Skip to main content
Glama

remote-ssh-mcp

给 AI agent 用的远程运维工具(一个 MCP 服务)。agent 只要说出 ~/.ssh/config 里的主机别名,比如 web1,就能在那台服务器上跑命令、查容器、改配置、看服务状态,效果等同于 ssh web1 …,但不用 agent 自己拼 ssh 命令和多层引号。

能做什么

  • 在 ~/.ssh/config 里配好的任意主机上跑命令,结果直接返回给 agent。

  • 读写远端文件,覆盖前自动备份到 ~/ops-backups/。

  • 看服务器的内存、磁盘、负载和监听端口,查 systemd 服务和 docker 容器。

  • 测主机能不能访问某个网址、出口 IP 是多少,调用 x-ui 面板的接口。

  • 重启关机、装包卸包这类危险命令默认拦下,交给你手动执行。

Related MCP server: ssh-for-agents

工具一览

一共 11 个工具:

想做什么

工具

会不会改东西

跑任意命令

exec

会

读文件

file_read

不会

覆盖或追加写文件

file_write

会,覆盖前自动备份

备份文件或目录

backup_file

会,在远端生成备份

列出容器

docker_ps

不会

在容器里跑命令

docker_exec

会

看容器日志

docker_logs

不会

看内存、磁盘、负载、端口

sys_snapshot

不会

查 systemd 服务状态和日志

service_status

不会

测网址连通性和出口 IP

http_probe

不改主机,但会从主机发网络请求

调 x-ui 面板接口

xui_api

看调的接口,可能会改面板配置

每个工具的完整参数用 npm run call -- --list --json 查看。工具返回的第一行是 exit= 加退出码,后面是命令输出;输出太长时只保留开头和结尾。

适用范围

  • 适合在 ~/.ssh/config 里配好的 Linux 主机上排查问题、改配置。

  • Windows 和 Termux 主机只能用 exec,其余工具都按 Linux 命令写。

  • 需要交互式终端的操作(top、vim、要输密码的 sudo)请直接开 ssh。

  • 非 root 账号的主机上,写 /etc 或运行 docker 可能没有权限,工具不提供 sudo 参数。

环境要求

  • Node.js 20 或更新。

  • 本机装有 OpenSSH 客户端,~/.ssh/config 里配好主机别名,并且能用密钥免密登录。

  • 远端要有工具用到的命令:docker 类工具要 docker,http_probe 和 xui_api 要 curl,xui_api 还要 sqlite3。

安装

先在仓库里构建:

npm install && npm run build

然后把下面的配置加进你的 MCP 客户端,路径换成仓库所在位置:

{
  "mcpServers": {
    "remote-ssh": {
      "command": "node",
      "args": ["/path/to/remote-ssh-mcp/dist/index.js"]
    }
  }
}
claude mcp add remote-ssh -s user -- node /path/to/remote-ssh-mcp/dist/index.js

要放开某类危险命令时加 -e,如 claude mcp add remote-ssh -s user -e SSH_MCP_ALLOW_PKG=1 -- node …。

把上面的配置加进 ~/.cursor/mcp.json。要放开某类危险命令时,在 remote-ssh 里加 "env": { "SSH_MCP_ALLOW_PKG": "1" }。

装好后可以先在仓库里试一次调用,看到的就是 agent 拿到的结果。下面的输出是示例,主机名、端口和进程已经换成通用值:

npm run call -- sys_snapshot '{"host":"web1"}'
exit=0
== mem (MB)
used 471 / 973, available 501
swap used 0 / 0
== disk /
used 2.1G / 30G (8%), avail 27G
== load
 03:49:36 up 10 days,  3:55,  0 user,  load average: 0.00, 0.02, 0.00
== listening tcp
0.0.0.0:22 sshd
*:443 nginx
127.0.0.1:8080 app
...

配置

用环境变量配置,写在客户端配置的 env 里(Claude Code 用 -e)。

环境变量

说明

SSH_MCP_ALLOW_POWER

默认不设,exec / docker_exec 拦截电源类命令:reboot、shutdown、poweroff、halt、init 0/6、systemctl reboot/poweroff/halt 等。设为 1 才放开。

SSH_MCP_ALLOW_PKG

默认不设,拦截装包类命令:apt / apt-get / aptitude / yum / dnf / apk 的 install、remove、purge、upgrade 等,以及 dpkg -i/-r/-P/--configure。设为 1 才放开。

安全

  • 只连 ~/.ssh/config 里的主机别名,直接写 IP 或 user@ip 会被拒绝。

  • 危险命令被拦时,工具提示 agent 让你自己 ssh 上去执行。

开发

npm install
npm run build
npm test
npm run call -- --list
npm run call -- exec '{"host":"web1","cmd":"uptime"}'

npm run call 用来在本地直接调用工具,运行前要先 npm run build。

许可证

MIT,详见 LICENSE。

Available Tools

11 tools
backup_fileA

Back up a remote file or directory (tar.gz) to ~/ops-backups/-/ with a sha256 file. Use before editing via exec.

