usage condition. No filler words; every phrase contributes to the agent's understanding. This is a model of conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with two optional parameters and no output schema, the description covers the purpose, when to use it, and what it verifies. The only gap is the lack of explicit return-value specification, but given the diagnostic nature, the outcome (success/failure) is implied. The description is complete enough for an agent to select and invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides full descriptions for both parameters (host and user), including defaults and constraints. With 100% schema description coverage, the description adds no additional parameter detail, which is acceptable. The baseline of 3 applies because the schema sufficiently documents the parameters without needing extra elaboration.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Test Git-over-SSH authentication') and clearly identifies the resource (hosting providers like GitHub, GitLab, Bitbucket). It is unambiguous and distinct from generic SSH tools by focusing on Git-over-SSH. The mention of verifying the SSH key registration and working status adds actionable clarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives an explicit trigger: 'Use this when git clone/pull/push fails with SSH errors.' This clearly indicates the intended scenario. It does not explicitly state when not to use it or name alternatives, but the specific use case distinguishes it from siblings like ssh_test without requiring further detail. A stronger exclusion clause would elevate this to 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_key_listARead-only
List all SSH private keys in ~/.ssh/ with their type, fingerprint, and whether they are loaded in the agent. Use this to find which keys are available and which ones need to be loaded. Reports isError only when ~/.ssh exists but could not be read -- an absent or empty ~/.ssh is a successful answer with a ssh-keygen hint.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds genuinely non-obvious behavior beyond the readOnlyHint/openWorldHint annotations: isError is raised only when ~/.ssh exists but is unreadable, while a missing or empty directory is a successful result with a ssh-keygen hint. That error semantics is valuable, though file permissions, symlink handling, and public-key visibility are unstated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences: what it returns first, then when to use it, then error semantics. Every sentence carries information and nothing is repeated from structured fields.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
A zero-parameter read tool with no output schema, and the description covers the returned fields plus the success/failure boundary. Nothing an agent needs in order to call it and interpret the result is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes no parameters, so there is nothing for the description to document and the baseline of 4 applies. The description does not need to compensate for any schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb (list) plus resource (SSH private keys) plus scope (~/.ssh/), and it names the returned fields: type, fingerprint, agent-loaded status. This is clearly distinguishable from ssh_key_load, which it implicitly signals as the follow-up action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
States an explicit usage context: find which keys are available and which need loading, which routes the agent toward ssh_key_load for the second step. It doesn't state any when-not conditions or name the sibling tool outright, so it stops short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_key_loadA
Load an SSH private key into the running agent. Ensures the agent is running first. Use this after ssh_key_list shows a key that is not loaded.
| Name | Required | Description | Default |
|---|---|---|---|
| keyPath | Yes | Path to the SSH private key to load (e.g. ~/.ssh/id_ed25519) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the behavioral burden. It adds useful context by noting 'Ensures the agent is running first', but it does not disclose error handling, idempotency, or permission needs. Minimum viable for a simple load operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, both earning their place. The main action is front-loaded, the prerequisite and usage condition are stated succinctly, with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool with no output schema, this description provides enough to invoke correctly: what it does, a key prerequisite, and the condition for use. It is slightly incomplete in not mentioning return values or error scenarios, but these are minor for this operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single parameter keyPath, and the description does not add meaning beyond what the schema already provides. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Load an SSH private key'), the target ('into the running agent'), and differentiates from siblings by referencing ssh_key_list. It is specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly provides a condition for use ('after ssh_key_list shows a key that is not loaded'), but does not mention when not to use it or compare with sibling ssh_agent_ensure, which also handles agent startup. Lacks explicit alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_known_hosts_fixA
Remove a stale host key from known_hosts and re-scan the host to add the current key. Use this when you see 'Host key verification failed' errors, typically after a server has been recreated or reprovisioned.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | SSH hostname or IP address | |
| port | No | SSH port (default: 22) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and clearly discloses the mutating behavior: removal of a stale key followed by a re-scan to add the current key. It goes beyond the tool name by specifying the action sequence and trigger, although it doesn't mention the affected known_hosts path or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two brief sentences: the first describes the action, the second the trigger. No waste and front-loaded with the primary behavior.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Adequate for a two-parameter tool with no output schema: an agent knows what it does and when to invoke it. It could note that this modifies the local user's known_hosts file, but the action is clear from the phrase 'remove a stale host key from known_hosts'.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, with host and port each described. The description adds no extra parameter detail beyond the schema, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific sequence (remove stale key, re-scan host) on a specific resource (known_hosts), and explicitly names the error condition it addresses. This differentiates it from sibling ssh tools that execute, read, or list remote files.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells when to use: upon 'Host key verification failed' errors after server recreate/reprovision. Does not name alternatives or exclude cases such as using ssh_diagnose for broader connectivity checks, so one point off.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_lsARead-only
