SSH MCP Server
SSH MCP Server —— 面向 AI 智能体的远程服务器工具
它使用你机器上已有的 OpenSSH 客户端:你的密钥、你的 ~/.ssh/config、你的跳板主机、你的代理转发。无需捆绑任何东西,无需编译,没有原生绑定。
可与 Claude Code、Codex CLI、opencode、Gemini CLI、Qwen Code、Hermes 及其他 MCP 客户端配合使用。
安装 · 工具 · 设置 · 安全 · 路线图 · 文档 · 更新日志
30 秒完成安装
无需全局安装。npx 会在首次使用时下载该包:
npx -y @hypnosis/ssh-mcp-server为每个项目将其添加到 Claude Code:
claude mcp add ssh -s user \
-e SSH_PROFILES_FILE="$HOME/.claude/ssh-profiles.json" \
-- npx -y @hypnosis/ssh-mcp-server然后创建 ~/.claude/ssh-profiles.json,至少包含一台机器:
{
"profiles": {
"production": {
"host": "server.example.com",
"username": "admin",
"privateKeyPath": "~/.ssh/your_private_key"
}
}
}这样就已经足够建立连接了。
Codex、opencode、Qwen Code 及其他客户端的配置方法见设置 SSH MCP server。
环境要求
Node.js 18+,并且系统 ssh 客户端位于 PATH 中。在 Windows 上,请使用基于密钥的配置文件;目前不支持密码和口令配置文件。
如果你更想要固定版本、离线使用,或希望每次启动少一次注册表检查:请运行 npm install -g @hypnosis/ssh-mcp-server,然后在命令中使用 ssh-mcp-server,而不是 npx。
Related MCP server: cygnus-ssh-mcp
适用人群
希望更快完成审计、故障检查和日常服务器维护的 DevOps 和 SRE。
借助 AI 助手交付产品、并把自己构建的东西运行在自己服务器上的 Vibe 编码者和独立开发者。
希望使用结构化工具,而不是不受限制的原始 shell 的 系统管理员和平台工程师。
没有专职运维团队、自己运营 VPS 的 开发者和小型团队。
Homelab、NAS 和路由器用户——手头那些仍然好用的硬件,已经跟不上现代协议了。
为什么选择 SSH MCP server,而不是原始 shell
更少的 token,更低的 AI 成本
原始 shell 给 AI 智能体的是一个信息洪流:重复的命令、ASCII 表格和日志转储。要把这些噪音转化为服务器的全貌,需要烧掉大量 token——花的是你的钱。
更快的服务器调试
专用工具可以批量执行常规检查、限制嘈杂的输出,并只返回关键部分。智能体花在解读终端输出上的时间更少,也就能更快地找到修复方案。
更少的猜测,更少的 AI 错误
结构化答案会说明发现了什么、哪些内容无法测量、哪些内容被截断。这让智能体几乎没有空间用幻觉来填补空白——也意味着更少的错误修复、更平稳的部署和更可靠的代码。
SSH 兼容性:现代服务器、老旧设备和 Windows
使用你现有的 OpenSSH 配置
不捆绑任何 SSH 实现,没有原生绑定,无需针对每个平台重新构建。命令通过系统 ssh 客户端执行,因此你的密钥、你的 ~/.ssh/config、你的跳板主机和你的代理转发都会像在终端中一样正常工作。在支持的情况下,每个目标共享一条多路复用连接,意味着你只需认证一次,而不是每条命令认证一次。
对老旧服务器、路由器和 NAS 设备的 SSH 支持
用现代的 scp 向路由器发送文件,你会得到这样的结果:
scp app.conf router:/etc/
# scp: subsystem request failed on channel 0其实什么也没有坏——当前的 scp 使用的是新协议,而路由器并不认识。在终端里,你只能去翻论坛帖子,然后带着一个额外的 flag 回来。在这里你什么都不用做:先尝试传输,识别到拒绝后改用旧协议,同时记住这台机器,下次传文件就直接走旧协议。
针对更老的 SSH 客户端和缺失工具的降级方案
老旧设备得到的是降级方案,而不是死胡同。当某个现代功能缺失时,服务器会尽可能走老路:
你的机器 | 你会得到什么 |
一台性能不足以支持现代文件传输的路由器或 NAS | 文件仍然能送达——会自动使用旧协议 |
一台十年前的服务器 | 工作流仍然有效;只是每条命令都会新建连接,而不是复用连接 |
一个精简到无法对文件做哈希的镜像 | 上传会提示“无法验证”,而不是声称已匹配而实际上没人核对过 |
一台根本没有安装某个工具的机器 | 答案会显示“未测量”——绝不会出现一个被读作“什么都没有”的零 |
为 Model Context Protocol 而生
基于官方 MCP SDK 构建,全程使用 TypeScript,拥有 2500+ 单元测试,外加一套针对真实容器而非 mock 运行的实时测试套件。
原始 SSH 对比 SSH MCP server:同一项工作,两种做法
SSH 服务器健康检查
场景: 刚刚上线了一次部署。服务器感觉变慢了,而你不知道该归咎于磁盘、内存、服务、容器还是错误。
问题: “这台机器健康吗?”
