Skip to main content
Glama

SSH MCP 서버 — AI 에이전트용 원격 서버 도구

이 서버는 여러분 머신에 이미 설치된 OpenSSH 클라이언트를 사용합니다: 여러분의 키, ~/.ssh/config, 점프 호스트, 에이전트 포워딩. 번들로 포함된 것도, 컴파일할 것도, 네이티브 바인딩도 없습니다.

Claude Code, Codex CLI, opencode, Gemini CLI, Qwen Code, Hermes 및 기타 MCP 클라이언트와 함께 작동합니다.

MCP Registry Glama npm downloads tests

설치 · 도구 · 설정 · 보안 · 로드맵 · 문서 · 변경 이력


30초 설치

전역 설치가 필요 없습니다. npx가 첫 사용 시 패키지를 다운로드합니다:

npx -y @hypnosis/ssh-mcp-server

Claude Code에 모든 프로젝트에 대해 추가하세요:

claude mcp add ssh -s user \
  -e SSH_PROFILES_FILE="$HOME/.claude/ssh-profiles.json" \
  -- npx -y @hypnosis/ssh-mcp-server

그런 다음 ~/.claude/ssh-profiles.json을 생성하고 최소 하나의 머신을 추가하세요:

{
  "profiles": {
    "production": {
      "host": "server.example.com",
      "username": "admin",
      "privateKeyPath": "~/.ssh/your_private_key"
    }
  }
}

이것으로 연결이 가능합니다.

Codex, opencode, Qwen Code 및 기타 클라이언트는 SSH MCP 서버 설정에서 다룹니다.

요구 사항

Node.js 18+ 및 PATH에 있는 시스템 ssh 클라이언트. Windows에서는 키 기반 프로필을 사용하세요; 비밀번호 및 패스프레이즈 프로필은 현재 지원되지 않습니다.

npm version Node.js TypeScript MCP SDK License

고정 버전을 선호하거나, 오프라인 작업을 하거나, 실행할 때마다 레지스트리 확인을 하나 줄이고 싶다면: npm install -g @hypnosis/ssh-mcp-server를 실행한 후 npx 대신 ssh-mcp-server를 명령으로 사용하세요.

Related MCP server: cygnus-ssh-mcp

이런 분들을 위한 서버입니다

  • DevOps 및 SRE — 더 빠른 감사(audit), 장애 점검, 일상적인 서버 작업을 원하는 분.

  • 바이브 코더와 인디 빌더 — AI 어시스턴트와 함께 제품을 출시하고 자신의 서버에서 실행하는 분.

  • 시스템 관리자와 플랫폼 엔지니어 — 제한 없는 원시 셸 대신 구조화된 도구를 원하는 분.

  • 전담 운영 팀 없이 자체 VPS를 운영하는 개발자와 소규모 팀.

  • 홈랩, NAS, 라우터 소유자 — 유용한 하드웨어가 현대 프로토콜을 지원하지 못하는 분.

원시 셸 대신 SSH MCP 서버를 사용하는 이유

더 적은 토큰, 더 낮은 AI 비용

원시 셸은 AI 에이전트에게 화재 호스를 쏟아붓습니다: 반복되는 명령, ASCII 테이블, 로그 덤프. 그 노이즈를 서버 상태 파악으로 바꾸는 데 토큰이 소모됩니다 — 바로 여러분의 비용입니다.

더 빠른 서버 디버깅

목적에 맞게 설계된 도구는 일상적인 점검을 일괄 처리하고, 시끄러운 출력을 제한하며, 중요한 부분만 반환합니다. 에이전트는 터미널 출력을 해석하는 데 시간을 덜 쓰고 더 빨리 수정에 도달합니다.

더 적은 추측, 더 적은 AI 실수

구조화된 응답은 무엇이 발견되었는지, 무엇을 측정할 수 없었는지, 무엇이 잘렸는지를 명확히 말합니다. 이는 에이전트가 환각으로 빈틈을 메울 여지를 줄여줍니다 — 그리고 더 적은 잘못된 수정, 더 안정적인 배포, 더 신뢰할 수 있는 코드를 제공합니다.

SSH 호환성: 최신 서버, 레거시 장비, Windows

기존 OpenSSH 설정 활용

번들 SSH 구현도, 네이티브 바인딩도, 플랫폼별 재빌드도 없습니다. 명령은 시스템 ssh 클라이언트를 사용하므로 여러분의 키, ~/.ssh/config, 점프 호스트, 에이전트 포워딩이 터미널에서와 똑같이 작동합니다. 지원되는 경우, 대상별로 공유된 멀티플렉스 연결 하나를 사용하여 명령마다 인증하는 대신 한 번만 인증합니다.

레거시 서버, 라우터, NAS 기기용 SSH 지원

최신 scp로 라우터에 파일을 보내면 이런 결과가 나옵니다:

scp app.conf router:/etc/
# scp: subsystem request failed on channel 0

아무것도 고장난 것이 아닙니다 — 현재 scp는 새 프로토콜을 사용하며 라우터는 그것을 모릅니다. 터미널에서는 포럼 스레드를 읽고 추가 플래그를 들고 돌아와야 합니다. 여기서는 아무것도 할 필요가 없습니다: 전송이 시도되고, 거부가 인식되며, 이전 프로토콜이 대신 사용되고, 해당 머신이 기억되어 다음 파일은 바로 그 프로토콜로 전송됩니다.

구형 SSH 클라이언트 및 누락된 도구에 대한 폴백

구형 장비에는 막다른 길이 아닌 폴백이 제공됩니다. 최신 기능이 없을 때 서버는 가능한 경우 이전 방식을 사용합니다:

여러분의 머신

제공되는 기능

최신 파일 전송을 지원하기엔 너무 작은 라우터나 NAS

파일은 여전히 전송됩니다 — 이전 프로토콜이 자동으로 사용됩니다

10년 된 서버

워크플로는 여전히 작동합니다. 단지 연결을 재사용하는 대신 명령마다 새 연결을 엽니다

파일 해시 기능이 없는 최소화된 이미지

업로드가 "검증할 수 없음"이라고 표시합니다 — 아무도 확인하지 않은 일치를 주장하지 않습니다

특정 도구가 설치되지 않은 머신

응답은 "측정되지 않음"이라고 표시합니다 — "아무것도 없음"으로 읽히는 0을 절대 반환하지 않습니다

Model Context Protocol을 위해 설계됨

공식 MCP SDK 기반, 전체 TypeScript, 2500개 이상의 단위 테스트와 실제 컨테이너에서 실행되는 라이브 테스트 스위트(모의 객체가 아닌)를 갖추고 있습니다.


원시 SSH vs SSH MCP 서버: 같은 작업, 두 가지 방식

SSH 서버 상태 점검

상황: 배포가 막 완료되었습니다. 서버가 느려진 것 같지만 디스크, 메모리, 서비스, 컨테이너, 오류 중 무엇이 원인인지 모릅니다.

질문: "이 서버는 정상인가요?"

원시 SSH

$ uptime
 10:42:17 up 18 days,  3:21,  2 users,  load average: 0.42, 0.31, 0.28
$ df -hT
Filesystem     Type   Size  Used Avail Use% Mounted on
/dev/sda1      ext4    40G   35G  5.0G  87% /
overlay        overlay  40G   35G  5.0G  87% /var/lib/docker/overlay2/...
$ free -h
               total        used        free      shared  buff/cache   available
Mem:           7.7Gi       4.9Gi       612Mi       121Mi       2.2Gi       2.5Gi
$ systemctl --failed
  UNIT              LOAD   ACTIVE SUB    DESCRIPTION
● api-worker.service loaded failed failed API background worker
$ docker ps -a
CONTAINER ID   IMAGE          STATUS                     PORTS
8e14d0b41c2a   api:latest     Up 3 minutes               0.0.0.0:8080->8080/tcp
65b894af2430   worker:latest  Exited (1) 2 minutes ago
$ ss -tulpn
Netid  State   Local Address:Port   Process
tcp    LISTEN  0.0.0.0:22          users:(("sshd",pid=842,fd=3))
tcp    LISTEN  0.0.0.0:8080        users:(("docker-proxy",pid=1942,fd=4))
$ journalctl -p err --since -1h | tail -50
Aug 20 10:39:14 prod api-worker[22104]: database connection timed out
Aug 20 10:39:14 prod systemd[1]: api-worker.service: Failed with result 'exit-code'.

이것도 여전히 축약된 결과입니다. 완전한 점검에는 CPU, 서비스 상태, 컨테이너 수, 최근 오류에 대한 더 많은 명령이 필요하며 각각 고유한 출력 형식을 가집니다. 더 나쁜 것은, ss가 없는 서버는 포트 점검이 실행되지 않았는데도 수신 대기 중인 것이 0개인 것처럼 보일 수 있습니다.

구조화된 MCP 결과

ssh_snapshot({ "profile": "production" })
{
  "disk_pct": 87,
  "mem_pct": 64,
  "cpu_pct": 12,
  "load": "0.42 0.31 0.28",
  "containers": 7,
  "ports": 14,
  "services_running": 3,
  "recent_errors": 21,
  "unavailable": []
}

에이전트가 얻는 이점

원시 SSH

구조화된 MCP

여러분의 이점

여러 명령과 ASCII 테이블

하나의 결과에 이름이 지정된 필드

한 번의 호출, 이름이 지정된 필드, 더 적은 왕복

누락된 도구가 빈 출력처럼 보일 수 있음

unavailable이 측정되지 않은 것을 명시

더 적은 추측과 더 적은 잘못된 수정

디스크, 서비스, 오류를 직접 분류해야 함

문제 신호가 이미 표면화됨

더 빠른 디버깅

전체 ssh_audit_baseline 결과는 소수의 원시 명령 출력보다 길 수 있습니다 — 실험실 측정에서 약 1,077 토큰 대 765 토큰. 절약은 하나의 응답을 더 짧게 만드는 것이 아니라 전체 워크플로우에서 발생합니다.

실제 트러블슈팅 세션에서 목적에 맞게 설계된 도구는 49개의 개별 명령 호출을 4개의 MCP 호출로 줄였습니다. 추가 호출마다 누적된 대화와 함께 새로운 모델 턴이 시작됩니다. 프롬프트 캐싱은 반복 입력 비용을 줄일 수 있지만, 새 명령과 그 출력은 여전히 컨텍스트를 소비합니다. 더 적은 왕복은 세션 전체에서 더 적은 토큰, 더 적은 반복 분석, 그리고 답에 도달하는 더 빠른 경로를 의미합니다.

맥박이 아닌 전체 그림이 필요하신가요? ssh_audit_baseline은 시스템, 디스크, 메모리, 포트, sshd, 실패한 유닛, Docker, 방화벽, 업데이트를 일괄 처리합니다. 결과는 CRITICAL / WARNING / OK로 제공됩니다. 측정되지 않은 섹션은 0으로 조용히 읽히는 대신 명시적으로 이름이 지정됩니다.

Linux 서버 로그 검색

상황: API가 타임아웃되고 있지만, 같은 메시지가 nginx, syslog, journald 또는 일반 사용자로 읽을 수 없는 애플리케이션 로그에 있을 수 있습니다.

질문: "그 오류는 어디서 발생한 건가요?"

원시 SSH

$ grep -i "timeout" /var/log/nginx/error.log
2026/08/20 10:38:54 [error] upstream timed out while reading response header
$ grep -i "timeout" /var/log/syslog
Aug 20 10:39:14 prod api-worker[22104]: database connection timed out
$ grep -i "timeout" /var/log/app/*.log 2>/dev/null
$ journalctl -u api --since "1 hour ago" | grep -i timeout
Aug 20 10:39:14 prod api[22104]: database connection timed out after 30000ms

세 번째 명령은 깔끔해 보이지만, 2>/dev/null이 권한 오류도 숨겼습니다. "일치하는 항목 없음"과 "읽은 항목 없음"이 이제 동일하게 보입니다. 바쁜 로그는 수천 줄을 반환하여 사고의 나머지 부분을 에이전트의 컨텍스트 밖으로 밀어낼 수도 있습니다.

