Skip to main content
Glama

ssh-mcp

SSH MCP server that lets AI assistants execute commands on remote servers.

License: MPL-2.0 Claude Code Ready

What is this

ssh-mcp is a Model Context Protocol server that gives AI assistants like Claude direct access to your SSH infrastructure. Once configured, Claude can run commands, transfer files, and query server groups across your fleet without leaving the conversation.

Connection details are read from your existing ~/.ssh/config. No credentials are stored in the MCP configuration.

Related MCP server: ssh-mcp-server

Features

  • Run shell commands on individual servers or across entire groups in parallel

  • SFTP file upload and download over the existing SSH session

  • Connection pooling — reuses SSH connections across tool calls

  • Dangerous command detection — warns before executing destructive operations

  • Server groups for organizing hosts (production, staging, per-service)

  • SSH config integration — reads host, port, user, and identity from ~/.ssh/config

  • Custom config path via SSH_MCP_CONFIG environment variable

Quick Start

Install

# Run directly with uvx (no install required)
uvx ssh-mcp

# Or install with pip
pip install ssh-mcp

Requires Python 3.11+. Install uv to use uvx.

Docker

A prebuilt image is published to GitHub Container Registry:

docker pull ghcr.io/blackaxgit/ssh-mcp:latest

Or run with Docker Compose:

services:
  ssh-mcp:
    image: ghcr.io/blackaxgit/ssh-mcp:latest
    stdin_open: true
    restart: unless-stopped
    environment:
      SSH_MCP_CONFIG: /config/servers.toml
    volumes:
      - ./servers.toml:/config/servers.toml:ro
      - ~/.ssh:/home/sshmcp/.ssh:ro

The image uses a non-root sshmcp user (uid 1000). Mount your SSH keys and config file read-only. See compose.yaml in the repo for a working example.

Create a config file

mkdir -p ~/.config/ssh-mcp
cp config/servers.example.toml ~/.config/ssh-mcp/servers.toml

Edit ~/.config/ssh-mcp/servers.toml and add your servers. Server names must match Host entries in ~/.ssh/config.

Add to Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or the equivalent on your platform:

{
  "mcpServers": {
    "ssh-mcp": {
      "command": "uvx",
      "args": ["ssh-mcp"]
    }
  }
}

To use a non-default config path, pass the environment variable:

{
  "mcpServers": {
    "ssh-mcp": {
      "command": "uvx",
      "args": ["ssh-mcp"],
      "env": {
        "SSH_MCP_CONFIG": "/path/to/servers.toml"
      }
    }
  }
}

Restart Claude Desktop after editing the config.

Add to Claude Code

If you use Claude Code instead of Claude Desktop, you can set everything up from the terminal:

# 1. Add the MCP server
claude mcp add ssh-mcp -- uvx ssh-mcp

# 2. Create the config directory and copy the example
mkdir -p ~/.config/ssh-mcp
curl -sL https://raw.githubusercontent.com/blackaxgit/ssh-mcp/main/config/servers.example.toml \
  > ~/.config/ssh-mcp/servers.toml

# 3. Edit with your servers (server names must match ~/.ssh/config Host entries)
${EDITOR:-nano} ~/.config/ssh-mcp/servers.toml

# 4. Restrict permissions
chmod 600 ~/.config/ssh-mcp/servers.toml

To use a custom config path:

claude mcp add ssh-mcp -e SSH_MCP_CONFIG=/path/to/servers.toml -- uvx ssh-mcp

Configuration

Environment variables

Variable

Default

Purpose

SSH_MCP_CONFIG

Absolute path to a TOML config file. Overrides the default search path.

SSH_MCP_LOG_FORMAT

console

Log output format. Set to json to emit single-line JSON events (timestamp, level, event, contextvars) suitable for log aggregators like Loki, Datadog, or Splunk. Any other value falls back to the colorized console renderer.

SSH_MCP_TRANSPORT

stdio

MCP transport. stdio = classic subprocess transport (default, used by Claude Desktop / Claude Code via uvx ssh-mcp). http or streamable-http = run as a network service over MCP streamable HTTP.