原始 SSH
$ uptime
10:42:17 up 18 days, 3:21, 2 users, load average: 0.42, 0.31, 0.28
$ df -hT
Filesystem Type Size Used Avail Use% Mounted on
/dev/sda1 ext4 40G 35G 5.0G 87% /
overlay overlay 40G 35G 5.0G 87% /var/lib/docker/overlay2/...
$ free -h
total used free shared buff/cache available
Mem: 7.7Gi 4.9Gi 612Mi 121Mi 2.2Gi 2.5Gi
$ systemctl --failed
UNIT LOAD ACTIVE SUB DESCRIPTION
● api-worker.service loaded failed failed API background worker
$ docker ps -a
CONTAINER ID IMAGE STATUS PORTS
8e14d0b41c2a api:latest Up 3 minutes 0.0.0.0:8080->8080/tcp
65b894af2430 worker:latest Exited (1) 2 minutes ago
$ ss -tulpn
Netid State Local Address:Port Process
tcp LISTEN 0.0.0.0:22 users:(("sshd",pid=842,fd=3))
tcp LISTEN 0.0.0.0:8080 users:(("docker-proxy",pid=1942,fd=4))
$ journalctl -p err --since -1h | tail -50
Aug 20 10:39:14 prod api-worker[22104]: database connection timed out
Aug 20 10:39:14 prod systemd[1]: api-worker.service: Failed with result 'exit-code'.这仍然只是一个删减过的结果。完整的检查还需要更多命令来查看 CPU、服务状态、容器数量和最近错误,每条命令都有自己的输出格式。更糟的是,一台没有 ss 的机器,在端口检查从未运行的情况下,看起来可能像是没有任何端口在监听。
结构化 MCP 结果
ssh_snapshot({ "profile": "production" }){
"disk_pct": 87,
"mem_pct": 64,
"cpu_pct": 12,
"load": "0.42 0.31 0.28",
"containers": 7,
"ports": 14,
"services_running": 3,
"recent_errors": 21,
"unavailable": []
}智能体从中获得什么
原始 SSH | 结构化 MCP | 你的收益 |
多条命令和 ASCII 表格 | 一次结果中的命名字段 | 一次调用、命名字段、更少的往返 |
缺失的工具可能看起来像空输出 |
| 更少的猜测和更少的错误修复 |
由你自行梳理磁盘、服务和错误 | 问题信号已经被呈现出来 | 更快的调试 |
完整的 ssh_audit_baseline 结果可能比几条原始命令的输出还要长——在我们的实验室测量中约为 1,077 个 token,而原始命令输出为 765 个。节省来自完整的工作流,而不是来自让某一次响应变得更短。
在一次真实的故障排查会话中,专用工具把 49 次独立的命令调用减少到了 4 次 MCP 调用。每多一次调用,模型都要在已累积的对话之上再开启一个新回合。提示缓存可以降低重复输入的成本,但新命令及其输出仍然会消耗上下文。更少的往返意味着整个会话中更少的 token、更少的重复分析,以及一条通向答案的更快路径。
需要的是完整画面,而不仅仅是脉搏? ssh_audit_baseline 会批量检查系统、磁盘、内存、端口、sshd、失败的单元、Docker、防火墙和更新。结果以 CRITICAL / WARNING / OK 呈现;未测量的部分会被明确指出,而不是被静默地当作零。
Linux 服务器日志搜索
场景: API 正在超时,但同样的消息可能出现在 nginx、syslog、journald 或某个你用普通用户无法读取的应用程序日志中。
问题: “这个错误是从哪里来的?”