List files in a directory on a remote host via SFTP. If the connection pool is full (SSH_MCP_MAX_POOL_SIZE, default 100), waits up to 30s for a free slot before starting.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | SSH hostname or IP address | |
| path | Yes | Absolute path to the remote directory. Must start with /. | |
| port | No | SSH port (default: 22) | |
| password | No | SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process. | |
| username | No | SSH username (default: current user) | |
| privateKeyPath | No | Path to SSH private key |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and openWorldHint, so the safety profile is covered; the description adds genuinely new behavioral context by disclosing the connection-pool limit (SSH_MCP_MAX_POOL_SIZE, default 100) and a 30s wait before starting, which tells the agent this call can block. It stops short of stating result shape, whether listing is recursive, or whether hidden files are included.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero filler, and the core operation is front-loaded ahead of the secondary pool-exhaustion caveat. Every clause carries information an agent can act on.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description is the only place to learn what a listing returns (entry names only? metadata? symlink handling?), and it says nothing about that. The blocking/pool behavior is covered well, but for a read/list tool the return semantics gap is a real omission.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so all six parameters (including the plaintext-password warning and default port/user) are already documented in the schema. The description adds no parameter-level meaning beyond what the schema provides, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List files in a directory on a remote host') plus the transport ('via SFTP'), so the agent knows exactly what operation this performs. It does not, however, distinguish itself from close siblings like ssh_find or ssh_stat, which also touch remote paths.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The second sentence describes pool-exhaustion behavior, not when to choose this tool over alternatives. There is no guidance on when to use ssh_ls versus ssh_find (search), ssh_stat (metadata), or ssh_read_file (contents), and no stated prerequisites beyond the implied SSH connection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_mkdirA
Create a directory on a remote host via SFTP. Set recursive: true to create parent directories as needed (like mkdir -p). Existing intermediate dirs are tolerated; an existing leaf path is still an error. Unlike the other SFTP tools, the path may be relative. If the connection pool is full (SSH_MCP_MAX_POOL_SIZE, default 100), waits up to 30s for a free slot before starting. NOT gated by SSH_MCP_COMMAND_WHITELIST / SSH_MCP_COMMAND_BLACKLIST: command policy applies only to ssh_exec and ssh_multi_exec, so a blacklist such as ^rm does NOT block this tool.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | SSH hostname or IP address | |
| path | Yes | Path of the directory to create. Absolute (starting with /) is recommended and unambiguous. A relative path is also accepted and resolves against the SFTP working directory, which is normally the remote user's home. ~ is NOT expanded — SFTP has no shell to expand it. | |
| port | No | SSH port (default: 22) | |
| password | No | SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process. | |
| username | No | SSH username (default: current user) | |
| recursive | No | Create parent directories as needed (default: false). Like `mkdir -p`. | |
| privateKeyPath | No | Path to SSH private key |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure and does so richly. It documents error semantics ('existing leaf path is still an error'), waiting behavior ('waits up to 30s for a free slot'), and a major security/policy exception ('NOT gated by SSH_MCP_COMMAND_WHITELIST / BLACKLIST'). These exceed basic expectations and give the agent concrete expectations beyond just 'creates a directory.'
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and front-loaded: it opens with the core purpose, then immediately covers recursive behavior, then path relativity, then connection pool, then command policy. Every sentence earns its place; there is no fluff or redundancy. It packs a lot of important detail into a compact paragraph without being verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (mkdir) and a fully documented schema, the description covers the key contextual gaps: error behavior, wait timeout, and command policy interplay. It does not explicitly state what happens after the 30s wait exceeds or what the success return value is, but these are minor for this operation. The description is largely complete for an agent to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds meaningful semantics beyond the schema, particularly for `recursive`: it explains the behavior of existing intermediate dirs vs. an existing leaf path, and the `~` expansion caveat for `path` (though that is also in the schema). This adds value beyond the raw property definitions, justifying a 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb+resource: 'Create a directory on a remote host via SFTP.' This clearly states the tool's action and domain, and it distinguishes itself from siblings by noting 'Unlike the other SFTP tools, the path may be relative,' which helps an agent tell it apart from other SFTP operations like ssh_write_file or ssh_ls.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context about when to use the tool, such as supporting relative paths and the recursive flag behavior, but it stops short of explicitly naming alternatives or saying 'use this instead of ssh_exec for mkdir.' It includes a relevant exclusion about command policy (not gated by whitelist/blacklist), which is an implicit usage condition, but no direct when-not statements.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_multi_execA
Execute a command on multiple remote hosts in parallel. Runs at most SSH_MCP_MAX_POOL_SIZE hosts at once (default 100) and works through a longer list as slots free up. timeout is per host: it bounds each host's command, not the whole call. Each parallel slot works through its share of the list one host at a time, so with the pool to itself a call can take up to about ceil(hosts / SSH_MCP_MAX_POOL_SIZE) x (timeout + connect time). The connection pool is shared with every other tool; when it is full this call waits for slots instead of failing, and gives up only when none of its own hosts holds a slot and a full timeout has passed with none of them starting or finishing. The hosts waiting at that point (up to one per parallel slot) and every host still queued then report Connection pool is full; the queued ones are never attempted. Rerun those hosts once the other calls finish, or raise SSH_MCP_MAX_POOL_SIZE. Returns results per host. Use this instead of calling ssh_exec multiple times — it's faster and shows results side by side. Use env to set environment variables for this call without modifying the command string. Subject to SSH_MCP_COMMAND_WHITELIST / SSH_MCP_COMMAND_BLACKLIST if configured (policy is checked once, against the env-prefixed command, before fan-out).