SSH_MCP_HTTP_HOST

127.0.0.1

Bind address for HTTP transport. Binding to any non-localhost value (e.g. 0.0.0.0) REQUIRES SSH_MCP_HTTP_TOKEN — startup aborts otherwise.

SSH_MCP_HTTP_PORT

8000

TCP port for HTTP transport.

SSH_MCP_HTTP_TOKEN

Shared bearer secret. When set, every request must carry Authorization: Bearer <token> (scheme case-insensitive per RFC 7235) or receive HTTP 401. Mandatory for non-localhost binds (unless SSH_MCP_HTTP_AUTH=none). Minimum length 16 characters — shorter tokens are rejected at startup. Leading/trailing whitespace is stripped so .env files with trailing newlines work as expected.

SSH_MCP_HTTP_TOKEN_FILE

Path to a file containing the bearer token (alternative to SSH_MCP_HTTP_TOKEN). Read at startup, stripped of whitespace. Preferred for Docker secrets: mount the secret file and point this env var at it.

SSH_MCP_HTTP_AUTH

bearer

Authentication mode. bearer (default) enables the built-in middleware. none disables it entirely — useful when ssh-mcp sits behind a trusted reverse proxy that handles auth at the edge. Combining none with a non-localhost bind REQUIRES the explicit acknowledgement env var below.

SSH_MCP_HTTP_NETWORK_NO_AUTH

Magic-string escape hatch. Must equal literal I_ACCEPT_RCE_RISK to allow SSH_MCP_HTTP_AUTH=none + non-localhost bind. Intentionally verbose so nobody sets it by accident.

SSH_MCP_HTTP_KEEPALIVE_TIMEOUT

2

uvicorn timeout_keep_alive in seconds. Idle HTTP/1.1 connections are closed after this many seconds. v0.4.0 default (5s) accumulated enough concurrent connections under bursty n8n traffic to exhaust the container's 1024 fd limit — v0.4.1 default 2s is safer for spiky clients. Increase to 5–10 for long-polling MCP clients behind a load balancer.

SSH_MCP_HTTP_LIMIT_CONCURRENCY

256

uvicorn limit_concurrency. Max simultaneous in-flight requests before returning HTTP 503. Prevents unbounded growth under burst load. Tune up for high-QPS deployments; tune down on small containers.

SSH_MCP_HTTP_BACKLOG

128

uvicorn backlog — TCP listen backlog for the accept queue. Smaller caps SYN-flood exposure.

fd exhaustion mitigation: the Docker base image inherits a 1024 fd limit by default. Under sustained burst traffic that can run out quickly. Raise it in your compose file:

ssh-mcp:
  # ...
  ulimits:
    nofile:
      soft: 65536
      hard: 65536

Pair that with the SSH_MCP_HTTP_KEEPALIVE_TIMEOUT / SSH_MCP_HTTP_LIMIT_CONCURRENCY knobs above for a full fix. | SSH_MCP_HTTP_STATELESS | false | Set to true for stateless sessions (recommended for load-balanced or serverless deployments). Default is stateful with server-side sessions. | | SSH_MCP_HTTP_ALLOWED_HOSTS | — | Comma-separated extra Host-header values the SDK's DNS-rebinding protection should permit (e.g. ssh-mcp.internal:*,api.example.com:8000). Localhost aliases are always permitted. | | HYPOTHESIS_PROFILE | dev | For local development / CI only. Set to ci to run property-based tests with max_examples=200 instead of 50. |

Running over HTTP

ssh-mcp exposes the MCP streamable HTTP transport as an alternative to stdio. This lets MCP-aware clients connect over the network instead of launching a subprocess, which is useful for containerized deployments, shared-team servers, or anything that needs to survive a client restart.

WARNING: ssh-mcp serves plain HTTP, not HTTPS. The bearer token is transmitted in cleartext on every request. Deploying on a public IP without a TLS-terminating reverse proxy (Caddy, nginx, Traefik) exposes the token to any network observer — equivalent to publishing a root shell. Always terminate TLS before ssh-mcp reaches the network.