NameRequiredDescriptionDefault
tagYesShort name, e.g. xray-chain
hostYes
pathYesAbsolute remote path

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of behavioral disclosure. It usefully reveals that a tar.gz archive and sha256 file are created under a date-tag directory, but it omits important operational details such as permissions, whether existing backups are overwritten, and failure behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two tightly written sentences with no wasted text. The core operation and destination are front-loaded, followed by a concise usage note.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a three-parameter tool with no output schema, the description covers the essential purpose, destination layout, and invocation context. Minor gaps remain around host semantics and backup-overwrite behavior, but the definition is largely sufficient to call the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 67%, and the description adds some meaning by showing that tag is embedded in the backup directory name and that path refers to a remote file or directory. However, host remains unexplained in both schema and description, leaving a notable gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: backing up a remote file or directory. It also specifies the archive format (tar.gz), destination pattern, and accompanying sha256 file, making the operation distinct from sibling tools like exec or file_write.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says to use this before editing via exec, giving a clear triggering context and naming the relevant sibling tool. It does not describe when not to use it or mention alternative backup approaches, so it falls short of full when/when-not guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

docker_execC

Run cmd inside a container with sh -c; write it as you would inside the container, the tool does the quoting.

NameRequiredDescriptionDefault
cmdYes
hostYes
timeoutNoSeconds, default 60
containerYesContainer name or id
max_charsNoPer-stream output cap, default 8000

TDQS

C2.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It usefully discloses shell wrapping and automatic quoting, but omits permissions/security implications, container-running preconditions, output truncation behavior, timeout behavior, and mutation side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One front-loaded sentence with no wasted words. The execution mechanism and quoting behavior are stated efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an arbitrary container command-execution tool with no annotations and no output schema, the description is too sparse. It should at least clarify host/container targeting, timeout/output-cap behavior, and the fact that commands may mutate container state.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Adds useful meaning for `cmd` by explaining it is shell text and that the tool handles quoting. However, schema coverage is only 60%, and `host` is undocumented in both schema and description; timeout and max_chars are also not addressed in the description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: running a command inside a container via `sh -c`. This clearly separates it from docker_ps/docker_logs, though it does not explicitly distinguish it from the sibling `exec` tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explains how to phrase the command but not when to use this tool instead of `exec` or other command-running siblings. No preconditions, exclusions, or alternative-selection guidance are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

docker_logsC

Tail a container's logs (stdout and stderr merged).

NameRequiredDescriptionDefault
hostYes
tailNo
sinceNoe.g. 30m, 2h, 2026-10-26T10:00
containerYesContainer name or id
max_charsNoPer-stream output cap, default 8000

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It usefully states that stdout and stderr are merged, but it does not disclose whether the call streams/follows, blocks, requires Docker permissions, is read-only, or how output is capped.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single front-loaded sentence with no wasted words. Its brevity is efficient, though it is arguably too sparse for a tool with five parameters.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a five-parameter tool with no annotations and no output schema, the description is incomplete. It does not explain return behavior, whether logs are followed, permission requirements, or the roles of the remaining parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds no parameter meaning beyond the schema. With only 60% schema description coverage, important parameters such as host and tail are undocumented in both the schema and the description, and the description does not compensate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Tail') and resource ('container's logs') and clarifies that stdout and stderr are merged. It does not differentiate this from sibling tools such as docker_exec or exec, so it stops short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool instead of docker_exec, exec, or other siblings, nor are prerequisites or exclusions mentioned. The intended use is only implied by the word 'Tail'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

docker_psC

List containers on a host as name, image, status (tab separated).