구조화된 MCP 결과

ssh_log_search({ "profile": "production",
                 "path": ["/var/log/nginx/error.log", "/var/log/syslog", "/var/log/app/*.log"],
                 "query": "timeout", "context": 2, "since": "1h" })
{
  "matches": 34,
  "lines": [
    { "file": "/var/log/nginx/error.log", "line": 4821,
      "text": "upstream timed out while reading response header", "context": false },
    { "file": "/var/log/nginx/error.log", "line": 4822,
      "text": "client closed connection", "context": true }
  ],
  "files_searched": 6,
  "files_unreadable": ["/var/log/app/private"],
  "files_skipped": 12,
  "files_undated": [],
  "limited": false,
  "truncated": false
}

에이전트가 얻는 이점

원시 SSH

구조화된 MCP

여러분의 이점

네 번의 검색과 네 개의 출력

파일과 글로브(glob)에 걸친 한 번의 검색

더 적은 토큰과 왕복

권한 오류가 사라질 수 있음

files_unreadable이 놓친 모든 경로를 명시

"로그가 깨끗하다"는 잘못된 결론 방지

출력이 유용한 상한 없이 커질 수 있음

limited와 truncated가 모든 잘림을 노출

부분 결과에서 더 안전한 결정

since는 서버의 시계를 사용하고, namesOnly: true는 일치하는 경로만 반환하며, ssh_log_tail은 한 번의 호출로 여러 로그의 마지막 N줄을 읽습니다.

안전한 원격 설정 파일 편집

상황: 운영 중인 서버의 nginx 설정을 교체해야 합니다. 연결 끊김, 잘못된 모드, 확인되지 않은 복사는 서비스를 손상된 파일로 남길 수 있습니다.

질문: "부분 파일을 남기지 않고 이 설정을 교체할 수 있나요?"

원시 SSH

$ sudo sh -c 'cat > /etc/nginx/conf.d/api.conf' <<'EOF'
server {
    listen 80;
    location / { proxy_pass http://127.0.0.1:8080; }
}
EOF
$ echo $?
0

종료 코드 0은 셸이 완료되었음을 의미합니다. 어떤 바이트가 실제로 기록되었는지는 증명하지 않으며, >는 새 파일의 첫 바이트가 도착하기 전에 기존 파일을 잘라버렸습니다. 쓰기 중에 연결이 끊기면 서비스는 부분 설정 파일을 남기게 됩니다.

구조화된 MCP 결과

ssh_file_write({ "profile": "production",
                 "files": [{ "path": "/etc/nginx/conf.d/api.conf",
                             "content": "server {\n    listen 80;\n    location / { proxy_pass http://127.0.0.1:8080; }\n}\n",
                             "mode": "644", "sudo": true, "verify": true }] })
{
  "files": [{ "path": "/etc/nginx/conf.d/api.conf", "written": true,
              "verified": "verified", "reason": null, "bytes": 79 }]
}

에이전트가 얻는 이점

Raw SSH

Structured MCP

Your gain

대상 본문이 복사 완료 전에 잘림

완전한 임시 파일이 한 번의 rename으로 대체함

반쯤 쓰인 설정 파일 없음

종료 코드만 반환

바이트와 검증 결과가 이름 있는 형태로 제공

실제로 무엇이 저장되었는지 알 수 있음

권한이 셸 텍스트 안에 있음

sudo, mode, verify가 파일별 필드

예측 가능한 소유권과 더 적은 따옴표 실수

verified는 세 가지 정직한 결과를 가집니다: verified, 서버에 해시 도구가 없을 때의 unavailable, 그리고 검증이 요청되지 않았을 때의 skipped입니다. 읽기의 경우 ssh_file_read는 경로 목록을 받고, ssh_file_list는 glob, 재귀, 크기, 모드를 처리합니다.

sudo로 배치 SSH 명령 실행하기

상황: 배포가 준비됐지만, 트래픽을 이동하기 전에 nginx 문법, 서비스 상태, 최근 오류를 모두 확인해야 합니다. 한 번의 실패한 검사가 결합된 덤프 안에서 사라져서는 안 됩니다.

질문: "모든 사전 점검이 통과했나요?"

원시 SSH

$ ssh admin@server.example.com 'sudo nginx -t'
nginx: configuration file /etc/nginx/nginx.conf test is successful
$ ssh admin@server.example.com 'sudo systemctl is-active nginx'
active
$ ssh admin@server.example.com 'sudo tail -5 /var/log/nginx/error.log'
2026/08/20 10:38:54 [error] upstream timed out while reading response header

세 번의 연결이 서로 무관한 세 가지 출력을 반환합니다. 명령을 ;로 연결하면 쉘은 마지막 종료 코드만 보고하고, &&로 연결하면 첫 실패 이후의 검사는 사라집니다.

구조화된 MCP 결과

ssh_exec({ "profile": "production",
           "command": ["nginx -t", "systemctl is-active nginx",
                       "tail -5 /var/log/nginx/error.log"],
           "sudo": true })
{
  "commands": [
    { "command": "nginx -t", "exit_code": 0, "truncated": false, "clipped_bytes": 0,
      "stdout": "", "stderr": "nginx: configuration file /etc/nginx/nginx.conf test is successful\n" },
    { "command": "systemctl is-active nginx", "exit_code": 0, "truncated": false,
      "clipped_bytes": 0, "stdout": "active\n", "stderr": "" },
    { "command": "tail -5 /var/log/nginx/error.log", "exit_code": 0, "truncated": false,
      "clipped_bytes": 0, "stdout": "2026/08/21 09:14:02 [error] upstream timed out\n", "stderr": "" }
  ],
  "job_id": null
}

에이전트가 얻는 이점

원시 SSH

구조화된 MCP

당신의 이점

세 번의 호출과 서로 무관한 출력

하나의 순서 있는 명령 목록

왕복 횟수 감소

한 번의 결합된 쉘이 중간 상태를 숨길 수 있음

모든 명령이 자신만의 exit_code를 유지

놓친 실패 검사 없음

sudo와 따옴표가 명령 텍스트에 반복됨

sudo가 전체 배치에 적용

더 적은 따옴표 실수

파괴적 명령 가드는 첫 번째 명령이 실행되기 전에 전체 목록을 검사합니다. 하나의 항목이 거부되면 다른 모든 항목은 실행되지 않은 것으로 표시되고 서버로 아무것도 전송되지 않습니다.

각 명령은 자체 stdout과 stderr를 가집니다. 실행되어 출력이 없는 명령은 빈 문자열을 가지며, 실행되지 않은 명령은 해당 필드가 아예 없으므로 둘을 혼동할 수 없습니다. 명령당 128KB를 초과하는 출력은 양쪽 끝을 모두 유지합니다 — 테이블용 머리와 로그용 꼬리 — 그리고 그 사이의 이음매는 잘린 양을 명시하며, clipped_bytes가 잘린 바이트 수를 알려줍니다. 잘림은 바이트 경계에서 발생하고 문자 끝으로 물러나므로, 잘린 출력에 교체 표시가 포함되지 않습니다.

sudo는 터미널 없이 서버에 도달합니다: 프로필에 비밀번호가 있으면 표준 입력으로 sudo에 전달됩니다. 키로 인증하는 프로필에는 전달할 비밀번호가 없으므로, 거기서 sudo는 이미 비밀번호 없이 허용된 곳에서만 작동합니다. 그리고 자신의 표준 입력을 읽는 명령에는 비밀번호가 절대 전달되지 않으므로, 비밀번호가 데이터에 섞여 들어가지 않습니다.

장기 실행 SSH 작업 실행하기

상황: 백업이나 마이그레이션이 대화보다 오래 실행됩니다. 연결이 끊길 수 있지만, 나중에 상태, 출력, 종료 코드가 여전히 필요합니다.

질문: "이 작업이 대화가 끝난 뒤에도 유지될까요?"

원시 SSH

$ ssh admin@server.example.com 'pg_dump app | gzip > /srv/backups/app.sql.gz'
client_loop: send disconnect: Broken pipe

터미널이 닫혔습니다. 다시 연결해 프로세스를 찾고, 대상 파일을 조사하고, 백업이 완료됐는지 중간에 실패했는지 추측해야 합니다.

Structured MCP 결과

ssh_exec({ "profile": "production",
           "command": "pg_dump app | gzip > /srv/backups/app.sql.gz",
           "detach": true })
{
  "commands": [{
    "command": "pg_dump app | gzip > /srv/backups/app.sql.gz",
    "exit_code": null,
    "truncated": false,
    "timed_out": false,
    "blocked": false,
    "blocked_reason": null,
    "not_run": false,
    "warning": null
  }],
  "job_id": "mst0f2q1-9ab3c4d5"
}

얻을 수 있는 이점

Raw SSH

Structured MCP

당신이 얻는 것

작업이 단일 SSH 세션에 묶여 있음

원격 작업에 지속적인 id가 있음

안전한 연결 해제와 재시작

재연결은 다시 해석해야 함

상태와 종료 코드가 명명된 형태로 제공

완료 여부를 추측할 필요 없음

출력을 다시 읽으면 처음부터 반복

바이트 오프셋부터 출력이 이어짐

긴 작업에서 토큰 사용량 감소

작업 상태는 이 서버의 메모리가 아니라 원격 머신의 디스크에 저장됩니다. ssh_job_status는 running, finished, lost를 구분하며, ssh_job_output은 마지막 바이트 오프셋부터 이어서 읽고, ssh_job_kill은 셸뿐 아니라 전체 프로세스 그룹에 시그널을 보냅니다.

레거시 라우터와 NAS 장치로 파일 전송하기

상황: 현재 OpenSSH 클라이언트는 SFTP를 시도하지만, 라우터나 NAS는 기존의 scp 프로토콜만 이해합니다. 파일은 그래도 온전히 도착하고 대상 파일을 안전하게 교체해야 합니다.

질문: "이 오래된 장치가 여전히 검증된 파일을 받을 수 있을까요?"

원시 SSH

$ scp app.conf operator@router:/etc/app.conf
subsystem request failed on channel 0
scp: Connection closed

보통 다음 단계는 레거시 플래그를 기억해 내고, 재시도한 다음 별도의 해시 명령을 실행하는 것입니다 — 장치에 해시 도구가 있다면 말이죠.

구조화된 MCP 결과

ssh_upload({ "profile": "router", "local_path": "./app.conf",
             "remote_path": "/etc/app.conf", "sudo": true,
             "mode": "644", "owner": "root:root", "verify": true })
{
  "files": [{
    "path": "/etc/app.conf",
    "written": true,
    "verified": "verified",
    "reason": null,
    "bytes": 1284
  }]
}

에이전트가 얻는 이점

원시 SSH

Structured MCP

당신의 이점

최신 SFTP 모드가 첫 실패에서 멈춤

클래식 scp 폴백이 자동이며 기억됨

오래된 장비도 여전히 동작함

성공한 복사가 무결성을 증명하지 않음

SHA-256 검증에 이름 있는 결과가 있음

성공과 실패를 혼동하지 않음

직접 교체는 부분 쓰기로 끝날 수 있음

임시 파일이 전송 후 제자리로 이동

중단에도 원본 파일이 살아남음

장치에 sha256sum도 openssl도 없으면 결과는 unavailable이라고 말하고, 잘못된 일치를 보고하는 대신 이유를 명시합니다. recursive: true로 재귀 전송을 하면 해시도 재귀적으로 검증합니다.