Security first. ssh-mcp runs shell commands on remote servers. Exposing the HTTP endpoint without authentication is equivalent to exposing a root shell. The startup code enforces this:

  • Binding to 127.0.0.1 / localhost / ::1 without a token is allowed — this matches the single-user workstation model.

  • Binding to ANY other address without SSH_MCP_HTTP_TOKEN raises RuntimeError at startup and the process exits.

  • The MCP SDK's DNS-rebinding protection is enabled by default. Remote clients connecting via a hostname must have it listed in SSH_MCP_HTTP_ALLOWED_HOSTS.

  • Bearer-token comparison uses hmac.compare_digest to prevent timing attacks.

Local loopback (no auth needed):

SSH_MCP_TRANSPORT=http ssh-mcp
# → listening on http://127.0.0.1:8000/mcp

Container deployment with bearer auth:

TOKEN=$(openssl rand -hex 32)
docker run -d \
  -p 8000:8000 \
  -e SSH_MCP_TRANSPORT=http \
  -e SSH_MCP_HTTP_HOST=0.0.0.0 \
  -e SSH_MCP_HTTP_TOKEN="$TOKEN" \
  -e SSH_MCP_HTTP_STATELESS=true \
  -e SSH_MCP_HTTP_ALLOWED_HOSTS='ssh-mcp.internal:*' \
  -v ~/.ssh:/home/sshmcp/.ssh:ro \
  -v ./servers.toml:/config/servers.toml:ro \
  -e SSH_MCP_CONFIG=/config/servers.toml \
  ghcr.io/blackaxgit/ssh-mcp:latest

Clients connect with:

Authorization: Bearer <TOKEN>
Host: ssh-mcp.internal

For stateful sessions (default), FastMCP maintains per-client context across requests. For stateless deployments behind a load balancer, set SSH_MCP_HTTP_STATELESS=true — each request is handled independently with no server-side session.

Healthcheck

The Docker image includes a built-in ssh-mcp healthcheck CLI subcommand that Docker's HEALTHCHECK directive invokes automatically. No inline Python, no curl, no manual compose surgery required. The subcommand:

  • Auto-detects the transport via SSH_MCP_TRANSPORT:

    • stdio mode: verifies the package imports and servers.toml parses

    • http mode: sends a real MCP initialize JSON-RPC POST and checks for any non-5xx response

  • Reads the same auth env vars as the server (SSH_MCP_HTTP_TOKEN, SSH_MCP_HTTP_TOKEN_FILE, SSH_MCP_HTTP_AUTH) — never logs the token

  • Exits 0 if healthy, 1 otherwise

  • Uses Python stdlib only (no curl/wget dependency)

  • 3-second hard timeout per probe

Run manually for debugging:

docker exec ssh-mcp ssh-mcp healthcheck && echo "healthy"

Check current status:

docker inspect ssh-mcp --format '{{.State.Health.Status}}'

To override the baked-in settings in your compose file:

healthcheck:
  test: ["CMD", "ssh-mcp", "healthcheck"]
  interval: 15s
  timeout: 5s
  retries: 3
  start_period: 10s

Reverse proxy deployment (auth at the edge)

If your reverse proxy (Caddy, nginx, Traefik, Envoy, Cloudflare Access, etc.) already authenticates requests before they reach ssh-mcp, you can disable the built-in bearer middleware with SSH_MCP_HTTP_AUTH=none. This mode is deliberately hard to enable on a public bind — you must also set a verbose acknowledgement env var:

docker run -d \
  --network internal \
  -e SSH_MCP_TRANSPORT=http \
  -e SSH_MCP_HTTP_HOST=0.0.0.0 \
  -e SSH_MCP_HTTP_AUTH=none \
  -e SSH_MCP_HTTP_NETWORK_NO_AUTH=I_ACCEPT_RCE_RISK \
  -e SSH_MCP_HTTP_ALLOWED_HOSTS='ssh-mcp.internal:*' \
  -v ~/.ssh:/home/sshmcp/.ssh:ro \
  -v ./servers.toml:/config/servers.toml:ro \
  -e SSH_MCP_CONFIG=/config/servers.toml \
  ghcr.io/blackaxgit/ssh-mcp:latest