NameRequiredDescriptionDefault
allNoInclude stopped containers
hostYes
filterNoCase-insensitive regex on the line

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It discloses the tab-separated output format, but does not mention permissions, read-only nature, error behavior, or how host connectivity is handled.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence that states the action, resource, and output shape with no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only listing tool, the description covers the output columns but leaves the required host parameter ambiguous and does not explain defaults or filtering behavior. It is minimally adequate but misses important context for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 67%, but the required 'host' parameter has no description in either the schema or the description. The description adds output formatting but does not clarify what 'host' expects, nor does it explain how 'filter' interacts with the returned line format.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ('List containers on a host') and specifies the returned fields. It is clear what the tool does, though it does not explicitly differentiate itself from siblings like docker_logs or docker_exec.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus alternatives such as docker_logs or docker_exec. The default behavior of including stopped containers is only visible in the schema, not explained in usage terms.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

execB

Run a shell command on a host, same as ssh <host> '<cmd>'; write cmd without the outer quotes. Prefer a dedicated tool when one fits. Hosts:

NameRequiredDescriptionDefault
cmdYes
hostYes
timeoutNoSeconds, default 60
max_charsNoPer-stream output cap, default 8000

TDQS

B3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry the full behavioral disclosure burden. It says this is equivalent to SSH and explains command quoting, but it does not disclose permissions, destructive potential, side effects, authentication requirements, or output behavior for an arbitrary remote shell execution tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short and front-loads the key invocation model, which is good. However, the trailing incomplete fragment 'Hosts: ' is a structural defect that wastes space and leaves promised host information missing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a high-risk arbitrary command execution tool with no annotations and no output schema, so the description should be more complete. It omits safety implications, host list details, permissions context, and output behavior, leaving the agent without enough information to invoke it confidently in a multi-tool environment.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50%, so the description needs to compensate for the undocumented `host` and `cmd` parameters. It partially does so by mapping them to the SSH analogy and specifying that `cmd` should be written without outer quotes, but the host enumeration is truncated at 'Hosts: ' and `timeout`/`max_chars` are left entirely to the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'Run a shell command on a host,' and clarifies the execution model with the `ssh <host> '<cmd>'` analogy. It hints at sibling alternatives with 'Prefer a dedicated tool when one fits,' but does not name any sibling tool, so differentiation is only partial.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a minimal usage rule: prefer a dedicated tool when one fits, implying `exec` is the fallback for arbitrary shell commands. However, it does not name which siblings fit which cases, nor does it state when-not to use this tool beyond that vague preference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

file_readC

Read a remote text file, optionally a line range.

NameRequiredDescriptionDefault
hostYes
pathYesAbsolute remote path
linesNoLine count from start_line
max_charsNoPer-stream output cap, default 8000
start_lineNo

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, yet it discloses only that the target must be a text file. It says nothing about truncation behavior, the max_chars cap, permission/error behavior, or what happens when the file is large or binary.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler. It is efficient, though the terseness pushes detail burdens onto other dimensions rather than being a structure flaw.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 5-parameter remote-read tool with no annotations and no output schema, the description omits return shape, truncation signaling, and binary/encoding handling. An agent can guess how to call it but not what to expect back.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 60%, and 'optionally a line range' loosely maps to start_line/lines, but the interaction between lines and start_line is not explained. The host and max_chars parameters get no added meaning from the description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Read a remote text file') and scopes it to text files with an optional line range. It is easy to distinguish from the sibling file_write, but the description never names or contrasts with any sibling explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this versus alternatives such as exec or http_probe for retrieving content, and no prerequisites (host reachability, auth) are stated. Usage is only implied by the verb.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

file_writeA

Write content to a remote file verbatim (no escaping). overwrite first backs up the old file to ~/ops-backups/-auto/, then replaces it atomically, keeping mode and owner; append adds to the end.

NameRequiredDescriptionDefault
hostYes
modeNooverwrite
pathYesAbsolute remote path
backupNoBack up before overwrite
contentYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does most of it well: it discloses the backup location (~/ops-backups/<date>-auto/), atomic replacement, preserved mode and owner, and that append appends rather than replaces. Missing are prerequisite/privilege requirements on the remote host and failure behavior — the main remaining gaps for an unannotated mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence with the core write guarantee front-loaded, followed by the mode-specific behavior. No filler, and each clause adds operational information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a five-parameter mutation tool with no annotations and no output schema, the description covers the risky parts (backup, atomicity, permissions preservation) well. It stops short of explaining the host parameter and error/return behavior, which an agent would still need to guess at.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 40%, so the description must compensate. It does explain mode values and the backup-before-overwrite behavior, and clarifies that content is written without escaping, but it says nothing about the 'host' parameter (SSH target? inventory name?) or path semantics, leaving two undocumented params unaccounted for.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Write content to a remote file') plus a distinctive behavioral qualifier ('verbatim, no escaping') that separates it from shell-based alternatives like exec. An agent can tell immediately this is a direct remote file writer.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implicitly tells you to pick overwrite vs append, and the existence of file_read and backup_file siblings implies the read/backup split. But it never states when to prefer this over exec or whether it should be used for new files, so usage is only implied rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

http_probeA

From a host, fetch a URL (optionally via a proxy) and report HTTP code, time and the egress IP.