| Name | Required | Description | Default |
|---|---|---|---|
| env | No | Environment variables to set for this command. Injected as a `KEY='value' ...` prefix; works on any sshd regardless of AcceptEnv config. VALUES are POSIX-single-quoted, so any byte is safe in a value. KEYS cannot be quoted (a shell assignment prefix requires a bare name), so each key must match /^[A-Za-z_][A-Za-z0-9_]*$/ (the POSIX name grammar) — a key outside that grammar is rejected and the call fails before anything is sent to a host. Command policy is checked against the PREFIXED command, so a `^`-anchored whitelist pattern stops matching once this is set. | |
| port | No | SSH port (default: 22) | |
| hosts | Yes | List of SSH hostnames or IPs | |
| command | Yes | Shell command to execute on all hosts | |
| timeout | No | Per-host command timeout in milliseconds (default: 30000): bounds each host's command, not the whole call. Also the call's no-progress budget on a full pool (see the tool description). | |
| password | No | SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process. | |
| username | No | SSH username (default: current user) | |
| privateKeyPath | No | Path to SSH private key |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With zero annotations, the description carries the full burden and does so thoroughly: it discloses the shared connection pool, queueing rather than failing, the exact no-progress give-up condition, which hosts get reported as 'Connection pool is full', and that whitelist/blacklist policy is evaluated once against the env-prefixed command before fan-out. These are non-obvious behaviors an agent could not infer from the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The operation and its primary use case are front-loaded, and the dense middle is warranted by genuinely complex pool semantics. It is longer than ideal — the pool-exhaustion paragraph is a single hard-to-parse sentence — but almost every clause carries operational information rather than filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Concurrency, timeout, policy, and failure behavior are all covered for an 8-parameter tool with no annotations. The one gap is the return value: 'Returns results per host' does not say whether each entry carries exit status, stdout/stderr separation, or how failed hosts are represented, and there is no output schema to fall back on.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description reinforces the important `timeout` scoping (per host, not whole call) and the env-prefix interaction with `^`-anchored whitelists, but those details are already present in the schema, so it adds little beyond structured data.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb, resource, and concurrency mode ('Execute a command on multiple remote hosts in parallel') and explicitly distinguishes itself from the sibling ssh_exec by naming the alternative pattern to avoid. An agent can select this over ssh_exec without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit routing rule ('Use this instead of calling ssh_exec multiple times — it's faster and shows results side by side'), plus remedial guidance for the failure path (rerun the reported hosts or raise SSH_MCP_MAX_POOL_SIZE) and a note on when to prefer `env` over command-string manipulation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_read_fileARead-only
Read a file from a remote host via SFTP. A whole-file read is limited to 10 MB. For a large file -- or behind a proxy that caps results, such as Yaw MCP at about 100 KB -- read it in pages with offset and length (bytes): a paged read returns a status block first ([bytes A-B of SIZE] and the next offset) and then the text. If the connection pool is full (SSH_MCP_MAX_POOL_SIZE, default 100), waits up to 30s for a free slot before starting.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | SSH hostname or IP address | |
| path | Yes | Absolute path to the remote file. Must start with /. | |
| port | No | SSH port (default: 22) | |
| length | No | Number of bytes to read (default: the rest of the file, up to 10 MB). Behind Yaw MCP keep it at or under about 90000 so the page is not cut. A page boundary can split a multi-byte UTF-8 character. | |
| offset | No | Byte offset to start reading at (default 0). Setting offset or length switches to a paged read. | |
| password | No | SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process. | |
| username | No | SSH username (default: current user) | |
| privateKeyPath | No | Path to SSH private key |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnly and openWorld annotations, the description discloses important behavioral traits: the 10 MB whole-file limit, proxy result caps, paged-read status output, UTF-8 boundary splitting, and a 30-second wait when the SSH connection pool is exhausted. These are exactly the operational constraints an agent needs before invoking the tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: the core action and size limit appear first, followed by paging guidance and pool-wait behavior. Every sentence carries useful operational information with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description compensates by explaining paged-read return behavior, size limits, proxy caps, and pool timeouts. Combined with the fully described input schema, an agent has enough context to call this tool correctly and understand its key constraints.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the schema already documents host, path, port, length, offset, auth fields, and pagination behavior in detail. The description adds useful paging context but largely repeats what the schema already conveys about offset and length, so it does not substantially add parameter-level meaning beyond the structured fields.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: reading a remote file via SFTP. It is clearly about file reading, but it does not explicitly differentiate itself from sibling tools such as ssh_download or ssh_tail, which also retrieve remote file content.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives concrete invocation guidance: whole-file reads are capped at 10 MB, and large files or proxy-capped environments should use paged reads with offset and length. It does not explicitly say when to choose this tool over alternatives like ssh_download or ssh_tail, so it stops short of full when/when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_service_statusARead-only
Check the status of a systemd service on a remote host. Returns whether it's active, its PID, uptime, and description. Use this instead of ssh_exec with systemctl.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | SSH hostname or IP address | |
| port | No | SSH port (default: 22) | |
| service | Yes | Systemd service name (e.g. nginx, sshd, docker) | |
