ssh-mcp

Overview Schema Source Related Servers Discussions Admin

execute

Run shell commands on a remote SSH server and retrieve output, errors, and exit codes. Supports working directories, timeouts, dry-run previews, and safety filtering to prevent destructive actions.

Instructions

Execute a shell command on a single SSH server.

Args: server: Server name (e.g. 'web-prod-01'). Must match a configured server. Use list_servers to see available servers. command: Shell command to execute on the remote server (exactly as it would be typed at a bash prompt). Rejected if it exceeds max_command_bytes (default 65536 encoded UTF-8 bytes). timeout: Command timeout in seconds. Default 30. Not range-checked, and NOT authoritative: a timeout set on the server's entry in servers.toml overrides this argument outright, so a per-server 30 wins over a caller-supplied 600. working_dir: Absolute remote directory to cd into before running the command. Uses the server's default_dir from servers.toml if omitted, or the SSH login directory if neither is set. force: If True, bypass the dangerous-command detection patterns. Use only for audited bulk operations. The block list is ~25 regexes and is broader than "obviously destructive": besides rm -rf /, mkfs, dd-to-disk, chmod 777 /, redirects into /dev/sd* and /etc/{passwd,shadow,gshadow,sudoers}, find -delete / -exec rm, shred / wipefs / blkdiscard / sgdisk on /dev/, partition-table edits, and fork bombs, it also rejects ordinary interpreter wrappers — bash -c ..., python3 -c ... (also perl/ruby -c/-e), eval "...", and base64 -d | sh. Harmless commands in those forms need force=True too. Default False. dry_run: If True, do NOT connect or execute. Return a preview describing what would run (server, command, working_dir, timeout, force). Dangerous-command detection still runs so rejection can be previewed. Useful for LLM plans that want to validate intent before committing. Default False.

Returns: Formatted command execution result with stdout, stderr, and exit code. Long output is truncated at max_output_bytes (default 50 KiB) PER STREAM — stdout and stderr get independent budgets, so the combined worst case is 2x that setting. A truncated stream ends with [... output truncated at N bytes], and hitting the cap TERMINATES the remote process rather than letting it keep writing.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`force`	No
`server`	Yes
`command`	Yes
`dry_run`	No
`timeout`	No
`working_dir`	No

Output Schema

TableJSON Schema

Name	Required	Description	Default
`result`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedv0.1.1Jul 4, 2026

addedInput schema / properties / dry_run

Added value: +{
+  "default": false,
+  "title": "Dry Run",
+  "type": "boolean"
+}

First observedv0.1.0Mar 11, 2026

TDQS

A4.8/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and succeeds. It discloses dangerous-command detection and force bypass behavior, timeout override from servers.toml, dry_run's no-execution preview behavior, per-stream output truncation limits, and that hitting the output cap terminates the remote process. These are non-obvious behaviors essential for safe invocation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long, but it is well-structured with Args and Returns sections, and the one-sentence purpose is front-loaded. The detailed force list and timeout caveats are high-value for a command-execution tool where the agent could otherwise invoke it incorrectly; no section is redundant with the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex 6-parameter tool with no annotations, the description is complete: it covers server discovery, command size limits, defaulting behavior, dangerous-command safety, dry-run behavior, output truncation, and process termination. The Returns section also explains what the agent can expect clearly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description documents every parameter with meaning beyond the schema: server must match a configured entry, command size limits, timeout precedence semantics, working_dir fallbacks, force safety implications, and dry_run preview behavior. It fully compensates for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence uses a specific verb ('Execute') with a resource ('shell command') and scope ('single SSH server'), immediately distinguishing this tool from sibling execute_on_group. The parameter documentation further clarifies that server must be a configured server name discoverable via list_servers.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context: use this for a single SSH server, and tells the agent to call list_servers to discover valid server names. It stops just short of explicitly saying 'for multiple servers, use execute_on_group instead', so it lacks a fully explicit alternative statement.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server