WARNING: SSH_MCP_HTTP_AUTH=none + SSH_MCP_HTTP_NETWORK_NO_AUTH=I_ACCEPT_RCE_RISK is a remote code execution surface. The magic-string acknowledgement exists so operators physically type the words "I ACCEPT RCE RISK" before opting in. Every tool call reaches a shell on every managed SSH server. Use this only when:

  1. ssh-mcp is on a private Docker network not reachable from the host's public interface, AND

  2. The reverse proxy fronting it enforces authentication (basic auth, OAuth, mTLS, Cloudflare Access, etc.), AND

  3. You have audit logging on the proxy that's immutable to the ssh-mcp process.

For localhost binds without auth, no acknowledgement is needed — that matches the historical stdio deployment model.

Config file location

Checked in order:

  1. $SSH_MCP_CONFIG environment variable

  2. ~/.config/ssh-mcp/servers.toml (default)

  3. config/servers.toml relative to the package (development only)

Example servers.toml:

[settings]
ssh_config_path = "~/.ssh/config"
command_timeout = 30          # seconds, range 1..3600
max_output_bytes = 51200      # truncate captured output at this many bytes
connection_idle_timeout = 300 # seconds; eviction scan runs every 60s
known_hosts = true            # false removes MITM protection
max_parallel_hosts = 10       # concurrency cap for execute_on_group (1..100)

[groups]
production = { description = "Production servers" }
staging    = { description = "Staging servers" }

[servers.web-prod-01]
description = "Production web server"
groups      = ["production"]

[servers.web-staging-01]
description = "Staging web server"
groups      = ["staging"]
jump_host   = "bastion"

[servers.db-prod-01]
description = "Production database"
groups      = ["production"]
user        = "dbadmin"

Per-server overrides (user, jump_host) take precedence over ~/.ssh/config. See config/servers.example.toml for the full reference.

Restrict config file permissions to your user:

chmod 600 ~/.config/ssh-mcp/servers.toml

Available Tools

Tool

Description

list_servers

List configured servers; optionally filter by group

list_groups

List server groups with member counts

execute

Run a shell command on a single server (supports force to bypass dangerous-command detection)

execute_on_group

Run a command on all servers in a group (parallel; supports fail_fast and force)

upload_file

Upload a local file to a server via SFTP (validates both local and remote paths)

download_file

Download a file from a server via SFTP (validates both local and remote paths)

Security

Dangerous command blocking. ssh-mcp rejects commands that match known destructive patterns — rm -rf /, rm -rf ~, find / -delete, find / -exec rm, shred /dev/*, wipefs /dev/*, mkfs, dd if=..., > /dev/sd*, chmod 777 /, fork bombs (spaced and adjacent variants) — unless the tool caller passes force=true. ASCII control characters (null bytes, newlines, \x01..\x1f, \x7f) are normalized to spaces before matching, so rm\x00-rf / is caught just like rm -rf /. The regex is fuzz-tested with Hypothesis on every CI run.

This is a TRIPWIRE, not a security boundary. The regex catches obvious accidents and shortcut destructive commands. It does NOT defend against a motivated attacker:

  • Base64-encoded payloads (echo <b64> | base64 -d | bash) bypass by design

  • Shell hex escapes ($'\x72\x6d -rf /') are interpreted AFTER regex matching

  • Unicode homoglyphs (Cyrillic р, Greek ρ) do not match Latin r

  • Indirection via $(...), `...`, eval, python -c, etc. can hide intent

If you need real isolation for untrusted tool callers, sandbox at a lower layer: run ssh-mcp inside a container with a restricted SSH config, use ForceCommand on the managed servers, or audit force=false usage via the structured logs. The dangerous-command filter exists to stop LLM accidents and typos, not adversaries.

When force=true is used, the audit log records the bypass explicitly so the operator has a clean paper trail. Do not grant force=true to untrusted MCP clients.