파괴적 명령 보호

이 서버는 사전 검사 없이 임의의 SSH 명령을 실행하지 않습니다. 파괴적 명령은 로컬에서 차단됩니다.

AI 에이전트를 위한 파괴적 명령 가드

가드는 로컬에서, 명령이 SSH로 전송되기 전에 실행됩니다. 데이터를 담고 있는 것을 지우는 작업과 내용만 바꾸는 작업을 구분하고, 명령 순서도 확인합니다.

파괴적 체인을 시작하기 전에 멈추기

안전한 교체 순서:

cp -r /srv/app /srv/app.bak && mv /srv/app /srv/app-old && rm -rf /srv/app

같은 작업을 파괴적 순서로:

rm -rf /srv/app && cp -r /srv/app /srv/app.bak && mv /srv/app /srv/app-old
# REFUSED before the first command runs

쉘은 백업 소스가 사라진 것을 나중에야 발견합니다. 가드는 이전 단계가 이미 파괴한 대상을 이후 단계가 읽는 것을 감지하고 전체 호출을 사용자 머신에 남겨 둡니다. 같은 검사가 && 체인에도 적용됩니다 — 예를 들어 dropdb app && pg_dump app > backup.sql은 pg_dump가 존재하지 않는 데이터베이스를 읽으려고 하므로 차단됩니다.

되돌릴 수 없는 손실은 거부하고, 경고만 하는 경우

컨테이너 자체 — 거부됨

경고만 — 내용 변경

DROP DATABASE, DROP SCHEMA

DROP TABLE

docker volume rm

docker rm -f

crontab -r

crontab -e

mkfs, wipefs, dd

rm -rf은 내용만 지움

git push --force

git reset --hard

명령이 파괴적인지 아닌지는 컨텍스트에 따라 다릅니다. rm -rf 한 줄만으로는 충분하지 않습니다. 가드는 경로 제한과 함께 전체 명령 목록을 확인합니다.

확인된 파괴적 명령

가드는 로컬에서, 명령이 SSH로 전송되기 전에 실행됩니다. 데이터를 담고 있는 것을 지우는 작업과 내용만 바꾸는 작업을 구분합니다.

# GXP14에서 세 연결은 독립적입니다. ;로 연결하면 셸은 마지막 종료 코드만 보고하고, &&로 연결하면 나중 검사가 사라집니다.

# GXP15에서 하나의 배치가 세 가지 답을 반환합니다.

{
  "commands": [
    { "command": "nginx -t", "exit_code": 0, "truncated": false, "clipped_bytes": 0,
      "stdout": "", "stderr": "nginx: configuration file /etc/nginx/nginx.conf test is successful\n" },
    { "command": "systemctl is-active nginx", "exit_code": 0, "truncated": false,
      "clipped_bytes": 0, "stdout": "active\n", "stderr": "" },
    { "command": "tail -5 /var/log/nginx/error.log", "exit_code": 0, "truncated": false,
      "clipped_bytes": 0, "stdout": "2026/08/21 09:14:02 [error] upstream timed out\n", "stderr": "" }
  ],
  "job_id": null
}

# GXP17에서 마지막 줄은 다음과 같습니다: 각 명령은 자체 종료 코드를 유지합니다.

# GXP18에서 마지막 줄은 다음과 같습니다: 출력은 128KB로 잘립니다.

# GXP19에서 마지막 줄은 다음과 같습니다: 작업 상태는 원격 디스크에 저장됩니다.

$ scp app.conf operator@router:/etc/app.conf
subsystem request failed on channel 0
scp: Connection closed
ssh_upload({ "profile": "router", "local_path": "./app.conf",
             "remote_path": "/etc/app.conf", "sudo": true,
             "mode": "644", "owner": "root:root", "verify": true })
{
  "files": [{
    "path": "/etc/app.conf",
    "written": true,
    "verified": "verified",
    "reason": null,
    "bytes": 1284
  }]
}
cp -r /srv/app /srv/app.bak && mv /srv/app /srv/app-old && rm -rf /srv/app
rm -rf /srv/app && cp -r /srv/app /srv/app.bak && mv /srv/app /srv/app-old
# REFUSED before the first command runs

# GXP20에서 마지막 줄은 다음과 같습니다: 복사는 바이트 경계에서 잘립니다.

{
  "profiles": {
    "production": {
      "host": "server.example.com",
      "username": "admin",
      "port": 22,
      "privateKeyPath": "~/.ssh/your_private_key"
    }
  }
}

# GXP21에서 마지막 줄은 다음과 같습니다: 출력은 128KB로 잘립니다.

ssh_exec({ command: "uptime" })
→ No profile specified. Name one explicitly: production

# GXP22에서 마지막 줄은 다음과 같습니다: 출력은 128KB로 잘립니다.

{
  "secretsFile": "~/.config/ssh-mcp/secrets.json",
  "profiles": {
    "production": {
      "host": "server.example.com",
      "username": "admin"
    }
  }
}

shell 명령과 MCP 도구의 차이는 구조화된 출력입니다. 이 서버는 네 가지 도구를 제공합니다: ssh_exec, ssh_file_read, ssh_file_write, ssh_file_list.

SSH MCP 도구

도구

설명

ssh_exec

원격 명령 실행, 배치, 파괴적 명령 가드, 선택적 분리 실행

ssh_file_read

원격 파일 읽기, 텍스트 또는 바이너리

ssh_file_write

원자적 이름 변경과 선택적 SHA-256 검증으로 파일 쓰기

ssh_file_list

디렉터리 목록, 선택적 glob과 재귀

원격 파일 관리

도구

설명

ssh_file_read

하나 또는 여러 파일 읽기, 텍스트 또는 바이너리

ssh_file_write

원자적 이름 변경과 선택적 SHA-256 검증으로 파일 쓰기

ssh_file_list

디렉터리 목록, 선택적 glob과 재귀

장기 실행 SSH 작업 모니터링

도구

설명

ssh_job_status

백그라운드 작업 상태: running, finished, lost

ssh_job_output

바이트 오프셋에서 누적 출력 계속 읽기

ssh_job_list

작업 목록, TTL 지난 작업 정리

ssh_job_kill

작업의 전체 프로세스 그룹에 시그널 보내기

로그 검색 및 상태 확인

도구

설명

ssh_log_tail

하나 또는 여러 로그의 마지막 N줄, glob 지원

ssh_log_search

로그에서 패턴 검색

ssh_snapshot

원격 시스템 상태 스냅샷: 서비스, 리소스, 오류

ssh_monitor

원격 모니터링: 상태, 재시작, 목록

파일 전송

도구

설명

ssh_upload

파일 업로드

ssh_download

파일 다운로드

참고: 전송 도구는 SFTP를 사용합니다. 레거시 장치가 SFTP를 지원하지 않으면 ssh_exec으로 scp를 사용하세요.

Windows SSH 호환 모드

Windows는 호환 모드를 자동으로 사용합니다. 연결 다중화를 사용할 수 없으면 서버는 명령마다 하나의 연결을 사용하도록 전환합니다. 동일한 도구는 키 기반 SSH에서 계속 사용할 수 있습니다. 별도의 설정이나 Windows 전용 구현은 필요 없습니다.

파괴적 명령 보호 장치는 AI 에이전트용 파괴적 명령 보호에서 다룹니다.

SSH MCP 서버 설정하기

먼저 30초 설치에서 패키지를 실행한 다음 프로필 파일을 만드세요.

SSH 연결 프로필 만들기

원하는 곳에 두면 됩니다. 보통 에이전트 자체 설정 파일 옆에 둡니다. 아래 예시는 ~/.claude/ssh-profiles.json을 사용합니다. 다른 에이전트는 디렉터리를 바꾸세요(~/.codex/, ~/.qwen/, ~/.config/opencode/):

{
  "profiles": {
    "production": {
      "host": "server.example.com",
      "username": "admin",
      "port": 22,
      "privateKeyPath": "~/.ssh/your_private_key"
    }
  }
}

SSH 프로필을 명시적으로 선택하기

서버가 기본으로 사용하는 프로필은 없습니다. 각 프로필은 서로 다른 머신을 가리키며, 잘못된 머신에 보낸 명령은 이후에 오류 메시지로 되돌릴 수 없습니다. 이름 없이 요청하면 선택할 수 있는 이름 목록이 답으로 옵니다:

ssh_exec({ command: "uptime" })
→ No profile specified. Name one explicitly: production

서버가 SSH에 사용할 수 없는 프로필 — host가 없거나, username이 없거나, mode: "local"인 경우 — 은 불평 없이 건너뛰며, 인식하지 못하는 필드는 그대로 두므로 파일을 다른 도구와 공유할 수 있습니다. 손상된 필드가 있는 프로필은 다른 경우입니다. 필드와 값과 함께 프로필 이름이 표시되고, 정상인 다른 프로필은 계속 작동합니다.

각 프로필은 선택적으로 pathSecurity 블록을 사용하여 파일 도구가 접근할 수 있는 경로를 허용하거나 차단할 수 있습니다 — docs/security.md를 참조하세요.

SSH 비밀번호와 패스프레이즈를 프로필에 넣지 않기

키를 선호하세요. 비밀번호나 암호화된 키의 패스프레이즈를 피할 수 없다면 별도의 시크릿 파일에 보관하고, 절대 프로필 자체에 넣지 마세요:

{
  "secretsFile": "~/.config/ssh-mcp/secrets.json",
  "profiles": {
    "production": {
      "host": "server.example.com",
      "username": "admin"
    }
  }
}

시크릿 파일은 프로필 이름을 키로 사용합니다 — secrets.json.example을 참조하세요:

{
  "production": { "password": "..." }
}

시크릿 파일은 사용자 본인만 읽을 수 있어야 합니다(chmod 600). 상대 경로는 프로필 파일을 기준으로 해석됩니다. 시크릿은 argv에 포함되지 않으며 로그에서 마스킹됩니다. 자격 증명 보안을 참조하세요.

Claude Code, Codex 및 기타 MCP 클라이언트 구성하기

사용하는 클라이언트를 선택하고 동일한 프로필 파일을 가리키게 하세요.

Claude Code

명령 하나면 됩니다. -s user는 서버를 모든 프로젝트에서 사용할 수 있게 합니다:

claude mcp add ssh -s user \
  -e SSH_PROFILES_FILE="$HOME/.claude/ssh-profiles.json" \
  -- npx -y @hypnosis/ssh-mcp-server

Codex CLI

codex mcp add ssh \
  --env SSH_PROFILES_FILE="$HOME/.codex/ssh-profiles.json" \
  -- npx -y @hypnosis/ssh-mcp-server

opencode

~/.config/opencode/opencode.json에 넣으세요:

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "ssh": {
      "type": "local",
      "command": ["npx", "-y", "@hypnosis/ssh-mcp-server"],
      "enabled": true,
      "environment": {
        "SSH_PROFILES_FILE": "~/.config/opencode/ssh-profiles.json"
      }
    }
  }
}

Qwen Code

다른 것들과 마찬가지로 명령 하나면 됩니다:

qwen mcp add ssh \
  -e SSH_PROFILES_FILE="$HOME/.qwen/ssh-profiles.json" \
  npx -y @hypnosis/ssh-mcp-server

기타 MCP 클라이언트

Gemini CLI, Hermes, Cline, 편집기 플러그인 또는 직접 만든 에이전트도 같은 방식으로 작동합니다. 필요한 것은 실행할 명령과 환경 변수 하나뿐입니다.

MCP 클라이언트 다시 시작하기

클라이언트를 다시 시작한 다음 ssh_monitor({ action: "list" })를 실행하여 프로필이 로드되었는지 확인하세요.