| timeout | No | Command timeout in milliseconds (default: 30000). Also the longest the call waits for a free connection-pool slot (SSH_MCP_MAX_POOL_SIZE, default 100) before the command starts; the wait and the command are bounded separately. | |
| password | No | SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process. | |
| username | No | SSH username (default: current user) | |
| privateKeyPath | No | Path to SSH private key |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and openWorldHint, so the safety profile is covered. The description adds value by disclosing the return payload (active state, PID, uptime, description), which is meaningful since there is no output schema. It doesn't mention failure behavior for an unreachable host or unknown unit, keeping it at 4.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences with no filler: purpose first, return contents second, sibling routing third. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description usefully summarizes the returned fields, and the schema carries auth and timeout detail. Minor gaps on error/edge behavior (host unreachable, service not found) keep it just short of complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and every parameter — including the plaintext-password warning and timeout/pool-slot semantics — is documented in the schema itself. The description adds nothing about the 'service' or 'host' arguments, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Check the status of a systemd service on a remote host') and immediately distinguishes itself from the generic sibling by saying to use it instead of ssh_exec with systemctl. An agent can select it over the 20 siblings without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly names the alternative it replaces ('Use this instead of ssh_exec with systemctl'), which is the key routing decision. It stops short of covering edge cases — e.g. non-systemd hosts or when ssh_exec would still be appropriate — so it is clear but not exhaustive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_statARead-only
Get metadata for a file or directory on a remote host via SFTP. Returns size, permissions (octal), uid/gid, mtime/atime, and the path type. Symlinks are reported as symlink -> <target kind>: the type describes the link itself while size/mode/mtime describe its TARGET, and a dangling symlink is reported rather than erroring. Use this instead of parsing ls -la output. If the connection pool is full (SSH_MCP_MAX_POOL_SIZE, default 100), waits up to 30s for a free slot before starting.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | SSH hostname or IP address | |
| path | Yes | Absolute path to the remote file or directory. Must start with /. | |
| port | No | SSH port (default: 22) | |
| password | No | SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process. | |
| username | No | SSH username (default: current user) | |
| privateKeyPath | No | Path to SSH private key |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare readOnly and openWorld; the description goes further with concrete behavior: symlink type describes the link while size/mode/mtime describe the target, dangling symlinks are reported rather than erroring, and pool saturation causes up to a 30s wait (with the SSH_MCP_MAX_POOL_SIZE knob named). That is exactly the kind of context annotations cannot convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with purpose, then the non-obvious symlink semantics, then the pool-wait caveat. Every sentence carries information an agent would otherwise have to guess.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description supplies the return fields (size, octal permissions, uid/gid, mtime/atime, path type) and the symlink edge case, plus latency behavior under pool pressure. Nothing critical for correct invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so host, path, port, credentials and key path are all documented in the schema, including a strong warning about plaintext passwords. The description adds no parameter-level detail beyond the return-field discussion, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Get metadata for a file or directory on a remote host via SFTP') and names the mechanism, immediately distinguishing it from listing tools. The 'instead of parsing ls -la output' line further separates it from ssh_ls-style siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says to use this rather than parsing `ls -la` output, giving a clear usage condition. It does not, however, route against the actual sibling tools (ssh_ls, ssh_find, ssh_read_file) or state when-not-to-use beyond that one comparison.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_tailARead-only
Read the last N lines of a file on a remote host, optionally filtering by a grep pattern. Use this for reading log files instead of ssh_exec with manual tail/grep commands.
| Name | Required | Description | Default |
|---|---|---|---|
| grep | No | Case-insensitive pattern to filter lines | |
| host | Yes | SSH hostname or IP address | |
| path | Yes | Absolute path to the file to tail | |
| port | No | SSH port (default: 22) | |
| lines | No | Number of lines to read from the end (default: 100). Must be a positive integer. | |
| timeout | No | Command timeout in milliseconds (default: 30000). Also the longest the call waits for a free connection-pool slot (SSH_MCP_MAX_POOL_SIZE, default 100) before the command starts; the wait and the command are bounded separately. | |
| password | No | SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process. | |
| username | No | SSH username (default: current user) | |
| privateKeyPath | No | Path to SSH private key |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true, so the safety and environment profile is known. The description adds the intended use case context but says nothing about auth requirements, what happens on a missing file or unreachable host, or whether the connection pool/timeout behavior is shared with ssh_exec; the pool caveat lives only in the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences: the first defines the operation, the second gives the routing advice. Nothing redundant, and the purpose is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 9 parameters, full schema coverage, and annotations covering safety, the description is nearly sufficient for correct invocation. The remaining gap is that it never states what comes back (raw lines? exit status? error message on missing file), which matters slightly more because no output schema exists.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter (host, path, lines, grep, timeout, auth fields) is already documented in structured data. The description mentions line count and grep filtering only in passing and adds no syntax or format detail beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Read the last N lines of a file on a remote host') plus the optional filter, which is a precise and non-tautological statement of what the tool does. It is clearly distinguishable from generic execution siblings like ssh_exec or ssh_multi_exec.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly routes the agent away from the obvious alternative: 'Use this for reading log files instead of ssh_exec with manual tail/grep commands.' It doesn't mention ssh_read_file, which is arguably the closest sibling for plain file reads, so a small differentiation gap remains.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_testA