Credential redaction in logs. ssh-mcp automatically redacts known credential patterns (MySQL -p<pass>, --password=, PGPASSWORD=, Authorization: Bearer, URL basic-auth user:pass@host, plus any env var ending in _PASSWORD, _SECRET, _TOKEN, _KEY, _CREDENTIAL, _PWD) from audit logs and OTel span attributes before they reach stderr or trace backends. The asyncssh internal channel logger is suppressed to WARNING level so it never emits the raw command.

Known limitation: command OUTPUT is NOT redacted. If you run cat /etc/mysql/my.cnf, env | grep PASSWORD, or kubectl get secret X -o yaml, the stdout/stderr returned to the MCP client will contain plaintext secrets. The redaction pipeline only filters the COMMAND string (what you asked to run), not the OUTPUT (what it printed). Avoid running commands that print secrets via ssh-mcp — pass credentials through env vars, Docker/K8s secrets, or dedicated config files instead.

Path validation. SFTP upload_file and download_file validate both remote and local paths. Any of these block the transfer:

  • Sensitive Unix paths: /etc/shadow, /etc/passwd

  • SSH key material: ~/.ssh/authorized_keys, ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.ssh/id_ecdsa, ~/.ssh/id_dsa

  • Any path containing .. (parent traversal)

This prevents an LLM client from exfiltrating secrets on either the MCP host or a managed server.

Host key verification is on by default (known_hosts = true). Disabling StrictHostKeyChecking in ~/.ssh/config weakens MITM protection and should be avoided in production.

Audit logging. Every tool call is logged to stderr with server, command, exit_code, duration_ms, and (for SFTP) byte counts. SFTP operations emit three-stage events: sftp.upload.startsftp.upload.complete (or sftp.upload.failed), each tagged with a stable connection_id so a single transfer is grep-correlatable.

For production log aggregation, set SSH_MCP_LOG_FORMAT=json to emit single-line JSON events:

{"event": "sftp.upload.complete bytes=4096 duration_ms=183", "level": "info", "timestamp": "2026-04-08T16:00:11.761575Z", "server": "web-prod-01", "operation": "upload", "local_path": "/tmp/app.tar.gz", "remote_path": "/var/www/release.tar.gz", "connection_id": "web-prod-01-4242-a3f1c9d2"}

When running in Docker, capture stderr with docker logs for the audit trail.

For vulnerability reports, see SECURITY.md. Do not open public GitHub issues for security concerns.

Development

git clone https://github.com/blackaxgit/ssh-mcp.git
cd ssh-mcp
uv sync --extra dev
uv run pytest
uv run ruff check .

See CONTRIBUTING.md for guidelines on making changes and submitting pull requests.

Changelog

See CHANGELOG.md.

License

Mozilla Public License 2.0. See LICENSE.

Available Tools

6 tools
download_fileA

Download a file from a remote server via SFTP.

Args: server: Server name (e.g. 'pro-dicentra'). remote_path: Absolute path to remote file. local_path: Absolute local destination path.

Returns: Confirmation message with file size.

ParametersJSON Schema
NameRequiredDescriptionDefault
serverYes
local_pathYes
remote_pathYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions the SFTP protocol and describes the return value, but doesn't cover important behavioral aspects like error conditions, timeout behavior, authentication requirements, file size limitations, or whether the operation is idempotent. The description provides basic operational context but lacks comprehensive behavioral transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections (purpose, Args, Returns) and uses minimal sentences. Each sentence earns its place by providing essential information. The formatting is efficient, though the 'Args:' and 'Returns:' labels could be slightly more concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has an output schema (which handles return value documentation), no annotations, and 3 parameters with good description coverage, the description is reasonably complete. It covers the core operation, all parameters, and return format. The main gap is lack of behavioral context like error handling and authentication requirements, but the presence of output schema reduces the completeness burden.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description compensates by clearly explaining all three parameters with examples and context. The Args section provides meaningful semantics: 'server' is explained with an example format, 'remote_path' specifies it must be absolute, and 'local_path' clarifies it's the destination. This adds substantial value beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('Download a file') and resource ('from a remote server via SFTP'), distinguishing it from sibling tools like upload_file. It provides a complete verb+resource+protocol combination that leaves no ambiguity about what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like upload_file or other sibling tools. It mentions SFTP protocol but doesn't specify prerequisites, authentication requirements, or when this tool is appropriate versus other file transfer methods. No exclusions or alternative scenarios are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

executeA

Execute a shell command on a single SSH server.