原始 SSH
$ grep -i "timeout" /var/log/nginx/error.log
2026/08/20 10:38:54 [error] upstream timed out while reading response header
$ grep -i "timeout" /var/log/syslog
Aug 20 10:39:14 prod api-worker[22104]: database connection timed out
$ grep -i "timeout" /var/log/app/*.log 2>/dev/null
$ journalctl -u api --since "1 hour ago" | grep -i timeout
Aug 20 10:39:14 prod api[22104]: database connection timed out after 30000ms第三条命令看起来没问题,但 2>/dev/null 也把权限错误隐藏了起来。“没有匹配”和“什么都没读到”现在看起来一模一样。繁忙的日志还可能返回数千行,把事故的其余内容挤出智能体的上下文。
结构化 MCP 结果
ssh_log_search({ "profile": "production",
"path": ["/var/log/nginx/error.log", "/var/log/syslog", "/var/log/app/*.log"],
"query": "timeout", "context": 2, "since": "1h" }){
"matches": 34,
"lines": [
{ "file": "/var/log/nginx/error.log", "line": 4821,
"text": "upstream timed out while reading response header", "context": false },
{ "file": "/var/log/nginx/error.log", "line": 4822,
"text": "client closed connection", "context": true }
],
"files_searched": 6,
"files_unreadable": ["/var/log/app/private"],
"files_skipped": 12,
"files_undated": [],
"limited": false,
"truncated": false
}智能体从中获得什么
原始 SSH | 结构化 MCP | 你的收益 |
四次搜索和四个输出 | 跨文件和 glob 的一次搜索 | 更少的 token 和往返 |
权限错误可能悄然消失 |
| 不会错误地得出“日志是干净的”结论 |
输出可以无限增长,没有有用的上限 |
| 基于部分结果做出更安全的决策 |
since 使用服务器的时钟,namesOnly: true 只返回匹配的路径,而 ssh_log_tail 一次调用即可读取多个日志的最后 N 行。
安全的远程配置编辑
场景: 你需要在生产服务器上替换一份 nginx 配置。连接断开、模式错误或未经校验的复制,都可能让服务留下一个损坏的文件。
问题: “我能否替换这份配置,而不会留下一个只写了一半的文件?”
原始 SSH
$ sudo sh -c 'cat > /etc/nginx/conf.d/api.conf' <<'EOF'
server {
listen 80;
location / { proxy_pass http://127.0.0.1:8080; }
}
EOF
$ echo $?
0退出码为零只能说明 shell 执行完了。它并不能证明哪些字节真正写入,而且 > 会在新文件的第一个字节到达之前就截断旧文件。如果连接在写入中途断开,服务就会留下一个不完整的配置。
结构化 MCP 结果
ssh_file_write({ "profile": "production",
"files": [{ "path": "/etc/nginx/conf.d/api.conf",
"content": "server {\n listen 80;\n location / { proxy_pass http://127.0.0.1:8080; }\n}\n",
"mode": "644", "sudo": true, "verify": true }] }){
"files": [{ "path": "/etc/nginx/conf.d/api.conf", "written": true,
"verified": "verified", "reason": null, "bytes": 79 }]
}智能体从中获得什么
原始 SSH | 结构化 MCP | 你的收益 |
目标在复制完成前被截断 | 完整的临时文件通过一次重命名替换它 | 不会出现写了一半的配置 |
只有退出码 | 字节数和校验结果都有明确的命名 | 你知道实际落盘了什么 |
权限藏在 shell 文本里 |
| 所有权可预测,引号错误更少 |
verified 有三种诚实的结局:verified、当服务器没有哈希工具时的 unavailable,以及未请求校验时的 skipped。对于读取,ssh_file_read 接受路径列表;ssh_file_list 处理通配符、递归、大小和模式。
使用 sudo 运行批量 SSH 命令
场景: 部署已就绪,但在流量切换前必须检查 nginx 语法、服务状态和最近的错误。任何一项检查失败都不应消失在合并的输出中。
问题: “每一项预检都通过了吗?”