Quick connectivity test to an SSH host. Reports success/failure with timing and actionable error details. Lighter and faster than ssh_diagnose — use this for a quick check before running operations.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | SSH hostname or IP address | |
| port | No | SSH port (default: 22) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the tool reports success/failure with timing and actionable error details, which informs the agent about the return type and content. It does not mention authentication or potential side effects, but 'test' implies a non-destructive operation. The description adds meaningful context beyond the bare name, so a 4 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: two sentences that front-load the core purpose, then immediately state the differentiation and usage context. Every sentence earns its place, with no redundant phrasing or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple two-parameter schema and absence of an output schema, the description covers the essential aspects: what it does, what it returns (success/failure, timing, error details), and when to use it. It lacks precise output formatting details, but it provides enough for an agent to invoke it correctly and interpret the result. This is nearly complete for such a lightweight tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already covers 100% of parameter descriptions (host and port). The description adds no additional meaning about parameters—it does not explain expected formats, defaults, or how the port is used beyond the schema's basic default of 22. Therefore, the baseline of 3 is appropriate; the description adds no extra value here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: a quick connectivity test to an SSH host, reporting success/failure with timing and error details. It explicitly distinguishes itself from the sibling ssh_diagnose by being lighter and faster, so an agent can easily tell them apart without examining schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states when to use this tool ('use this for a quick check before running operations') and contrasts it with ssh_diagnose ('lighter and faster'). This gives clear context and implies when not to use it (when a deeper diagnostic is needed). The guidance is direct and actionable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_uploadA
Upload a local file to a remote host via SFTP. Reads an arbitrary local file at an agent-chosen localPath -- any file readable by this process leaves the machine toward the remote host (the mirror direction of ssh_download's local write). If the connection pool is full (SSH_MCP_MAX_POOL_SIZE, default 100), waits up to 30s for a free slot before starting. NOT gated by SSH_MCP_COMMAND_WHITELIST / SSH_MCP_COMMAND_BLACKLIST: command policy applies only to ssh_exec and ssh_multi_exec, so a blacklist such as ^rm does NOT block this tool.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | SSH hostname or IP address | |
| port | No | SSH port (default: 22) | |
| password | No | SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process. | |
| username | No | SSH username (default: current user) | |
| localPath | Yes | Path to the local file to upload | |
| remotePath | Yes | Absolute path on the remote host. Must start with /. | |
| privateKeyPath | No | Path to SSH private key |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does substantial work: it discloses that any process-readable file leaves the machine, the 30s pool-wait behavior under SSH_MCP_MAX_POOL_SIZE, and the important exemption from SSH_MCP_COMMAND_WHITELIST/BLACKLIST with a concrete `^rm` example. It does not say whether an existing remote file is overwritten or the call fails, nor what the tool returns, which is a meaningful gap for a write operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the action, then the security and concurrency constraints in descending priority, with no filler. The final policy-exemption sentence is long but earns its length by preventing a real mistaken assumption about blacklists.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 7-parameter mutation tool with no annotations and no output schema, the description covers the safety surface, concurrency behavior, and policy scope well. The remaining gap is overwrite/failure semantics and what a successful call reports, which an agent would want before re-uploading to an existing path.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3; the description rises above it by scoping `localPath` as "agent-chosen" and emphasizing that any readable file is exfiltrated, which is security-relevant meaning the schema's neutral one-liner does not convey. It adds no new detail on `remotePath`, `port`, or auth parameters, but those are already fully documented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening sentence gives a specific verb and resource ("Upload a local file to a remote host via SFTP") and explicitly positions it as the mirror direction of ssh_download. However, it never distinguishes itself from ssh_write_file, the closest sibling, so an agent must infer the boundary between uploading a local file and writing remote content.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied through the ssh_download comparison and by naming ssh_exec/ssh_multi_exec as the tools governed by command policy. There is no explicit "use ssh_upload when X, use ssh_write_file when Y" guidance, leaving the most ambiguous sibling relationship unresolved.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_write_fileADestructive
Write content to a file on a remote host via SFTP. Creates or overwrites the file. If the connection pool is full (SSH_MCP_MAX_POOL_SIZE, default 100), waits up to 30s for a free slot before starting. NOT gated by SSH_MCP_COMMAND_WHITELIST / SSH_MCP_COMMAND_BLACKLIST: command policy applies only to ssh_exec and ssh_multi_exec, so a blacklist such as ^rm does NOT block this tool.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | SSH hostname or IP address | |
| path | Yes | Absolute path to the remote file. Must start with /. | |
| port | No | SSH port (default: 22) | |
| content | Yes | File content to write | |
| password | No | SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process. | |