NameRequiredDescriptionDefault
urlYes
hostYes
proxyNocurl -x value, e.g. http://127.0.0.1:10809 or socks5h://127.0.0.1:1080
timeoutNo
egress_ipNoAlso look up the egress IP via api.ipify.org

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It does disclose the returned payload and that the probe performs an outbound call (egress IP lookup), which hints at an external dependency, but it says nothing about request method, redirect handling, failure/timeout behavior, or what privileges the 'host' requires.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One sentence, zero filler, with the host scope and the proxy option front-loaded and the outputs listed last. Nothing repeats the title and nothing could be cut without losing information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With five parameters, no annotations, and no output schema, the description should be doing more work. It summarizes the return values, which is helpful, but omits error behavior, request method, and what the timeout actually bounds, so an agent cannot fully predict what a call will do or return in edge cases.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 40%: proxy and egress_ip are already documented in the schema, and the description only restates them ('optionally via a proxy', 'report ... the egress IP'). It does add one useful semantic — that 'host' is the machine the fetch originates from — but leaves url format and the timeout parameter (default 15, max 120) entirely to the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description pairs a specific verb (fetch) with a specific resource (a URL) and a scoping qualifier ('from a host'), then names the outputs. That is far more precise than a generic 'run command', though it never explicitly contrasts itself with the sibling exec tool, which could also perform an HTTP fetch.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: 'from a host' and 'via a proxy' suggest remote connectivity testing, so an agent can infer this is the structured probe rather than a shell command. There is no explicit when-to-use, no when-not-to-use, and no named alternative among exec/docker_exec/xui_api.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

service_statusC

systemd unit state (load/active/enabled) plus its recent journal lines.

NameRequiredDescriptionDefault
hostYes
unitYes
linesNoJournal lines, 0 for none
sinceNojournalctl --since, e.g. "2 hours ago"

TDQS

C2.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose the return payload (state fields plus journal lines), which is valuable since there is no output schema. However it says nothing about read-only semantics, required privileges, whether the host must be reachable, or behavior when the unit is missing or the journal is empty.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single compact sentence with no filler; the returned data is front-loaded. It is perhaps overly terse given the missing guidance, but nothing in it is wasteful.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 4-parameter remote-execution tool with no annotations and no output schema, the description should clarify host addressing, privilege requirements, and unit naming. It provides only a one-line summary of what comes back, leaving the agent to guess how to construct a valid call.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only half the schema has descriptions (`lines` and `since`), while `host` and `unit` are bare. The description does not clarify what `host` accepts (hostname vs. SSH target vs. localhost) or that `unit` expects a systemd unit name like `nginx.service`, so it fails to compensate for the coverage gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific resource (a systemd unit) and the exact data returned (load/active/enabled state plus recent journal lines). That is enough to separate it from siblings such as docker_logs or exec. It lacks an explicit verb and never names the sibling it substitutes for, so it stops short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to use this versus exec or docker_logs, no prerequisites such as SSH access or sudo, and no exclusions. The agent must infer usage entirely from the tool name and required parameters.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sys_snapshotC

Memory, root disk, load and listening TCP ports of a Linux host in one call.

NameRequiredDescriptionDefault
hostYes

TDQS

C2.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It implies a read-only metrics collection, but says nothing about how the 'host' is reached (SSH? agent? credentials?), whether it requires the host to be reachable, or what happens on failure — significant omissions for a remote-host tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One dense sentence with zero filler; the enumerated metrics are front-loaded and the scope ('of a Linux host', 'in one call') is clear. It is appropriately sized for a single-parameter tool, though it could spend one more clause on the host parameter.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter, no-output-schema tool, the enumeration of returned metric categories does double duty as a return-value summary, which is genuinely useful. However, the ambiguity about the host parameter's format and connection semantics leaves a real gap for an agent trying to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single required parameter 'host' has 0% schema description coverage and the description never clarifies its expected format (hostname, IP, user@host, SSH alias). With the only parameter undocumented in both schema and prose, the agent is left guessing at the most important input.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the exact resource set (memory, root disk, load, listening TCP ports) scoped to a Linux host, which is specific enough that an agent can tell it apart from siblings like service_status or http_probe. It lacks an explicit verb ('gathers'/'reads'), so the operation is implied rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to call this versus alternatives such as exec or service_status. The phrase 'in one call' hints at consolidation value but never names a competing tool or exclusion, so the agent must infer usage from the name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

xui_apiB

Call the host's x-ui/3x-ui panel API with its Bearer token injected on the remote side (panel address read from x-ui.db). path is relative to the panel base path, e.g. "panel/api/server/status", "panel/api/inbounds/list".