SSH MCP 서버 구성

Variable

What it does

Default

SSH_PROFILES_FILE

프로필 JSON의 경로 — 필수

—

SSH_MCP_LOG_LEVEL

debug, info, warn, error

info

LOG_LEVEL

대체값. SSH_MCP_LOG_LEVEL이 설정되지 않은 경우에만 사용됨

info

SSH_MCP_LOG_TIMESTAMP

로그 줄의 타임스탬프

true

SSH_MCP_CONTROL_PERSIST

마지막 명령 후 공유 연결이 유지되는 시간(초). 0이면 즉시 닫음

600

SSH_MCP_CONTROL_DIR

컨트롤 소켓이 위치하는 곳

~/.ssh/ssh-mcp

SSH_MCP_PROFILES_CACHE_TTL

프로필 캐시 TTL(ms)

60000

SSH_MCP_PROFILES_WATCH

프로필 파일이 변경되면 다시 로드함

true

공유 연결은 의도적으로 이 프로세스보다 오래 유지됩니다. 종료 시 연결을 닫으면 같은 머신의 다른 창이 사용 중인 채널이 끊기기 때문입니다.

SSH MCP 서버 제한 사항

  • 취소: SSH를 닫으면 원격 명령이 계속 실행 중일 수 있습니다. 제어가 중요하다면 분리된 작업(detached job)을 사용하세요.

  • 원자적 쓰기: BSD와 macOS는 파일 시스템 간 이름 변경을 사전에 확인할 수 없습니다.

SSH MCP 서버 로드맵

  • macOS SSH 호스트에 대한 전체 테스트 실행

  • Windows에서 엔드투엔드 호환성 실행

  • 다중 호스트 감사 — 한 번의 호출로 여러 SSH 프로필의 상태 비교

  • 기존 ~/.ssh/config에서 프로필 가져오기

  • 대용량 파일과 불안정한 연결을 위한 이어서 전송

  • 원격 작업 타임라인 — 명령, 전송, 보호 결정을 하나의 감사 추적으로

  • 즉시 사용 가능한 SSH 문제 해결 플레이북

  • 모델에 도달하는 답변 — 완료: 명령 출력, 일치하는 로그 줄, 머신 이름, 스냅샷 섹션이 텍스트뿐만 아니라 필드에도 전달됩니다

  • 더 작은 MCP 도구 스키마 — 완료: 도구 목록이 10% 가벼워졌고, 분리된 작업은 맹목적으로 폴링되는 대신 마지막으로 기록한 줄을 표시합니다

SSH MCP 서버 개발 및 테스트

npm install
npm run build           # tsc
npx tsc --noEmit        # types, plus dead declarations
npm run test:unit       # unit tests
npm run lab:up          # start the two test containers
npm run test:live       # live suite against those containers

실제 테스트 스위트는 실제 컨테이너(BusyBox 하나, coreutils 하나)를 대상으로 실행됩니다. 두 컨테이너는 조용히 의견이 다르고, 모의 객체는 작성자 편에 서기 때문입니다. 구조는 docs/architecture.md를 참조하세요.

SSH MCP 서버가 마음에 드시나요? ⭐

이 도구가 마음에 든다면 GitHub에서 스타를 눌러 주세요 — 더 많은 사람들이 프로젝트를 발견하는 데 도움이 됩니다.

SSH MCP 서버에 기여하기

이슈와 풀 리퀘스트는 github.com/hypnosis/ssh-mcp-server에서 환영합니다.

라이선스

MIT — LICENSE를 참조하세요.

Available Tools

18 tools
ssh_audit_baselineA
Read-only

Reports how a machine is set up: sshd, firewall, pending updates, failed services, docker, listening ports and disk, each section marked CRITICAL, WARNING or OK. Reads only, in one round trip instead of a dozen commands. For load and health at this moment rather than settings, use ssh_snapshot.

NameRequiredDescriptionDefault
compactNoTrim the long sections. false = whole, much larger answer. Default: true
includeNosystem, disk, mem, net, ssh, services, docker, firewall, updates. Default: all
profileYesMachine name.
include_sudo_sectionsNoRun the sections that need root as root: sshd -T for ssh, ufw and iptables rules for firewall. Without it those sections name what they could not read instead of guessing. Default: false

Output Schema

NameRequiredDescription
osNo
netNo
sshNo
diskNo
loadNo
dockerNo
kernelNo
legendNoWhat the words in this answer mean. A key names the field before the value — "state=limited", "jobs[].state=lost" — and only the values this answer actually used are listed.
memoryNo
uptimeNo
updatesNo
date_utcNo
firewallNo
hostnameNo
servicesNo
red_flagsNo
unavailableNo

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotation already declares readOnlyHint=true, and the description reinforces this with 'Reads only'. It adds useful behavioral context beyond the annotation by stating that sections are marked CRITICAL/WARNING/OK and that it replaces 'a dozen commands' in one round trip. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences with no filler: the first defines purpose and output shape, the second states safety and efficiency, and the third routes to the sibling tool. The most important scoping information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only audit tool, the description covers what it reports, how the output is categorized, why it is efficient, and which sibling to use in the alternate use case. Combined with full parameter documentation and an output schema, nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with every parameter documented including defaults and allowed values. The tool description contributes high-level context but does not need to compensate for missing parameter docs, so the baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Reports how a machine is set up', then enumerates exact domains (sshd, firewall, updates, services, docker, ports, disk) and the severity marking scheme. It also distinguishes itself from ssh_snapshot, so an agent can tell it apart from the closest sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit routing guidance: 'For load and health at this moment rather than settings, use ssh_snapshot.' It also frames the tool as a one-round-trip setup audit, making the intended use case clear without ambiguity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_disk_breakdownA
Read-only

Finds what filled a disk: free space per filesystem, the largest directories under each path given, and what docker, journald and package caches hold. Reads only, nothing is deleted. For how full the disks are at all, ssh_snapshot answers in one line.

NameRequiredDescriptionDefault
sudoNoRead as root. Straight away for places a plain user cannot read (/root, /var/lib/docker); otherwise retry with true when the answer names what it could not read. Default: false The cache section then reads root's home, not the profile user's.
pathsNoWhere to look. Naming the suspect beats walking the whole filesystem. Default: ["/"]
top_nNoLargest directories named per path. Default: 20
profileYesMachine name.

Output Schema

NameRequiredDescription
cacheNo
dockerNo
largestNo
var_logNo
journaldNo
unreadableNoNot looked into: the sizes above leave these out
filesystemsNo
unavailableNo

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, and the description reinforces this with 'Reads only, nothing is deleted.' It adds useful context about what areas are inspected (docker, journald, package caches) without contradicting the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences. The first explains scope and read-only behavior, and the second routes to the alternative for a different need. There is no filler or repeated schema content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With a rich input schema, an output schema, and a readOnlyHint annotation, the description covers what an agent needs: what it inspects, that it is safe, and how it relates to ssh_snapshot. No critical behavioral or selection information is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description does not add parameter-specific meaning beyond the schema, but it does relate the tool's purpose to the 'paths' concept. It neither improves nor harms parameter understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb-resource pair ('Finds what filled a disk') and enumerates the concrete outputs: free space per filesystem, largest directories per path, and cache contents. It also differentiates itself from ssh_snapshot by framing this as the detailed breakdown versus the one-line fullness answer.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a clear alternative and selection rule: use ssh_snapshot when only overall disk fullness is needed, and this tool when a breakdown is required. It could be slightly more explicit about when not to use the tool, but the guidance is strong enough for an agent to make the right choice.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_downloadA
DestructiveIdempotent

Copies a file or directory from a server to this machine, checked by sha256 on both sides. To read a text file rather than keep it, ssh_file_read skips the disk.

NameRequiredDescriptionDefault
sudoNoFor /root and the like. A root copy stages in /tmp, is fetched and removed — the machine needs room. Default: false
verifyNosha256 on both sides, per file. "unavailable" = no sha256 on the machine = delivered, not broken. "mismatched" fails the call and replaces nothing. Default: true
profileYesMachine name.
timeoutNoMilliseconds. No ceiling by default — a transfer runs as long as it takes.
recursiveNoOnly to force it — a directory is recognised on its own.
local_pathYesWhere it lands on this machine.
remote_pathYesWhat to fetch from the server.

Output Schema

NameRequiredDescription
filesNo
legendNoWhat the words in this answer mean. A key names the field before the value — "state=limited", "jobs[].state=lost" — and only the values this answer actually used are listed.

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide idempotentHint and destructiveHint, and the description adds meaningful behavioral detail: 'checked by sha256 on both sides.' This goes beyond the annotations by explaining the verification mechanism. It does not explicitly state that an existing local_path may be overwritten, but the destructiveHint annotation covers the general risk, and the schema's verify parameter adds mismatch semantics.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences with no redundant wording. The core action and verification detail are front-loaded, and the sibling alternative follows in a clearly conditional form. Every sentence contributes useful information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the rich input schema, output schema, and annotations, the description is complete enough for an agent to know what the tool does, when to use it, and when not to. It covers direction, verification, and the key sibling alternative, with no missing information necessary for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all seven parameters in detail. The description adds no parameter-level meaning beyond the schema; it only restates the overall transfer and verification behavior. A baseline of 3 is appropriate since the schema carries the semantic weight.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action and resource: 'Copies a file or directory from a server to this machine.' This clearly identifies the tool's direction and purpose. It also differentiates from ssh_file_read by noting the alternative is for reading text without keeping a copy, and the title 'Download from a server' reinforces the intent.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly provides an alternative and a usage condition: 'To read a text file rather than keep it, ssh_file_read skips the disk.' This tells an agent when to prefer a sibling tool instead. The copy direction is unambiguous, so there is no confusion with ssh_upload.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_execA
Destructive

Runs one command or a list of them on a server, each with its own exit code, stdout and stderr. Work measured in minutes belongs in detach, not in a longer timeout. Reach for it last — files, logs, transfers, health and jobs each have a tool that batches the round trips and parses the answer.

NameRequiredDescriptionDefault
cwdNoDirectory to start in, detached jobs included. Cannot be entered -> the command stops, it does not run elsewhere.
sudoNoExecute command(s) with sudo. Default: false
detachNoBackground job on the server: returns an id at once, outlives this call, timeout does not apply. Follow with ssh_job_status / ssh_job_output, stop with ssh_job_kill. One command. With sudo the job runs as root and every later call follows it as root, provided the profile has a password or sudo needs none. Default: false
commandYesOne command, or a list: ["hostname", "whoami"]. Each runs in its own shell — no shared variable, no shared cd; cwd applies to all. A non-zero exit does not stop the list.
profileYesMachine name.
timeoutNoMilliseconds, per command in a list, not for the whole list; default 30000. Work measured in minutes -> detach, not a bigger number.

Output Schema

NameRequiredDescription
job_idNo
legendNoWhat the words in this answer mean. A key names the field before the value — "state=limited", "jobs[].state=lost" — and only the values this answer actually used are listed.
commandsNo

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the destructiveHint annotation, the description adds behavior: each command returns its own exit code, stdout, and stderr, and long-running work should be detached rather than given a bigger timeout. It doesn't fully warn about the arbitrary-command risk, but the annotation and phrasing imply raw execution.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences carry both the core behavior and the key usage caveat. Every clause earns its place, and the most important routing guidance comes second but remains succinct.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The combination of a rich schema, output schema, and a description that covers command granularity and tool routing gives an agent enough to invoke this correctly. It does not name the exact sibling tools, but the categories are identifiable from the sibling list.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already explains every parameter. The description reinforces the detach-vs-timeout tradeoff at a high level, but adds no new parameter-specific meaning. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: running one command or a list on a server, with per-command exit code, stdout, and stderr. It also differentiates from specialized siblings by saying files, logs, transfers, health, and jobs each have their own tool, making this the raw fallback.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-not-to-use guidance: work measured in minutes belongs in detach, not a longer timeout. It also tells the agent to prefer category-specific tools because they batch round trips and parse answers, which is clear routing advice.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_file_listA
Read-only

Lists a directory on a server: every entry with its size, mode, owner and modification time, as fields. A directory it was not allowed to enter is named rather than left out, and a listing cut short by the output limit says so. To see what is inside a file, use ssh_file_read.