| username | No | SSH username (default: current user) | |
| privateKeyPath | No | Path to SSH private key |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and openWorldHint=true, and the description adds real value on top: it makes explicit that existing file contents are overwritten, discloses the pool-exhaustion wait (up to 30s, gated by SSH_MCP_MAX_POOL_SIZE, default 100), and clarifies that command blacklists do not protect against it. It omits failure behavior (permission denied, missing parent directory) and whether the write is atomic, which are the remaining gaps for a destructive mutation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose and overwrite semantics before the operational caveats, and every sentence carries information. The blacklist sentence is long and tool-specific but earns its place by preventing a false safety assumption.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive 7-parameter write with full schema coverage, no output schema, and safety hints already in annotations, the description covers purpose, overwrite risk, throughput limits, and a misleading policy assumption. Nothing essential to calling it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the schema already documents host, path, port, content, credentials, and key path with guidance (password plaintext warning, absolute-path requirement). The description adds no parameter-level detail beyond what the schema provides, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (write), resource (remote file), and transport (SFTP), plus the create-or-overwrite semantics. It does not explicitly distinguish itself from ssh_upload, the other obvious write-path sibling, so an agent must infer that ssh_upload takes a local source path while this takes inline content.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear operating context: the tool bypasses SSH_MCP_COMMAND_WHITELIST/BLACKLIST, which is exactly the kind of pre-call assumption an agent might get wrong, and names the sibling tools (ssh_exec, ssh_multi_exec) where policy does apply. It stops short of stating when to prefer ssh_upload or ssh_delete over this tool, so no direct alternative routing is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
3 tool updates
v0.18.1- Changed
ssh_find4 fields changed- changed
Input schema / properties / maxdepth / descriptionPrevious value: -"Maximum directory depth to search"New value: +"Maximum directory depth to search (0 = the path itself only)" - added
Input schema / properties / maxdepth / maximumAdded value: +9007199254740991 - added
Input schema / properties / maxdepth / minimumAdded value: +0 - changed
Input schema / properties / maxdepth / typePrevious value: -"number"New value: +"integer"
- Changed
ssh_multi_exec1 field changed- added
Input schema / properties / hosts / minItemsAdded value: +1
- Changed
ssh_read_file2 fields changed- added
Input schema / properties / lengthAdded value: +{ + "description": "Number of bytes to read (default: the rest of the file, up to 10 MB). Behind Yaw MCP keep it at or under about 90000 so the page is not cut. A page boundary can split a multi-byte UTF-8 character.", + "exclusiveMinimum": 0, + "maximum": 10485760, + "type": "integer" +} - added
Input schema / properties / offsetAdded value: +{ + "description": "Byte offset to start reading at (default 0). Setting offset or length switches to a paged read.", + "maximum": 9007199254740991, + "minimum": 0, + "type": "integer" +}
13 tool updates
v0.17.0- Changed
ssh_delete1 field changed- changed
Input schema / properties / path / descriptionPrevious value: -"Absolute path of the file or empty directory to delete"New value: +"Absolute path of the file or empty directory to delete. Must start with /."
- Changed
ssh_download1 field changed- changed
Input schema / properties / remotePath / descriptionPrevious value: -"Absolute path to the remote file"New value: +"Absolute path to the remote file. Must start with /."
- Changed
ssh_exec2 fields changed- changed
Input schema / properties / env / descriptionPrevious value: -"Environment variables to set for this command. Injected as a `KEY='value' ...` prefix; works on any sshd regardless of AcceptEnv config. Values are POSIX-single-quoted, so any byte is safe."New value: +"Environment variables to set for this command. Injected as a `KEY='value' ...` prefix; works on any sshd regardless of AcceptEnv config. VALUES are POSIX-single-quoted, so any byte is safe in a value. KEYS cannot be quoted (a shell assignment prefix requires a bare name), so each key must match /^[A-Za-z_][A-Za-z0-9_]*$/ (the POSIX name grammar) — a key outside that grammar is rejected and the call fails before anything is sent to a host. Command policy is checked against the PREFIXED command, so a `^`-anchored whitelist pattern stops matching once this is set." - changed
Input schema / properties / timeout / descriptionPrevious value: -"Command timeout in milliseconds (default: 30000)"New value: +"Command timeout in milliseconds (default: 30000). Also the longest the call waits for a free connection-pool slot (SSH_MCP_MAX_POOL_SIZE, default 100) before the command starts; the wait and the command are bounded separately."
- Changed
ssh_find1 field changed- changed
Input schema / properties / timeout / descriptionPrevious value: -"Command timeout in milliseconds (default: 30000)"New value: +"Command timeout in milliseconds (default: 30000). Also the longest the call waits for a free connection-pool slot (SSH_MCP_MAX_POOL_SIZE, default 100) before the command starts; the wait and the command are bounded separately."
- Changed
ssh_git_check4 fields changed- changed
Input schema / properties / host / descriptionPrevious value: -"Git hosting hostname (default: \"github.com\")"New value: +"Git hosting hostname (default: \"github.com\"). Omit for the default; an empty string is rejected." - added
Input schema / properties / host / minLengthAdded value: +1 - changed
Input schema / properties / user / descriptionPrevious value: -"SSH user for the git host (default: \"git\")"New value: +"SSH user for the git host (default: \"git\"). Omit for the default; an empty string is rejected." - added
Input schema / properties / user / minLengthAdded value: +1
- Changed
ssh_ls1 field changed- changed
Input schema / properties / path / descriptionPrevious value: -"Absolute path to the remote directory"New value: +"Absolute path to the remote directory. Must start with /."
- Changed
ssh_mkdir1 field changed- changed
Input schema / properties / path / descriptionPrevious value: -"Absolute path of the directory to create"New value: +"Path of the directory to create. Absolute (starting with /) is recommended and unambiguous. A relative path is also accepted and resolves against the SFTP working directory, which is normally the remote user's home. ~ is NOT expanded — SFTP has no shell to expand it."