Args: server: Server name (e.g. 'web-prod-01'). Must match a configured server. Use list_servers to see available servers. command: Shell command to execute on the remote server (exactly as it would be typed at a bash prompt). timeout: Command timeout in seconds. Default 30. Range 1–3600. working_dir: Absolute remote directory to cd into before running the command. Uses the server's default_dir from servers.toml if omitted, or the SSH login directory if neither is set. force: If True, bypass the dangerous-command detection regex. Use only for audited bulk operations — the block list catches rm -rf /, mkfs, dd-to-disk, chmod 777 /, and fork bombs. Default False. dry_run: If True, do NOT connect or execute. Return a preview describing what would run (server, command, working_dir, timeout, force). Dangerous-command detection still runs so rejection can be previewed. Useful for LLM plans that want to validate intent before committing. Default False.

Returns: Formatted command execution result with stdout, stderr, and exit code. Long output is truncated at max_output_bytes (default 50 KiB).

ParametersJSON Schema
NameRequiredDescriptionDefault
forceNo
serverYes
commandYes
dry_runNo
timeoutNo
working_dirNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully covers behavioral traits: dangerous-command detection (with force bypass), timeout range (1–3600 seconds), output truncation at max_output_bytes, working_dir fallback logic, and dry_run behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with an Args section and Returns, and every sentence adds value. It is somewhat lengthy but justified by the number of parameters and behaviors; minor trimming could improve conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 6 parameters, no annotations, and presence of output schema (mentioned in Returns), the description thoroughly covers all aspects: parameter details, defaults, edge cases, behavior, and return format. It leaves no critical gaps for the agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 0% description coverage, but the description adds detailed semantics for all 6 parameters: server format and validation, command as bash, timeout units and range, working_dir fallback, force bypass details, and dry_run preview purpose. It also explains return value formatting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Execute a shell command on a single SSH server.' It uses a specific verb ('execute') and resource ('shell command on a single SSH server'), and distinguishes from sibling tools like 'execute_on_group' which targets groups, and file operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says 'on a single SSH server' and references 'list_servers' to see available servers, implying when to use this tool. It also notes 'dry_run' for validating intent before committing, and by context, alternatives like 'execute_on_group' exist for group execution.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

execute_on_groupA

Execute a shell command on all servers in a group in parallel.

Concurrency is capped by the max_parallel_hosts setting (default 10; configure in [settings] of servers.toml, range 1–100).

Args: group: Group name (e.g. 'production', 'web'). Use list_groups to see available groups. command: Shell command to execute on every server in the group. timeout: Per-server command timeout in seconds. Default 30. Each server has its own timer; slow servers do NOT extend the per-server limit for others. working_dir: Absolute remote directory to cd into on each server. Uses each server's default_dir if omitted. fail_fast: If True, cancel remaining tasks as soon as any server returns a non-zero exit code or errors. Default False — run all servers to completion and report each result. force: If True, bypass the dangerous-command detection regex. Use only for audited bulk operations. Default False. dry_run: If True, do NOT connect or execute anywhere. Return a per-server preview describing what would run. Dangerous- command detection still applies. Useful for previewing fleet-wide rollouts before committing. Default False.

Returns: Formatted summary showing per-server results, success/failure counts, and aggregate exit status.