NameRequiredDescriptionDefault
pathYesDirectory to list.
sudoNoList as root, for directories the profile user cannot open. Default: false
patternNoGlob matched on the machine: "*.conf". Without it every entry comes back.
profileYesMachine name.
recursiveNoDescend into subdirectories. A deep tree is cut at the output limit and says so. Default: false

Output Schema

NameRequiredDescription
pathNo
legendNoWhat the words in this answer mean. A key names the field before the value — "state=limited", "jobs[].state=lost" — and only the values this answer actually used are listed.
entriesNo
truncatedNoThe output limit cut the answer: the directory holds more than entries lists.
unreadableNoDirectories nobody was allowed to enter. Their contents are missing from entries, and a list short by the one that mattered looks complete.

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint annotation, it discloses useful behavioral edge cases: unreadable directories are named rather than silently omitted, and listings truncated by the output limit are explicitly flagged. This gives the agent accurate expectations for permission failures and large listings.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences with no filler: core purpose first, then key behavioral guarantees, then the routing note to ssh_file_read. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With a readOnlyHint, 100% schema parameter coverage, and an output schema present, the description covers the remaining contextual needs: result contents, error behavior, truncation signaling, and the relationship to the closest sibling. Nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the input schema fully documents all five parameters. The description adds context about output fields and truncation but not new parameter-level semantics, matching the baseline for fully documented schemas.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Lists a directory on a server' and names the returned fields (size, mode, owner, modification time). It distinguishes itself from ssh_file_read by explicitly directing file-content needs to that sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly states the tool's use case (listing directories) and provides an explicit alternative for the adjacent case ('To see what is inside a file, use ssh_file_read'). No ambiguity remains about which sibling to pick for file-content access.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_file_readA
Read-only

Reads text files from a server, several of them in one call. A file it could not read is named with the reason, never returned empty or cut short as if that were the content. To look for something inside logs rather than read them, ssh_log_search greps on the server.

NameRequiredDescriptionDefault
pathYesOne path, or a list: ["/etc/hosts", "/etc/resolv.conf"]. An unreadable file costs the list nothing — the others still come back.
sudoNoRead as root, for files the profile user cannot open. Default: false
binaryNoFetch over the transport, not the command channel; answer in base64. The safe way for non-text, implies encoding=base64. Default: false
profileYesMachine name.
encodingNobase64 keeps non-text bytes intact but still goes through the command channel and its size limit. Real binary -> binary below. Default: utf8utf8

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=true, which the description does not contradict. The description adds meaningful behavioral context beyond annotations: unreadable files are reported with the reason, never returned as empty or truncated content, and multiple files can be read in one call. These are useful operational details not captured by the annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with no filler. The primary purpose and batch capability are front-loaded, followed by error behavior and an alternative tool reference. Every sentence earns its place and the structure is clean.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With a rich schema that documents all parameters, the description covers the core behavior (batch read, error handling) and names an alternative. Since there is no output schema, the error-behavior note partially clarifies return semantics, though the exact response structure isn't specified. For a read-only tool, this is adequate and nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% — every parameter (path, sudo, binary, profile, encoding) has a detailed schema description with defaults and enums where applicable. The tool description itself adds no additional parameter semantics beyond the schema, so this dimension sits at the baseline for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence states a specific verb ('reads') and resource ('text files from a server') and highlights the batch capability ('several of them in one call'). It explicitly distinguishes itself from ssh_log_search, but does not address other siblings like ssh_file_list or ssh_file_write, so differentiation is partial.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides an explicit alternative: 'To look for something inside logs rather than read them, ssh_log_search greps on the server.' This is clear when-not-to-use guidance for one specific scenario, but it does not mention when to use ssh_file_list or other file tools, so coverage is limited.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_file_writeA
DestructiveIdempotent

Writes text files on a server, several in one call, each with its own path, permissions, owner and sudo. A file is replaced whole and never appears half-written; there is no append. For something that already exists on this machine, use ssh_upload.

NameRequiredDescriptionDefault
filesYesOne file, or a list — mode and sudo decided per file, not per call.
profileYesMachine name.

Output Schema

NameRequiredDescription
filesNo
legendNoWhat the words in this answer mean. A key names the field before the value — "state=limited", "jobs[].state=lost" — and only the values this answer actually used are listed.

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the idempotent and destructive hints, the description discloses that files are replaced whole, atomically, and never appended to. This adds useful behavioral context that the annotations alone do not provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, all high-signal: the core action, the atomic/replace behavior, and the sibling alternative. No filler or redundant restatement.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the rich input schema, annotations, and output schema, the description covers the essential behavioral semantics and alternative routing. Nothing critical is missing for an agent to invoke this correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already explains each parameter thoroughly. The description contributes the multi-file and per-file ownership/sudo framing, but most parameter-level meaning is in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: writes files on a server. It also differentiates itself from the closest sibling by saying anything already on this machine should use ssh_upload.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly names ssh_upload as the alternative for files that already exist locally, and clarifies the tool supports multiple files in one call. The no-append note also sets an important boundary.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_job_killA
DestructiveIdempotent

Stops a detached job and everything it started — the signal reaches the whole process group. A job that had already finished is reported as gone, not as a refusal.

NameRequiredDescriptionDefault
idYesJob id returned by ssh_exec with detach: true. A job started with sudo is reached as root from the id alone — nothing extra to pass.
signalNoKILL only when TERM was already ignored.TERM
profileYesMachine name.

Output Schema

NameRequiredDescription
idNo
legendNoWhat the words in this answer mean. A key names the field before the value — "state=limited", "jobs[].state=lost" — and only the values this answer actually used are listed.
reasonNo
signalNoWhat was actually sent, which is not always what was asked for.
outcomeNosignalled — the signal reached the process group of the job; gone — the job had already ended, so there was nothing to stop; nopid — the job recorded no pid, so there was nothing to signal; missing — the server knows no job under this id; no-answer — the server did not answer the stop request, so the job state is unknown.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint and idempotentHint. The description adds valuable context: the signal reaches the whole process group, and already-finished jobs are reported as 'gone' rather than a refusal. This goes beyond the annotation hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences that front-load the primary action and then clarify an edge case. No redundancy or wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is sufficient for a destructive operation with an output schema. It explains the scope of destruction (process group) and the idempotent edge case. Combined with schema documentation for parameters and annotation hints, an agent has what it needs to call correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers all 3 parameters with descriptions, so baseline is 3. The tool description itself does not add any parameter-specific meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Stops), resource (detached job), and clarifies it reaches the entire process group. Distinguishes from sibling tools like ssh_job_list and ssh_job_status which are non-destructive. Also clarifies behavior for already-finished jobs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for stopping detached background jobs, but does not explicitly mention alternatives or conditions when not to use. It clarifies that it targets detached jobs, giving scope, but lacks explicit when-not guidance or reference to alternative sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_job_listA
Read-only

Lists the detached jobs on a machine with their state, jobs started with sudo included — for when an id was not kept. Ids and states only; for what a job printed, use ssh_job_output.

NameRequiredDescriptionDefault
profileYesMachine name.

Output Schema

NameRequiredDescription
jobsNo
legendNoWhat the words in this answer mean. A key names the field before the value — "state=limited", "jobs[].state=lost" — and only the values this answer actually used are listed.

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, and the description adds meaningful behavioral detail beyond that: it lists detached jobs including sudo-started ones, and clarifies that only IDs and states are returned. This goes beyond the annotation without contradicting it.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler. The core purpose is front-loaded, followed by a scope caveat and a pointer to an alternative. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter read-only tool with an output schema, the description is complete. It explains scope, inclusion of sudo jobs, return content, and when to use it, while relying on annotations and the output schema for the rest.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% because the only parameter, 'profile', is documented as 'Machine name.' The description does not add parameter-level meaning beyond the schema, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Lists') and resource ('detached jobs on a machine with their state'), and adds a distinguishing constraint ('jobs started with sudo included'). It also explicitly differentiates itself from ssh_job_output by limiting scope to 'Ids and states only', so an agent can select it correctly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit when-to-use guidance: 'for when an id was not kept'. It also names the alternative for related needs: 'for what a job printed, use ssh_job_output'. This directly helps an agent choose between sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_job_outputA
Read-only

Returns what a detached job has written so far, stdout and stderr together, from a byte offset you choose. For whether the job is still running rather than what it printed, ssh_job_status answers in one line.

NameRequiredDescriptionDefault
idYesJob id returned by ssh_exec with detach: true. A job started with sudo is reached as root from the id alone — nothing extra to pass.
offsetNoByte offset to read from; the answer names the next one.
profileYesMachine name.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=true, which covers safety, and the description adds meaningful behavioral context: reads only output produced 'so far' (non-blocking), merges stdout and stderr, and supports reading from a chosen byte offset with the next offset returned. This goes beyond annotation data without contradicting it.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences carry the full purpose, the key behavioral detail, and the alternative-tool routing. The most important information is front-loaded, and there is no filler or repetition of schema fields.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only streaming tool with a complete schema, the description is largely sufficient: it conveys non-blocking behavior, combined streams, byte-offset seeking, and the cursor semantics. There is no output schema, so a bit more detail about the exact return shape would push this to 5, but nothing essential to invoking it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all three parameters. The tool description itself does not add new parameter-level meaning beyond what the schema says; it merely restates the offset concept. This meets the baseline for full schema coverage but does not exceed it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Returns what a detached job has written so far', and clarifies that stdout and stderr are combined. It also distinguishes this from ssh_job_status by explicitly contrasting output content with run-state. This leaves no ambiguity about the tool's core function.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The second sentence gives clear routing guidance: if an agent cares whether the job is still running, use ssh_job_status instead. This is an explicit condition that selects between two closely related siblings, which is exactly what an agent needs.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_job_statusA
Read-only

Reports the state of a detached job, with the last lines it wrote so you can see where it got to. lost means no exit code was left behind, not that the work failed — ssh_job_output still has the output.

NameRequiredDescriptionDefault
idYesJob id returned by ssh_exec with detach: true. A job started with sudo is reached as root from the id alone — nothing extra to pass.
profileYesMachine name.

Output Schema

NameRequiredDescription
jobsNo
legendNoWhat the words in this answer mean. A key names the field before the value — "state=limited", "jobs[].state=lost" — and only the values this answer actually used are listed.

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the tool as read-only, so the description adds value by explaining the 'lost' status semantics and clarifying that 'lost' does not mean the work failed. It also discloses that the output remains available via ssh_job_output, which is useful behavioral context beyond what the annotations state.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences convey the core purpose, the extra output detail, and the important 'lost' edge-case semantics. Every phrase carries meaning, and the key information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only status tool with complete schema descriptions and an output schema present, the description covers all essential context. The 'lost' clarification removes a likely source of confusion, and the readOnlyHint addresses safety.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides 100% parameter coverage with descriptive text for both 'id' and 'profile', including the note about sudo. The tool description itself adds no additional parameter-level meaning, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Reports') and a specific resource ('the state of a detached job'), and also states it includes the last lines written for progress visibility. This distinguishes it from sibling tools like ssh_job_output (which retrieves full output) and ssh_job_list (which lists jobs).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes clear when to use this tool: to check the state of a detached job and see where it got to via its last lines. It also gives an implicit when-not by pointing to ssh_job_output for cases where the job is 'lost' but output still exists. It does not explicitly contrast with ssh_job_list, but the single-job framing is enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_log_tailA
Read-only

Returns the last lines of one or more log files, whatever their size — nothing is shipped here to be trimmed locally. A container is read by name instead of by path, through the file its driver writes. To look for something rather than read the end, use ssh_log_search.

