SSH MCP JumpServer enables AI agents to manage remote servers via SSH, with dynamic host discovery through JumpServer, security features, and connection pooling.
Core Operations:
List hosts (ssh_list_hosts): View all available SSH hosts from merged configuration (local project/user config + JumpServer).
Execute commands (ssh_exec): Run commands on any host (static or discovered via JumpServer) with optional timeout.
Get host config (ssh_get_config): Retrieve full merged SSH configuration for a specific host.
Test connectivity (ssh_test_connection): Verify SSH connection to a host.
Disconnect sessions (ssh_disconnect): Close one or all active SSH sessions.
Initialize config (ssh_init_config): Create or scaffold SSH config files at project or user level.
Smart Features:
JumpServer API dynamic discovery eliminates manual host configuration.
Automatic username fallback: tries root → ec2-user → game_server for JumpServer hosts.
Connection pooling reuses sessions across agent steps for performance.
Security: per-host allow/deny lists, dangerous command blocking, output truncation, secret redaction.
HMAC-SHA256 authentication to JumpServer.
Priority: command-line args > project config > user config > JumpServer.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@ssh-mcp-jumpserver Connect to 10.0.0.5 and run uptime"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
English | 中文
An MCP server that bridges AI agents (Claude Desktop, VS Code Copilot, etc.) to remote servers via SSH — with dynamic host discovery through JumpServer. No need to manually configure every host; if JumpServer knows it, you can connect to it.
JumpServer dynamic discovery: connect to any host JumpServer manages — no manual SSH config needed
Auto username fallback: tries root → ec2-user → game_server until one works
Standard SSH config support: still works with your existing OpenSSH config files for static hosts
Secure by default: dangerous command blocking, per-host allowlists/denylists, output caps, and secret redaction
Connection pooling: reuse SSH connections across agent steps for faster multi-turn sessions
Related MCP server: MCP SSH Server
npm install -g ssh-mcp-jumpserver
# or: npm install && npm run build && npm link{
"mcpServers": {
"ssh": {
"command": "ssh-mcp-jumpserver",
"args": [
"--ssh",
"name=prod,host=10.0.0.5,port=22,user=root,privateKey=~/.ssh/id_rsa"
],
"env": {
"JUMPSERVER_URL": "https://your-jumpserver.example.com",
"JUMPSERVER_KEY_ID": "your-access-key-id",
"JUMPSERVER_SECRET_ID": "your-access-secret-id"
}
}
}
}Static hosts passed with --ssh are searched first. If no static or config-file host matches, the server falls back to JumpServer discovery.
Ask your AI agent:
"Connect to 10.0.0.5 and run
uptime.""List all my SSH hosts."
"Test the connection to prod-db-01."
The server resolves unknown hosts through JumpServer automatically.
Feature | Description |
🔍 JumpServer dynamic discovery | Search assets by IP or hostname, fetch SSH keys via API |
🔄 Username fallback | Auto-tries |
📋 Static SSH config | Standard OpenSSH config ( |
🔒 Security policies | Per-host allowlist/denylist, output truncation, secret redaction |
🔌 Connection pool | Reuse SSH connections with idle cleanup |
🌐 HMAC-SHA256 auth | HTTP Signature signed requests to JumpServer API |
ssh-mcp-jumpserver [options]
--jumpserver-url <url> JumpServer base URL (enables dynamic host discovery)
--jumpserver-key-id <id> JumpServer Access Key ID
--jumpserver-secret-id <id> JumpServer Access Secret ID
--project-root <path> Project root (for project-level ssh.config)
--ssh <config> Static SSH host, repeatable:
name=prod,host=10.0.0.5,port=22,user=root,password=...
--timeout <ms> Default command timeout (default: 60000)
--max-output <chars> Max output characters (default: 10000)
--max-connections <n> Max concurrent SSH connections (default: 5)
--idle-timeout <ms> Connection idle timeout (default: 600000)Environment variable equivalents: JUMPSERVER_URL, JUMPSERVER_KEY_ID, JUMPSERVER_SECRET_ID.
Host lookup priority: --ssh args → project ssh.config → user config → JumpServer fallback.
Tool | Description |
| List all configured SSH hosts |
| Execute a command on a host (local config or JumpServer) |
| Show merged config for a host |
| Test SSH connectivity |
| Close SSH session(s) |
| Scaffold a new SSH config file |
User request: ssh_exec host="10.0.0.5"
→ Is "10.0.0.5" in local ssh.config?
├── Yes → connect directly
└── No → query JumpServer API
├── GET /api/v1/assets/assets/?ip=10.0.0.5
├── GET /api/v1/assets/system-users/?asset=<id>
├── GET /api/v1/assets/system-users/<id>/auth-info/
→ Build SSHHostConfig with discovered key
→ Try root → ec2-user → game_server
→ Execute commandSee CONTRIBUTING.md.
MIT — see LICENSE.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Operate your Linux servers from your LLM. Every action runs through an auditable allowlist.
Let AI operate servers without SSH. Choose actions, approve risky changes, and audit every step.
Runtime permission, approval, and audit layer for AI agent tool execution.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/helloNice/ssh-mcp-jumpserver'
If you have feedback or need assistance with the MCP directory API, please join our Discord server