- Changed
ssh_multi_exec2 fields changed- added
Input schema / properties / envAdded value: +{ + "additionalProperties": { + "type": "string" + }, + "description": "Environment variables to set for this command. Injected as a `KEY='value' ...` prefix; works on any sshd regardless of AcceptEnv config. VALUES are POSIX-single-quoted, so any byte is safe in a value. KEYS cannot be quoted (a shell assignment prefix requires a bare name), so each key must match /^[A-Za-z_][A-Za-z0-9_]*$/ (the POSIX name grammar) — a key outside that grammar is rejected and the call fails before anything is sent to a host. Command policy is checked against the PREFIXED command, so a `^`-anchored whitelist pattern stops matching once this is set.", + "propertyNames": { + "type": "string" + }, + "type": "object" +} - changed
Input schema / properties / timeout / descriptionPrevious value: -"Command timeout in milliseconds (default: 30000)"New value: +"Per-host command timeout in milliseconds (default: 30000): bounds each host's command, not the whole call. Also the call's no-progress budget on a full pool (see the tool description)."
- Changed
ssh_service_status1 field changed- changed
Input schema / properties / timeout / descriptionPrevious value: -"Command timeout in milliseconds (default: 30000)"New value: +"Command timeout in milliseconds (default: 30000). Also the longest the call waits for a free connection-pool slot (SSH_MCP_MAX_POOL_SIZE, default 100) before the command starts; the wait and the command are bounded separately."
- Changed
ssh_stat1 field changed- changed
Input schema / properties / path / descriptionPrevious value: -"Absolute path to the remote file or directory"New value: +"Absolute path to the remote file or directory. Must start with /."
- Changed
ssh_tail1 field changed- changed
Input schema / properties / timeout / descriptionPrevious value: -"Command timeout in milliseconds (default: 30000)"New value: +"Command timeout in milliseconds (default: 30000). Also the longest the call waits for a free connection-pool slot (SSH_MCP_MAX_POOL_SIZE, default 100) before the command starts; the wait and the command are bounded separately."
- Changed
ssh_upload1 field changed- changed
Input schema / properties / remotePath / descriptionPrevious value: -"Absolute path on the remote host"New value: +"Absolute path on the remote host. Must start with /."
- Changed
ssh_write_file1 field changed- changed
Input schema / properties / path / descriptionPrevious value: -"Absolute path to the remote file"New value: +"Absolute path to the remote file. Must start with /."
1 tool update
v0.11.7- Changed
ssh_read_file1 field changed- changed
Input schema / properties / path / descriptionPrevious value: -"Absolute path to the remote file"New value: +"Absolute path to the remote file. Must start with /."
6 tool updates
v0.11.0- Added
ssh_delete - Changed
ssh_exec1 field changed- added
Input schema / properties / envAdded value: +{ + "additionalProperties": { + "type": "string" + }, + "description": "Environment variables to set for this command. Injected as a `KEY='value' ...` prefix; works on any sshd regardless of AcceptEnv config. Values are POSIX-single-quoted, so any byte is safe.", + "propertyNames": { + "type": "string" + }, + "type": "object" +}
- Changed
ssh_find1 field changed- added
Input schema / properties / newerAdded value: +{ + "description": "Reference file path -- find matches files modified more recently than this file", + "type": "string" +}
- Added
ssh_mkdir - Added
ssh_stat - Changed
ssh_tail4 fields changed- changed
Input schema / properties / lines / descriptionPrevious value: -"Number of lines to read from the end (default: 100)"New value: +"Number of lines to read from the end (default: 100). Must be a positive integer." - added
Input schema / properties / lines / exclusiveMinimumAdded value: +0 - added
Input schema / properties / lines / maximumAdded value: +9007199254740991 - changed
Input schema / properties / lines / typePrevious value: -"number"New value: +"integer"
18 tool updates
v0.9.1- Added
ssh_agent_ensure - Added
ssh_config_lookup - Changed
ssh_diagnose4 fields changed- removed
Input schema / additionalPropertiesRemoved value: -false - added
Input schema / properties / port / maximumAdded value: +65535 - added
Input schema / properties / port / minimumAdded value: +1 - changed
Input schema / properties / port / typePrevious value: -"number"New value: +"integer"
- Changed
ssh_download5 fields changed- removed
Input schema / additionalPropertiesRemoved value: -false - changed
Input schema / properties / password / descriptionPrevious value: -"SSH password (prefer keys)"New value: +"SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process." - added
Input schema / properties / port / maximumAdded value: +65535 - added
Input schema / properties / port / minimumAdded value: +1 - changed
Input schema / properties / port / typePrevious value: -"number"New value: +"integer"
- Changed
ssh_exec9 fields changed- removed
Input schema / additionalPropertiesRemoved value: -false - changed
Input schema / properties / command / descriptionPrevious value: -"Shell command to execute on the remote host"New value: +"Shell command to execute on the remote host (interpreted by the remote login shell)" - changed
Input schema / properties / password / descriptionPrevious value: -"SSH password (prefer keys)"New value: +"SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process." - added
Input schema / properties / port / maximumAdded value: +65535 - added
Input schema / properties / port / minimumAdded value: +1 - changed