NameRequiredDescriptionDefault
pathNoOne path, a list, or a glob in the file name: "/var/log/*.log". Expanded by the server's find, not a shell — a name with a space or a newline stays one name. A glob in the directory part is refused.
sudoNoRead as root. Straight away for places a plain user cannot read (/root, /var/lib/docker); otherwise retry with true when the answer names what it could not read. Default: false
linesNoHow many lines from the end. Default: 100
profileYesMachine name.
containerNoRead this container's output instead of a file: docker is asked where it writes, and the answer names the file it read. Whatever cannot be read this way — a driver that keeps no file, an engine that is not docker, a name nothing answers to — comes back said aloud, naming ssh_exec as the way through. The file belongs to root, so sudo: true. Give this or path, never both.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint annotation, the description adds behavioral context: 'whatever their size — nothing is shipped here to be trimmed locally' and explains container resolution 'through the file its driver writes.' These clarify how the tool behaves without contradicting the annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three purposeful sentences: core behavior and scope come first, container nuance follows, and the sibling alternative closes. No filler, no repetition of schema details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only tail tool, the description plus fully described schema covers file paths, globs, container mode, sudo behavior, and search routing. It does not describe the return format, but that is reasonably inferable from 'returns the last lines' and no output schema exists.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the parameter descriptions already carry the meaning. The main description adds tailing/container framing but does not materially extend individual parameter semantics beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Returns the last lines of one or more log files'. It also distinguishes itself from the sibling ssh_log_search by explicitly contrasting tailing with searching for something.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly routes the agent: 'To look for something rather than read the end, use ssh_log_search.' It also clarifies the container-read path vs ordinary file paths, giving concrete context for when each mode applies.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_monitorA
Idempotent

Looks after the SSH connections themselves, not the machines behind them: lists the configured profiles, tests one, reports pool statistics, closes a connection or reloads the profile file. Start here on a machine you have not used yet — test names the state before anything else runs.

NameRequiredDescriptionDefault
actionYesWhich of the five to do. close and reload drop live connections; the other three only read.
profileNoWhich machine. Required for stats, test and close; list and reload take none.

Output Schema

NameRequiredDescription
stateNoready — logged in, commands run; limited — logged in and commands run, but the shell is not POSIX; no-route — the server was never reached; rejected — the server was reached and refused the login. null — nothing was checked: only the test action reaches the server.
actionNo
brokenNo
legendNoWhat the words in this answer mean. A key names the field before the value — "state=limited", "jobs[].state=lost" — and only the values this answer actually used are listed.
profileNo
profilesNo
exit_codeNo
latency_msNo

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description reveals important behavioral nuance beyond the annotations: close and reload drop live connections while the other actions only read. Annotations already signal idempotent and non-destructive, so this is additive rather than repetitive, and it does not contradict the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the core scope and followed by practical guidance. Every phrase earns its place; there is no redundant filler or repetition of schema content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With only two parameters, an output schema, and strong annotations, the description covers the essential usage guidance, side-effect differences, and conceptual scope. It could explicitly enumerate which action to use in which scenario, but the existing context is sufficient for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, with both parameters already well described in the schema. The description adds a high-level summary of actions but does not materially improve on the schema's per-parameter semantics, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb-and-resource purpose: managing SSH connections themselves, listing profiles, testing, reporting pool stats, closing, and reloading. It explicitly distinguishes itself from tools that operate on machines behind the connections, which differentiates it from the many ssh_ sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives concrete usage context: 'Start here on a machine you have not used yet' and recommends that 'test names the state before anything else runs.' It does not explicitly name which sibling tools to use instead, but its scope exclusion ('not the machines behind them') makes the appropriate context clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_service_statusA
Read-only

Reports one systemd unit: whether it is loaded, active and enabled, with the tail of its journal. A machine without systemd comes back as NOT CHECKED, never as a stopped service — that would read as an outage which is not there. For every failed unit at once, ssh_audit_baseline names them.

NameRequiredDescriptionDefault
sudoNoRead as root. Straight away for places a plain user cannot read (/root, /var/lib/docker); otherwise retry with true when the answer names what it could not read. Default: false Without it the journal comes back trimmed to what the profile user may see.
unitYesUnit name, e.g. "nginx" or "nginx.service".
sinceNoJournal window, as journalctl reads it: "1h ago", "today", "2026-08-19".
profileYesMachine name.
log_linesNoJournal lines returned. Default: 50

Output Schema

NameRequiredDescription
unitNo
legendNoWhat the words in this answer mean. A key names the field before the value — "state=limited", "jobs[].state=lost" — and only the values this answer actually used are listed.
enabledNo
outcomeNochecked — systemd answered, and the fields below carry its measurement; no_systemd — there was nobody to ask on this server, so the service was not measured; no_unit — systemd knows no such unit, which is not the same as a unit that is stopped.
restartNo
sub_stateNo
recent_logNo
status_headNo
active_stateNo
restart_afterNo

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With readOnlyHint=true, the safety profile is already known, so the description adds valuable behavioral context beyond annotations: the NOT CHECKED distinction for non-systemd machines and the journal-tail behavior. This prevents a false outage conclusion and clarifies return semantics.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences with no filler. The main purpose is front-loaded, and each subsequent sentence contributes either a behavioral caveat or a sibling alternative. Nothing is repeated from the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema exists and the input schema fully documents parameters, the description covers the essential agent-facing context: single-unit scope, journal tail, systemd-absence semantics, and the relevant sibling tool. No critical gap remains.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the input schema already documents all five parameters well. The description does not materially add parameter-level detail beyond the schema, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Reports one systemd unit: whether it is loaded, active and enabled, with the tail of its journal.' It also differentiates from ssh_audit_baseline by noting that sibling names failed units at once, making the tool's single-unit scope clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives an explicit alternative and condition: 'For every failed unit at once, ssh_audit_baseline names them.' It also provides a crucial usage caveat—machines without systemd return NOT CHECKED, not stopped—so an agent knows when not to interpret the result as an outage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_snapshotA
Read-only

Reports how a machine is doing right now: cpu, memory, disk, containers, listening ports, services and recent errors, in one round trip. Whatever could not be measured comes back null and marked unavailable, never as a zero that reads like an idle machine. For how the machine is set up rather than how it is running, use ssh_audit_baseline.

NameRequiredDescriptionDefault
profileYesMachine name.

Output Schema

NameRequiredDescription
loadNo
portsNo
cpu_pctNo
mem_pctNo
disk_pctNo
servicesNo
listeningNo
containersNo
error_linesNo
unavailableNo
recent_errorsNo
services_runningNo
containers_runningNo

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish readOnlyHint=true, so the read-only nature is covered. The description adds valuable behavioral context: unmeasured values return null and are marked unavailable rather than zero, preventing misinterpretation. This goes beyond annotations by defining output semantics, so a 4 is justified.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with no filler. It front-loads the core purpose, adds the critical null-behavior detail, and ends with the alternative. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that an output schema exists (which explains return structure) and the description covers what it measures, the round-trip efficiency, and the null unavailable convention, nothing essential is missing for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The sole parameter 'profile' is already fully described in the schema as 'Machine name.' (100% coverage). The description does not add any further detail about the parameter, so baseline 3 applies—the schema carries the full semantic load.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool reports current machine health (cpu, memory, disk, containers, listening ports, services, recent errors) in one round trip, and explicitly contrasts it with ssh_audit_baseline for setup vs. running state. This makes its purpose unambiguous and distinguishes it from siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when to use this tool: for current operational status, and when not to (for configuration use ssh_audit_baseline). This directly names the alternative and the condition, leaving no ambiguity about selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_tls_checkA
Read-only

Checks the TLS certificate a domain serves — days left, whether the name matches a SAN, the issuer and whether renewal is configured — with the handshake made from the server itself, so it sees what that machine sees, including hosts closed to the outside. A null field means the check could not run, not that the certificate is bad. Run it per domain, once ssh_audit_baseline has named the sites.

NameRequiredDescriptionDefault
portNoDefault: 443
sudoNoRead the renewal config as root. Without it "no hook configured" only means "could not look". Default: false
domainYesThe name to ask for, e.g. "example.com".
profileYesMachine name.
check_renew_hookNoAlso look for the renewal config. Default: true

Output Schema

NameRequiredDescription
portNo
domainNo
issuerNo
san_textNo
not_afterNo
days_until_expiryNo
renew_hook_evidenceNo
renew_hook_configuredNo
san_includes_hostnameNo

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint annotation, the description reveals that the handshake is made from the server itself, so it sees hosts closed to the outside, and clarifies that null fields mean the check could not run rather than certificate failure. This is meaningful behavioral context the annotation does not provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is information-dense and front-loads the core purpose, then adds null semantics and usage sequencing. The first sentence is a bit long with several em-dash interruptions, but every clause adds signal and there is no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With annotations declaring read-only behavior, an output schema present, and 100% parameter coverage, the description adds the remaining needed context: what the check sees, how to interpret nulls, and when to run it relative to ssh_audit_baseline. Nothing critical is missing for an agent to select and call this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the input schema already documents all five parameters. The tool description adds useful context around domains and null results, but it does not add new parameter-level meaning beyond what the schema provides, matching the baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Checks') and resource ('the TLS certificate a domain serves'), and enumerates the concrete outputs: days left, SAN match, issuer, renewal configuration. This clearly differentiates it from sibling SSH tools like ssh_exec or ssh_audit_baseline.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says to 'Run it per domain, once ssh_audit_baseline has named the sites,' giving a clear prerequisite and invocation pattern. It does not enumerate when not to use it or name alternatives, but the sequencing guidance is actionable and specific.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_uploadA
DestructiveIdempotent

Copies a local file or directory to a server, checked by sha256 on both sides and never left half-written at the target. A directory replaces the target whole — whatever was there and is not in the source is gone with it; merge: true keeps it instead. For text you can paste, ssh_file_write is cheaper; piping base64 through ssh_exec truncates silently.

NameRequiredDescriptionDefault
modeNoOctal, one value for every file sent. Omit to keep local permissions.
sudoNoFor /etc, /opt and the like, and for setting an owner. Data stages in /tmp first — the machine needs room for a second copy. Default: false
mergeNoDirectories only. true = what the target holds and the source does not stays — uploads, .env, logs; same-named files are taken from the source. The tree is still put in place whole, by one rename. mode and owner then cover the kept files too. Default: false
ownerNo"root:root", every file and directory sent. Needs sudo; without it the answer says it was not applied.
verifyNosha256 on both sides, per file. "unavailable" = no sha256 on the machine = delivered, not broken. "mismatched" fails the call and replaces nothing. Default: true
profileYesMachine name.
timeoutNoMilliseconds. No ceiling by default — a transfer runs as long as it takes.
overwriteNofalse = refuse rather than replace, including when the target cannot be checked. A directory is judged whole, not per file. Default: true
recursiveNoOnly to force it — a directory is recognised on its own.
local_pathYesA file or a directory on this machine.
remote_pathYesWhere it goes on the server. A sent directory becomes this path itself and replaces it whole, not file by file — with merge: true what the source lacks stays.

Output Schema

NameRequiredDescription
filesNo
legendNoWhat the words in this answer mean. A key names the field before the value — "state=limited", "jobs[].state=lost" — and only the values this answer actually used are listed.