ParametersJSON Schema
NameRequiredDescriptionDefault
forceNo
groupYes
commandYes
dry_runNo
timeoutNo
fail_fastNo
working_dirNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully discloses behavioral traits: concurrency via max_parallel_hosts, per-server timeout behavior, fail_fast cancelation, force bypass of dangerous-command detection, dry_run preview, and return format. No contradiction with any missing annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a clear opening sentence, numbered args, and a return summary. It is slightly verbose in places (e.g., 'Each server has its own timer' could be shorter), but every sentence adds value. Overall, it's efficient and front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (7 parameters, parallel execution, multiple flags), the description covers all necessary aspects: concurrency settings, per-server timeout, failure modes, dangerous-command detection, dry-run preview, and return format. The presence of an output schema reduces the need for detailed return description, and the provided summary is sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must explain all parameters. It does so comprehensively: group (with reference to list_groups), command, timeout (with range and per-server independence), working_dir (with fallback to default_dir), fail_fast (with default behavior), force (with caution), and dry_run (with behavior description). Each adds meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the purpose: 'Execute a shell command on all servers in a group in parallel.' The verb 'Execute' and resource 'shell command on all servers' are specific. It distinguishes from siblings like 'execute' (likely single server) and 'list_groups' (discovery).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use this tool (executing on a group) and references 'list_groups' for discovering groups. It lacks an explicit statement of when not to use it (e.g., for single server operations), but the sibling context implies that 'execute' would be appropriate then.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_groupsB

List all server groups with descriptions and member counts.

Returns: Formatted table of groups with name, description, and server count.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It states the return format ('Formatted table') and what columns to expect, which is helpful. However, it doesn't mention important behavioral aspects like whether this requires authentication, has rate limits, returns all groups at once or uses pagination, or if there are any access restrictions. The description adds some value but leaves significant gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is appropriately concise with two clear sentences. The first sentence states the core functionality, and the second describes the return format. There's no wasted text, though the structure could be slightly improved by combining the two sentences more fluidly or adding a brief introductory phrase.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has zero parameters, 100% schema coverage, and an output schema exists, the description is reasonably complete for a simple read operation. However, with no annotations and a read operation that likely has behavioral considerations (authentication, data scope, etc.), the description should ideally mention at least basic context about access or limitations. The output schema will handle return structure details, but behavioral transparency remains a gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters (schema coverage 100%), so the description doesn't need to explain parameters. The baseline for zero parameters is 4, as there's no parameter documentation burden. The description appropriately focuses on what the tool does rather than parameter details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with a specific verb ('List') and resource ('server groups'), including what information is returned (descriptions and member counts). It distinguishes from sibling 'list_servers' by focusing on groups rather than individual servers. However, it doesn't explicitly differentiate from other potential group-related operations that might exist in the future.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. While it implicitly suggests this is for viewing group information rather than executing operations (like 'execute_on_group'), there are no explicit when/when-not instructions or references to sibling tools. The agent must infer usage context from the tool name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_serversA

List all configured SSH servers with their groups and descriptions.

Args: group: Optional group name to filter by. Shows all servers if omitted. Use list_groups to see available group names.

Returns: Formatted table of servers with name, groups, and description.

ParametersJSON Schema
NameRequiredDescriptionDefault
groupNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It states the tool returns a 'formatted table' which adds useful context about output format, but doesn't mention potential limitations like pagination, rate limits, or authentication requirements for accessing server configurations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is perfectly structured and concise: a clear purpose statement followed by well-organized Args and Returns sections. Every sentence earns its place by providing essential information without redundancy, and the information is front-loaded appropriately.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity (1 parameter, read-only operation), the description is quite complete. It explains purpose, parameter usage, and output format. With an output schema present, it doesn't need to detail return values further. The only minor gap is lack of explicit mention that this is a read-only operation, though that's implied by 'List'.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description coverage is 0%, so the description must compensate fully. It does this excellently by explaining the single parameter's purpose ('Optional group name to filter by'), behavior ('Shows all servers if omitted'), and relationship to other tools ('Use list_groups to see available group names'), adding substantial meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with specific verbs ('List all configured SSH servers') and resources ('SSH servers'), and distinguishes it from siblings by mentioning 'groups and descriptions' which aren't covered by other tools like execute or download_file.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when to use this tool vs alternatives: it mentions using 'list_groups to see available group names' for filtering, and specifies that the group parameter is optional for showing all servers, giving clear context for usage decisions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

upload_fileA

Upload a file to a remote server via SFTP.

Args: server: Server name (e.g. 'pro-dicentra'). local_path: Absolute path to local file. remote_path: Absolute destination path on remote server.