NameRequiredDescriptionDefault
bodyNoJSON request body
hostYes
pathYes
methodNoGET
max_charsNoPer-stream output cap, default 8000

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose meaningful behavior: the Bearer token is injected server-side and the panel address is read from x-ui.db, so the agent does not need to supply credentials. However, it says nothing about the consequences of POST/PUT/DELETE on a live panel, whether changes are applied immediately, or how errors and truncation (max_chars) surface in the response.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence plus inline examples, front-loaded with the core action and the auth/address-resolution detail. Nothing is wasted, though the parenthetical about x-ui.db slightly interrupts the flow before the path examples.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a five-parameter tool with no annotations, no output schema, and write-capable methods, the description covers the auth/resolution mechanics but omits return-shape expectations, what max_chars truncation looks like, and error behavior. It is adequate to start an invocation but not to predict outcomes safely.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 40% (host, path, and method are undocumented in the schema), so the description needs to compensate. It clarifies that path is relative to the panel base path and supplies two examples, but leaves host's accepted format, method's semantics, and body expectations to inference — partial compensation only.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (call) and resource (the host's x-ui/3x-ui panel API), and gives two concrete path examples that make the target unambiguous. It implicitly separates itself from the generic http_probe sibling by handling auth and resolving the panel address from x-ui.db, though it never names http_probe explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied: reach for this when you need the x-ui panel API rather than a raw HTTP probe, since tokens and panel address are handled for you. There is no explicit when-to-use/when-not statement, no mention of prerequisites (a running x-ui instance, a configured panel base path), and no guidance on choosing between this and http_probe.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 11 tool updatesv0.1.0
    • First observedbackup_file
    • First observeddocker_exec
    • First observeddocker_logs
    • First observeddocker_ps
    • First observedexec
    • First observedfile_read
    • First observedfile_write
    • First observedhttp_probe
    • First observedservice_status
    • First observedsys_snapshot
    • First observedxui_api

TDQS

B3.4/5.0

Scored across 11 tools

Disambiguation4/5

Each dedicated tool has a clearly bounded purpose (docker_ps vs docker_logs vs docker_exec, sys_snapshot vs service_status vs http_probe), and exec explicitly instructs the agent to prefer a specialized tool. Minor overlaps remain: exec can do anything its peers do, docker_exec mirrors exec semantics on a container, and backup_file duplicates the automatic backup that file_write already performs on overwrite.

Naming Consistency4/5

The dominant pattern is domain_action (file_read, file_write, docker_ps, docker_exec, docker_logs, http_probe, xui_api), which reads predictably and groups related tools by prefix. Deviations are small but real: exec is a bare verb, and backup_file inverts the order (verb_resource) relative to the rest.

Tool Count5/5

Eleven tools is squarely in the well-scoped band for a remote-ops server, and each one maps to a recurring day-to-day task rather than a redundant variation. The broad exec escape hatch keeps the specialized set from needing to grow further.

Completeness4/5

Read/write/backup for files, container inspection and exec, system and service diagnostics, egress probing, and panel API access cover the core remote-ops lifecycle with no dead ends. Gaps are minor: no directory listing, file copy/move, or container lifecycle controls (restart/stop), all of which must fall back to exec.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables AI coding agents to securely execute shell commands on remote SSH servers with granular per-host permission controls. Automatically discovers hosts from ~/.ssh/config and exposes dedicated tools for each allowed host to ensure proper authorization before remote execution.
    1,420 npm
    Apache 2.0
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI agents to manage remote servers via SSH, including command execution, multi-host batch operations, SFTP file transfer, background job handling, DevOps diagnostics, port tunneling, and safety guardrails like high-risk command blocking and read-only mode.
    MIT
  • A
    license
    A
    quality
    B
    maintenance
    Enables AI agents to securely connect to and manage remote servers via SSH, with tools for running commands, file operations, log inspection, service management, and system monitoring under configurable access controls and audit logging.
    12
    11 npm
    1
    MIT