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the idempotentHint and destructiveHint annotations, the description discloses the critical behavior: sha256 verification on both sides, atomic writes that are never half-left, and full replacement of the target directory unless merge:true is set. This is substantive behavioral detail, not just a restatement of annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each earning its place: the first states the action and key guarantees, the second clarifies the destructive directory behavior, and the third routes to an alternative. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the rich parameter schema, the output schema, and annotations, the description covers the essential operational invariants: atomicity, verification, destructive replacement, and the relevant alternative. Nothing needed to correctly invoke the tool is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already covers all 11 parameters richly, so the baseline is 3. The description adds cross-cutting meaning not obvious from individual parameters: the transfer is atomic, directories replace the target whole, and verification is built in. This is useful, but the per-parameter semantic burden is largely carried by the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Copies a local file or directory to a server.' It also distinguishes itself from siblings by noting that ssh_file_write is cheaper for pasteable text, making the tool's role clear against the other SSH tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly gives a decision rule: for text you can paste, use ssh_file_write instead, and warns that piping base64 through ssh_exec truncates silently. This tells an agent when not to use this tool and which sibling to prefer.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 12 tool updatesv2.3.3
    • Changedssh_audit_baseline4 fields changed
      • changedInput schema / properties / include_sudo_sections / description
        Previous value: -"Read sshd config as sshd sees it (sshd -T), needs root. Without it the ssh section says so instead of guessing from the file. Default: false"New value: +"Run the sections that need root as root: sshd -T for ssh, ufw and iptables rules for firewall. Without it those sections name what they could not read instead of guessing. Default: false"
      • addedOutput schema / properties / firewall / properties / iptables / properties / status / description
        Added value: +"not_installed — the tool is absent from the server, so it filters nothing here; no_access — the tool is there, but reading its rules needs root: what it allows is unknown; read — the rules were read, and the fields beside this one come from them."
      • addedOutput schema / properties / firewall / properties / ufw / properties / status / description
        Added value: +"not_installed — the tool is absent from the server, so it filters nothing here; no_access — the tool is there, but reading its rules needs root: what it allows is unknown; read — the rules were read, and the fields beside this one come from them."
      • addedOutput schema / properties / legend
        Added value: +{
        +  "additionalProperties": {
        +    "type": "string"
        +  },
        +  "description": "What the words in this answer mean. A key names the field before the value — \"state=limited\", \"jobs[].state=lost\" — and only the values this answer actually used are listed.",
        +  "type": "object"
        +}
    • Changedssh_download4 fields changed
      • changedInput schema / properties / verify / description
        Previous value: -"sha256 on both sides, per file. \"unavailable\" = no sha256 on the machine = delivered, not broken. Default: true"New value: +"sha256 on both sides, per file. \"unavailable\" = no sha256 on the machine = delivered, not broken. \"mismatched\" fails the call and replaces nothing. Default: true"
      • addedOutput schema / properties / files / items / properties / verified / description
        Added value: +"How the sha256 check ended, not whether the data landed — written says that. verified — sha256 was compared after the write and matched; mismatched — sha256 was compared and differed: nothing was replaced, and the path still holds what it held before; unavailable — the check had nothing to work with, and reason says what was missing; skipped — no comparison ran: none was asked for, or nothing landed to compare."
      • changedOutput schema / properties / files / items / properties / verified / enum
        Previous value: -[
        -  "verified",
        -  "unavailable",
        -  "skipped"
        -]New value: +[
        +  "verified",
        +  "mismatched",
        +  "unavailable",
        +  "skipped"
        +]
      • addedOutput schema / properties / files / items / properties / written / description
        Added value: +"Whether the data reached the path. Permissions and owner are a separate matter: one that did not apply is named in reason, and written stays true."
    • Changedssh_file_list1 field changed
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "properties": {
        +    "entries": {
        +      "items": {
        +        "properties": {
        +          "group": {
        +            "type": "string"
        +          },
        +          "mode": {
        +            "description": "Octal, as chmod takes it: \"644\", \"4755\" — not the rwx letters ls prints.",
        +            "type": "string"
        +          },
        +          "mtime": {
        +            "description": "Seconds since epoch, UTC.",
        +            "type": "number"
        +          },
        +          "name": {
        +            "description": "Name inside the listed directory; with recursive, the path below it. Never a full path, so it reads the same either way.",
        +            "type": "string"
        +          },
        +          "owner": {
        +            "type": "string"
        +          },
        +          "size": {
        +            "type": "number"
        +          },
        +          "target": {
        +            "type": [
        +              "string",
        +              "null"
        +            ]
        +          },
        +          "type": {
        +            "description": "What the entry is, which decides what size means for it. file — a regular file, and size is its bytes; dir — a directory: size is the directory entry itself, never the sum of what it holds; symlink — a symbolic link — target says where it points, and size is the length of that path; other — a socket, fifo or device node: there is no content to read here.",
        +            "enum": [
        +              "file",
        +              "dir",
        +              "symlink",
        +              "other"
        +            ],
        +            "type": "string"
        +          }
        +        },
        +        "type": "object"
        +      },
        +      "type": "array"
        +    },
        +    "legend": {
        +      "additionalProperties": {
        +        "type": "string"
        +      },
        +      "description": "What the words in this answer mean. A key names the field before the value — \"state=limited\", \"jobs[].state=lost\" — and only the values this answer actually used are listed.",
        +      "type": "object"
        +    },
        +    "path": {
        +      "type": "string"
        +    },
        +    "truncated": {
        +      "description": "The output limit cut the answer: the directory holds more than entries lists.",
        +      "type": "boolean"
        +    },
        +    "unreadable": {
        +      "description": "Directories nobody was allowed to enter. Their contents are missing from entries, and a list short by the one that mattered looks complete.",
        +      "items": {
        +        "type": "string"
        +      },
        +      "type": "array"
        +    }
        +  },
        +  "type": "object"
        +}
    • Changedssh_file_write4 fields changed
      • changedInput schema / properties / files / oneOf
        Previous value: -[
        -  {
        -    "properties": {
        -      "binary": {
        -        "description": "content is base64, decoded before writing. Default: false",
        -        "type": "boolean"
        -      },
        -      "content": {
        -        "description": "The whole new content, written byte for byte. Replaces the file, never extends it; no trailing newline is added.",
        -        "type": "string"
        -      },
        -      "mode": {
        -        "description": "Octal string, \"644\". Applied before the file takes its place.",
        -        "type": "string"
        -      },
        -      "path": {
        -        "description": "Where the file goes.",
        -        "type": "string"
        -      },
        -      "sudo": {
        -        "description": "Write as root — /etc and anywhere the profile user cannot write. Default: false",
        -        "type": "boolean"
        -      },
        -      "verify": {
        -        "description": "Compare sha256 before the file takes its place. Default: false",
        -        "type": "boolean"
        -      }
        -    },
        -    "required": [
        -      "path",
        -      "content"
        -    ],
        -    "type": "object"
        -  },
        -  {
        -    "items": {
        -      "properties": {
        -        "binary": {
        -          "description": "content is base64, decoded before writing. Default: false",
        -          "type": "boolean"
        -        },
        -        "content": {
        -          "description": "The whole new content, written byte for byte. Replaces the file, never extends it; no trailing newline is added.",
        -          "type": "string"
        -        },
        -        "mode": {
        -          "description": "Octal string, \"644\". Applied before the file takes its place.",
        -          "type": "string"
        -        },
        -        "path": {
        -          "description": "Where the file goes.",
        -          "type": "string"
        -        },
        -        "sudo": {
        -          "description": "Write as root — /etc and anywhere the profile user cannot write. Default: false",
        -          "type": "boolean"
        -        },
        -        "verify": {
        -          "description": "Compare sha256 before the file takes its place. Default: false",
        -          "type": "boolean"
        -        }
        -      },
        -      "required": [
        -        "path",
        -        "content"
        -      ],
        -      "type": "object"
        -    },
        -    "type": "array"
        -  }
        -]New value: +[
        +  {
        +    "properties": {
        +      "binary": {
        +        "description": "content is base64, decoded before writing. Default: false",
        +        "type": "boolean"
        +      },
        +      "content": {
        +        "description": "The whole new content, written byte for byte. Replaces the file, never extends it; no trailing newline is added.",
        +        "type": "string"
        +      },
        +      "mode": {
        +        "description": "Octal string, \"644\", for this file alone. Applied before the file takes its place.",
        +        "type": "string"
        +      },
        +      "owner": {
        +        "description": "\"root:root\", for this file alone. Set before the file takes its place. Needs sudo; without it the answer says it was not applied.",
        +        "type": "string"
        +      },
        +      "path": {
        +        "description": "Where the file goes.",
        +        "type": "string"
        +      },
        +      "sudo": {
        +        "description": "Write as root, for this file alone — /etc and anywhere the profile user cannot write. Default: false",
        +        "type": "boolean"
        +      },
        +      "verify": {
        +        "description": "Compare sha256 before the file takes its place. A mismatch fails the call and leaves the path as it was. Default: true",
        +        "type": "boolean"
        +      }
        +    },
        +    "required": [
        +      "path",
        +      "content"
        +    ],
        +    "type": "object"
        +  },
        +  {
        +    "items": {
        +      "properties": {
        +        "binary": {
        +          "description": "content is base64, decoded before writing. Default: false",
        +          "type": "boolean"
        +        },
        +        "content": {
        +          "description": "The whole new content, written byte for byte. Replaces the file, never extends it; no trailing newline is added.",
        +          "type": "string"
        +        },
        +        "mode": {
        +          "description": "Octal string, \"644\", for this file alone. Applied before the file takes its place.",
        +          "type": "string"
        +        },
        +        "owner": {
        +          "description": "\"root:root\", for this file alone. Set before the file takes its place. Needs sudo; without it the answer says it was not applied.",
        +          "type": "string"
        +        },
        +        "path": {
        +          "description": "Where the file goes.",
        +          "type": "string"
        +        },
        +        "sudo": {
        +          "description": "Write as root, for this file alone — /etc and anywhere the profile user cannot write. Default: false",
        +          "type": "boolean"
        +        },
        +        "verify": {
        +          "description": "Compare sha256 before the file takes its place. A mismatch fails the call and leaves the path as it was. Default: true",
        +          "type": "boolean"
        +        }
        +      },
        +      "required": [
        +        "path",
        +        "content"
        +      ],
        +      "type": "object"
        +    },
        +    "type": "array"
        +  }
        +]
      • addedOutput schema / properties / files / items / properties / verified / description
        Added value: +"How the sha256 check ended, not whether the data landed — written says that. verified — sha256 was compared after the write and matched; mismatched — sha256 was compared and differed: nothing was replaced, and the path still holds what it held before; unavailable — the check had nothing to work with, and reason says what was missing; skipped — no comparison ran: none was asked for, or nothing landed to compare."
      • changedOutput schema / properties / files / items / properties / verified / enum
        Previous value: -[
        -  "verified",
        -  "unavailable",
        -  "skipped"
        -]New value: +[
        +  "verified",
        +  "mismatched",
        +  "unavailable",
        +  "skipped"
        +]
      • addedOutput schema / properties / files / items / properties / written / description
        Added value: +"Whether the data reached the path. Permissions and owner are a separate matter: one that did not apply is named in reason, and written stays true."
    • Changedssh_job_kill2 fields changed
      • addedOutput schema / properties / outcome / description
        Added value: +"signalled — the signal reached the process group of the job; gone — the job had already ended, so there was nothing to stop; nopid — the job recorded no pid, so there was nothing to signal; missing — the server knows no job under this id; no-answer — the server did not answer the stop request, so the job state is unknown."
      • addedOutput schema / properties / signal / description
        Added value: +"What was actually sent, which is not always what was asked for."
    • Changedssh_job_list2 fields changed
      • addedOutput schema / properties / jobs / items / properties / started_at / description
        Added value: +"Seconds since the epoch; null — the server did not record it."
      • addedOutput schema / properties / jobs / items / properties / state / description
        Added value: +"running — started and still running: this is not the outcome, come back later; finished — the job ended and reported its exit code; lost — the job is gone and left no exit code behind; missing — the server knows no job under this id."
    • Changedssh_job_status2 fields changed
      • addedOutput schema / properties / jobs / items / properties / started_at / description
        Added value: +"Seconds since the epoch; null — the server did not record it."
      • addedOutput schema / properties / jobs / items / properties / state / description
        Added value: +"running — started and still running: this is not the outcome, come back later; finished — the job ended and reported its exit code; lost — the job is gone and left no exit code behind; missing — the server knows no job under this id."
    • Changedssh_log_search4 fields changed
      • addedInput schema / properties / container
        Added value: +{
        +  "description": "Read this container's output instead of a file: docker is asked where it writes, and the answer names the file it read. Whatever cannot be read this way — a driver that keeps no file, an engine that is not docker, a name nothing answers to — comes back said aloud, naming ssh_exec as the way through. The file belongs to root, so sudo: true. Give this or path, never both.",
        +  "type": "string"
        +}
      • changedInput schema / properties / since / description
        Previous value: -"Window: \"today\" | \"2026-08-19\" | \"2h\" | \"3d\", the day taken from the server. Skips files untouched in it (count reported), then keeps only lines dated inside — 2026-08-19, Aug 19, 19/Aug/2026. Undated file: searched whole and named. Under a day filters files, not lines."New value: +"Window: \"today\" | \"2026-08-19\" | \"2h\" | \"3d\", the day taken from the server. Skips files untouched in it (count reported). A window of a day or more then keeps only lines dated inside — 2026-08-19, Aug 19, 19/Aug/2026; a shorter one filters files and leaves their lines alone. Undated file: searched whole and named."
      • changedInput schema / required
        Previous value: -[
        -  "profile",
        -  "path",
        -  "query"
        -]New value: +[
        +  "profile",
        +  "query"
        +]
      • addedOutput schema / properties / source
        Added value: +{
        +  "description": "Named only when container was asked: the engine, the driver and the file the lines were read from.",
        +  "type": "string"
        +}
    • Changedssh_log_tail2 fields changed
      • addedInput schema / properties / container
        Added value: +{
        +  "description": "Read this container's output instead of a file: docker is asked where it writes, and the answer names the file it read. Whatever cannot be read this way — a driver that keeps no file, an engine that is not docker, a name nothing answers to — comes back said aloud, naming ssh_exec as the way through. The file belongs to root, so sudo: true. Give this or path, never both.",
        +  "type": "string"
        +}
      • changedInput schema / required
        Previous value: -[
        -  "profile",
        -  "path"
        -]New value: +[
        +  "profile"
        +]
    • Changedssh_monitor2 fields changed
      • changedInput schema / properties / action / description
        Previous value: -"Which of the five to do."New value: +"Which of the five to do. close and reload drop live connections; the other three only read."
      • addedOutput schema / properties / state / description
        Added value: +"ready — logged in, commands run; limited — logged in and commands run, but the shell is not POSIX; no-route — the server was never reached; rejected — the server was reached and refused the login. null — nothing was checked: only the test action reaches the server."
    • Changedssh_service_status2 fields changed
      • addedOutput schema / properties / legend
        Added value: +{
        +  "additionalProperties": {
        +    "type": "string"
        +  },
        +  "description": "What the words in this answer mean. A key names the field before the value — \"state=limited\", \"jobs[].state=lost\" — and only the values this answer actually used are listed.",
        +  "type": "object"
        +}
      • addedOutput schema / properties / outcome / description
        Added value: +"checked — systemd answered, and the fields below carry its measurement; no_systemd — there was nobody to ask on this server, so the service was not measured; no_unit — systemd knows no such unit, which is not the same as a unit that is stopped."
    • Changedssh_upload8 fields changed
      • addedInput schema / properties / merge
        Added value: +{
        +  "default": false,
        +  "description": "Directories only. true = what the target holds and the source does not stays — uploads, .env, logs; same-named files are taken from the source. The tree is still put in place whole, by one rename. mode and owner then cover the kept files too. Default: false",
        +  "type": "boolean"
        +}
      • changedInput schema / properties / owner / description
        Previous value: -"\"root:root\", every file sent. Needs sudo; without it the answer says it was not applied."New value: +"\"root:root\", every file and directory sent. Needs sudo; without it the answer says it was not applied."
      • changedInput schema / properties / remote_path / description
        Previous value: -"Where it goes on the server. A sent directory becomes this path itself and replaces it whole, not file by file."New value: +"Where it goes on the server. A sent directory becomes this path itself and replaces it whole, not file by file — with merge: true what the source lacks stays."
      • changedInput schema / properties / sudo / description
        Previous value: -"For /etc, /opt and the like. Data stages in /tmp first — the machine needs room for a second copy. Default: false"New value: +"For /etc, /opt and the like, and for setting an owner. Data stages in /tmp first — the machine needs room for a second copy. Default: false"
      • changedInput schema / properties / verify / description
        Previous value: -"sha256 on both sides, per file. \"unavailable\" = no sha256 on the machine = delivered, not broken. Default: true"New value: +"sha256 on both sides, per file. \"unavailable\" = no sha256 on the machine = delivered, not broken. \"mismatched\" fails the call and replaces nothing. Default: true"
      • addedOutput schema / properties / files / items / properties / verified / description
        Added value: +"How the sha256 check ended, not whether the data landed — written says that. verified — sha256 was compared after the write and matched; mismatched — sha256 was compared and differed: nothing was replaced, and the path still holds what it held before; unavailable — the check had nothing to work with, and reason says what was missing; skipped — no comparison ran: none was asked for, or nothing landed to compare."
      • changedOutput schema / properties / files / items / properties / verified / enum
        Previous value: -[
        -  "verified",
        -  "unavailable",
        -  "skipped"
        -]New value: +[
        +  "verified",
        +  "mismatched",
        +  "unavailable",
        +  "skipped"
        +]
      • addedOutput schema / properties / files / items / properties / written / description
        Added value: +"Whether the data reached the path. Permissions and owner are a separate matter: one that did not apply is named in reason, and written stays true."
  2. 9 tool updatesv2.3.0
    • Changedssh_download1 field changed
      • addedOutput schema / properties / legend / description
        Added value: +"What the words in this answer mean. A key names the field before the value — \"state=limited\", \"jobs[].state=lost\" — and only the values this answer actually used are listed."
    • Changedssh_exec2 fields changed
      • changedInput schema / properties / detach / description
        Previous value: -"Background job on the server: returns an id at once, outlives this call, timeout does not apply. Follow with ssh_job_status / ssh_job_output, stop with ssh_job_kill. One command, no sudo. Default: false"New value: +"Background job on the server: returns an id at once, outlives this call, timeout does not apply. Follow with ssh_job_status / ssh_job_output, stop with ssh_job_kill. One command. With sudo the job runs as root and every later call follows it as root, provided the profile has a password or sudo needs none. Default: false"
      • addedOutput schema / properties / legend / description
        Added value: +"What the words in this answer mean. A key names the field before the value — \"state=limited\", \"jobs[].state=lost\" — and only the values this answer actually used are listed."
    • Changedssh_file_write1 field changed
      • addedOutput schema / properties / legend / description
        Added value: +"What the words in this answer mean. A key names the field before the value — \"state=limited\", \"jobs[].state=lost\" — and only the values this answer actually used are listed."
    • Changedssh_job_kill2 fields changed
      • changedInput schema / properties / id / description
        Previous value: -"Job id returned by ssh_exec with detach: true"New value: +"Job id returned by ssh_exec with detach: true. A job started with sudo is reached as root from the id alone — nothing extra to pass."
      • addedOutput schema / properties / legend / description
        Added value: +"What the words in this answer mean. A key names the field before the value — \"state=limited\", \"jobs[].state=lost\" — and only the values this answer actually used are listed."
    • Changedssh_job_list1 field changed
      • addedOutput schema / properties / legend / description
        Added value: +"What the words in this answer mean. A key names the field before the value — \"state=limited\", \"jobs[].state=lost\" — and only the values this answer actually used are listed."
    • Changedssh_job_output1 field changed
      • changedInput schema / properties / id / description
        Previous value: -"Job id returned by ssh_exec with detach: true"New value: +"Job id returned by ssh_exec with detach: true. A job started with sudo is reached as root from the id alone — nothing extra to pass."
    • Changedssh_job_status2 fields changed
      • changedInput schema / properties / id / description
        Previous value: -"Job id returned by ssh_exec with detach: true"New value: +"Job id returned by ssh_exec with detach: true. A job started with sudo is reached as root from the id alone — nothing extra to pass."
      • addedOutput schema / properties / legend / description
        Added value: +"What the words in this answer mean. A key names the field before the value — \"state=limited\", \"jobs[].state=lost\" — and only the values this answer actually used are listed."
    • Changedssh_monitor1 field changed
      • addedOutput schema / properties / legend / description
        Added value: +"What the words in this answer mean. A key names the field before the value — \"state=limited\", \"jobs[].state=lost\" — and only the values this answer actually used are listed."
    • Changedssh_upload1 field changed
      • addedOutput schema / properties / legend / description
        Added value: +"What the words in this answer mean. A key names the field before the value — \"state=limited\", \"jobs[].state=lost\" — and only the values this answer actually used are listed."
  3. 18 tool updatesv1.0.0
    • First observedssh_audit_baseline
    • First observedssh_disk_breakdown
    • First observedssh_download
    • First observedssh_exec
    • First observedssh_file_list
    • First observedssh_file_read
    • First observedssh_file_write
    • First observedssh_job_kill
    • First observedssh_job_list
    • First observedssh_job_output
    • First observedssh_job_status
    • First observedssh_log_search
    • First observedssh_log_tail
    • First observedssh_monitor
    • First observedssh_service_status
    • First observedssh_snapshot
    • First observedssh_tls_check
    • First observedssh_upload