Returns: Confirmation message with file size.

ParametersJSON Schema
NameRequiredDescriptionDefault
serverYes
local_pathYes
remote_pathYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden for behavioral disclosure. It mentions SFTP (implying secure transfer) and the return format, but doesn't cover critical behavioral aspects like authentication requirements, error handling, file size limits, overwrite behavior, or network timeouts. For a mutation tool with zero annotation coverage, this leaves significant gaps in understanding how the tool behaves.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections (purpose, args, returns) and uses minimal sentences that each serve a purpose. The first sentence states the core function, followed by organized parameter explanations and return information. It could be slightly more concise by integrating the parameter explanations more fluidly, but overall it's efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given a mutation tool with 3 parameters, no annotations, and an output schema (which handles return values), the description covers the basic purpose and parameters adequately. However, it lacks important contextual details like authentication requirements, error conditions, or performance characteristics that would be helpful for safe and effective use. The presence of an output schema reduces the need to explain returns, but other gaps remain.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description fully compensates by explaining all three parameters with clear examples and context. It specifies 'server' as a server name with an example, 'local_path' as an absolute path to the source file, and 'remote_path' as an absolute destination path. This adds substantial meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('Upload a file') and resource ('to a remote server via SFTP'), distinguishing it from sibling tools like download_file (which performs the inverse operation) and execute/execute_on_group (which run commands rather than transfer files). The verb+resource combination is precise and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context through the mention of SFTP and parameter explanations, but doesn't explicitly state when to use this tool versus alternatives like download_file or when not to use it (e.g., for local file operations). It provides basic guidance through parameter descriptions but lacks explicit comparative guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 2 tool updatesv0.1.1
    • Changedexecute1 field changed
      • addedInput schema / properties / dry_run
        Added value: +{
        +  "default": false,
        +  "title": "Dry Run",
        +  "type": "boolean"
        +}
    • Changedexecute_on_group2 fields changed
      • addedInput schema / properties / dry_run
        Added value: +{
        +  "default": false,
        +  "title": "Dry Run",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / force
        Added value: +{
        +  "default": false,
        +  "title": "Force",
        +  "type": "boolean"
        +}
  2. 6 tool updatesv0.1.0
    • First observeddownload_file
    • First observedexecute
    • First observedexecute_on_group
    • First observedlist_groups
    • First observedlist_servers
    • First observedupload_file

TDQS

A4.1/5.0
Disambiguation5/5

Each tool has a clearly distinct purpose with no overlap: download_file and upload_file handle file transfers, execute and execute_on_group handle command execution on individual servers or groups, and list_groups and list_servers provide metadata. The descriptions reinforce these boundaries, making misselection unlikely.

Naming Consistency5/5

All tools follow a consistent verb_noun pattern using snake_case: download_file, execute, execute_on_group, list_groups, list_servers, upload_file. This predictability aids agent comprehension and tool selection without deviation.

Tool Count5/5

With 6 tools, the server is well-scoped for SSH/SFTP operations, covering core workflows like file transfer, command execution (individual and group), and server/group listing. Each tool earns its place without bloat or thin coverage.

Completeness4/5

The toolset provides strong coverage for basic SSH/SFTP tasks, including CRUD-like operations for files and commands. A minor gap exists in lifecycle management (e.g., no tools for creating/deleting servers or groups), but agents can work around this using execute for administrative commands.

Maintenance

ActivitySlowing
ResponsivenessSyncing

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    C
    maintenance
    Enables AI assistants to securely connect to and manage remote servers via SSH, supporting command execution, file transfers via SFTP, and multi-server management with both password and SSH key authentication.
    9
    56
    2
    MIT
  • A
    license
    A
    quality
    C
    maintenance
    Enables AI assistants to securely execute remote SSH commands, perform file transfers, and monitor system status through a standardized interface. It features robust security controls including command whitelisting, blacklisting, and credential isolation to prevent unauthorized operations.
    10
    29
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI assistants to securely execute commands, transfer files, and manage port forwarding on remote servers via SSH.
    168
    36
    Apache 2.0

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/blackaxgit/ssh-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server