Input schema / properties / port / typePrevious value: -"number"New value: +"integer" - added
Input schema / properties / timeout / exclusiveMinimumAdded value: +0 - added
Input schema / properties / timeout / maximumAdded value: +9007199254740991 - changed
Input schema / properties / timeout / typePrevious value: -"number"New value: +"integer"
- Added
ssh_find - Added
ssh_git_check - Added
ssh_key_list - Added
ssh_key_load - Added
ssh_known_hosts_fix - Changed
ssh_ls5 fields changed- removed
Input schema / additionalPropertiesRemoved value: -false - changed
Input schema / properties / password / descriptionPrevious value: -"SSH password (prefer keys)"New value: +"SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process." - added
Input schema / properties / port / maximumAdded value: +65535 - added
Input schema / properties / port / minimumAdded value: +1 - changed
Input schema / properties / port / typePrevious value: -"number"New value: +"integer"
- Added
ssh_multi_exec - Changed
ssh_read_file5 fields changed- removed
Input schema / additionalPropertiesRemoved value: -false - changed
Input schema / properties / password / descriptionPrevious value: -"SSH password (prefer keys)"New value: +"SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process." - added
Input schema / properties / port / maximumAdded value: +65535 - added
Input schema / properties / port / minimumAdded value: +1 - changed
Input schema / properties / port / typePrevious value: -"number"New value: +"integer"
- Added
ssh_service_status - Added
ssh_tail - Added
ssh_test - Changed
ssh_upload5 fields changed- removed
Input schema / additionalPropertiesRemoved value: -false - changed
Input schema / properties / password / descriptionPrevious value: -"SSH password (prefer keys)"New value: +"SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process." - added
Input schema / properties / port / maximumAdded value: +65535 - added
Input schema / properties / port / minimumAdded value: +1 - changed
Input schema / properties / port / typePrevious value: -"number"New value: +"integer"
- Changed
ssh_write_file5 fields changed- removed
Input schema / additionalPropertiesRemoved value: -false - changed
Input schema / properties / password / descriptionPrevious value: -"SSH password (prefer keys)"New value: +"SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process." - added
Input schema / properties / port / maximumAdded value: +65535 - added
Input schema / properties / port / minimumAdded value: +1 - changed
Input schema / properties / port / typePrevious value: -"number"New value: +"integer"
7 tool updates
v0.2.0- First observed
ssh_diagnose - First observed
ssh_download - First observed
ssh_exec - First observed
ssh_ls - First observed
ssh_read_file - First observed
ssh_upload - First observed
ssh_write_file
TDQS
Scored across 21 tools
Every tool targets a clearly distinct operation (exec, file read/write, upload/download, ls/stat/delete/mkdir, key management, diagnostics), and the descriptions explicitly disambiguate close pairs like ssh_test vs ssh_diagnose and ssh_write_file vs ssh_upload. Minor overlap remains: ssh_tail and ssh_find are convenience wrappers around what ssh_exec could do, and ssh_agent_ensure vs ssh_diagnose overlap on agent troubleshooting.
All 21 tools share a predictable `ssh_` namespace and are readable at a glance. There is a near-even split between verb_noun (ssh_read_file, ssh_mkdir, ssh_multi_exec) and noun_verb ordering (ssh_key_list, ssh_config_lookup, ssh_git_check, ssh_known_hosts_fix), plus a special case ssh_ls, which is a small but real deviation.
21 tools is on the heavy side for this domain, with several thin convenience wrappers (ssh_tail, ssh_find, ssh_service_status, ssh_test) that could be expressed via ssh_exec. Each earns some place, but the surface feels broader than the core task strictly requires.
Strong lifecycle coverage: exec, multi-host exec, full SFTP file operations, directory creation, stat/metadata, key listing/loading, config lookup, known_hosts repair, and diagnostics. Gaps are moderate: no rename/move, chmod/chown, symlink creation, or key generation tool, forcing fallbacks to ssh_exec (or leaving no clean path for keygen).
Maintenance
Related MCP Connectors
Scoped, audited SSH exec, sessions, and SFTP on your saved servers without exposing credentials
Securely control computers you explicitly pair through files, terminals, processes, screenshots, desktop UI/input, clipboard, browser automation, diagnostics, and document tools.
Manage remote servers, SSH terminals, files, databases and proxies with scoped access and approvals.
Remote shell and detached long-running jobs on your own machines — no SSH, open ports or VPN.
Related MCP Servers
- AlicenseBqualityDmaintenanceEnables seamless SSH operations including secure connections, file transfers, interactive shell sessions, and Docker container management on remote servers. Supports both password and SSH key authentication with credential management and connection pooling.18MIT
- FlicenseNot gradedqualityDmaintenanceEnables remote file operations and command execution across multiple machines via SSH. Supports reading files, listing directories, and running commands on any host configured in your SSH config.-
- AlicenseAqualityDmaintenanceEnables secure SSH connections to multiple remote servers with support for command execution, file transfers (SFTP), directory listing, and both password and key-based authentication.7MIT
- AlicenseNot gradedqualityDmaintenanceEnables executing commands on remote SSH hosts, with full support for bastion/jump hosts and ~/.ssh/config, plus Slurm job management and rsync.4MIT