TDQS

A4.2/5.0

Scored across 18 tools

Disambiguation5/5

Each tool targets a distinct resource and action: file read/write/list/upload/download, job status/output/list/kill, log tail/search, and system snapshot/audit/disk/service checks are clearly separated. Cross-references such as ssh_file_read vs ssh_download and ssh_snapshot vs ssh_audit_baseline reinforce rather than blur the boundaries. ssh_exec is explicitly positioned as a last-resort generic tool, reducing overlap.

Naming Consistency4/5

All tools share the ssh_ prefix and snake_case, and most follow a domain_action pattern like ssh_file_read, ssh_job_status, and ssh_log_search. A few one-offs such as ssh_snapshot, ssh_monitor, ssh_upload, and ssh_audit_baseline break the otherwise predictable pattern, though they remain readable and recognizable.

Tool Count4/5

At 18 tools, the set is slightly above the typical 3-15 range, but it covers a broad SSH operations domain: execution, files, transfers, detached jobs, logs, monitoring, TLS, disk, and services. Each tool has a distinct role and none feels redundant, so the count is reasonable for the stated scope.

Completeness4/5

The tool surface covers the main workflows: command execution, file read/write/list/transfer, detached job lifecycle, log tailing/searching, and system/health inspection. Obvious gaps like a dedicated file delete or service start/stop are absent, but ssh_exec provides a universal fallback, so agents can work around those missing operations.

Maintenance

ActivitySlowing
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    C
    maintenance
    Enables AI assistants to securely execute remote SSH commands, perform file transfers, and monitor system status through a standardized interface. It features robust security controls including command whitelisting, blacklisting, and credential isolation to prevent unauthorized operations.
    10
    11 npm
    MIT
  • A
    license
    A
    quality
    A
    maintenance
    Enables AI assistants to manage remote servers via SSH with 43 specialized tools for command execution, file editing, directory operations, and background tasks across Linux, macOS, and Windows.
    46
    104 PyPI
    8
    GPL 3.0