原始 SSH
$ ssh admin@server.example.com 'sudo nginx -t'
nginx: configuration file /etc/nginx/nginx.conf test is successful
$ ssh admin@server.example.com 'sudo systemctl is-active nginx'
active
$ ssh admin@server.example.com 'sudo tail -5 /var/log/nginx/error.log'
2026/08/20 10:38:54 [error] upstream timed out while reading response header三次连接返回三个互不相关的输出。如果用 ; 连接命令,shell 只报告最后一个退出码;如果用 && 连接,第一次失败后后面的检查就消失了。
结构化 MCP 结果
ssh_exec({ "profile": "production",
"command": ["nginx -t", "systemctl is-active nginx",
"tail -5 /var/log/nginx/error.log"],
"sudo": true }){
"commands": [
{ "command": "nginx -t", "exit_code": 0, "truncated": false, "clipped_bytes": 0,
"stdout": "", "stderr": "nginx: configuration file /etc/nginx/nginx.conf test is successful\n" },
{ "command": "systemctl is-active nginx", "exit_code": 0, "truncated": false,
"clipped_bytes": 0, "stdout": "active\n", "stderr": "" },
{ "command": "tail -5 /var/log/nginx/error.log", "exit_code": 0, "truncated": false,
"clipped_bytes": 0, "stdout": "2026/08/21 09:14:02 [error] upstream timed out\n", "stderr": "" }
],
"job_id": null
}代理获得什么
原始 SSH | 结构化 MCP | 你的收益 |
三次调用和互不相关的输出 | 一个有序的命令列表 | 更少的往返次数 |
合并的 shell 可能隐藏中间状态 | 每条命令保留自己的 | 不会漏掉失败的检查 |
|
| 更少的引号错误 |
破坏性命令防护在第一条命令运行前检查完整列表。如果有一条被拒绝,其他所有条目都被标记为未运行,且不会向服务器发送任何内容。
每条命令携带自己的 stdout 和 stderr。运行过但未输出任何内容的命令有空的字符串;从未运行的命令则完全没有该字段,因此两者不会混淆。每条命令超过 128 KB 的输出会保留两端——头部用于表格,尾部用于日志——中间有接缝标明数量,clipped_bytes 说明被裁剪了多少。裁剪发生在字节边界上,并回退到字符边缘,因此被裁剪的答案永远不会带有替换标记。
sudo 在没有终端的情况下到达服务器:当配置文件有密码时,密码通过标准输入交给 sudo。通过密钥认证的配置文件没有密码可提供,因此那里的 sudo 只在已经免密的情况下有效——而且读取自身标准输入的命令永远不会被给予密码,否则密码会混入数据中。
运行长时间运行的 SSH 任务
场景: 备份或迁移的运行时间将超过代理会话。连接可能会关闭,但你之后仍然需要它的状态、输出和退出码。
问题: “这个任务能撑过对话吗?”
原始 SSH
$ ssh admin@server.example.com 'pg_dump app | gzip > /srv/backups/app.sql.gz'
client_loop: send disconnect: Broken pipe终端没了。你现在必须重新连接、找到进程、检查目标文件,然后猜测备份是完成了还是中途停止了。
结构化 MCP 结果
ssh_exec({ "profile": "production",
"command": "pg_dump app | gzip > /srv/backups/app.sql.gz",
"detach": true }){
"commands": [{
"command": "pg_dump app | gzip > /srv/backups/app.sql.gz",
"exit_code": null,
"truncated": false,
"timed_out": false,
"blocked": false,
"blocked_reason": null,
"not_run": false,
"warning": null
}],
"job_id": "mst0f2q1-9ab3c4d5"
}代理获得什么
原始 SSH | 结构化 MCP | 你的收益 |
任务绑定在一个 SSH 会话上 | 远程任务有持久的 id | 安全断开和重启 |
重新连接意味着搜索进程和文件 | 状态和退出码有明确的命名状态 | 不用猜测是否完成 |
再次读取输出会重复旧文本 | 输出从字节偏移处继续 | 长任务上更少的 token 消耗 |
任务状态存储在远程磁盘上,而不是这个服务器的内存中。ssh_job_status 区分 running、finished 和 lost;ssh_job_output 从最后的字节偏移处继续;ssh_job_kill 向整个进程组发送信号,而不仅仅是它的 shell。
向旧式路由器和 NAS 设备传输文件
场景: 当前的 OpenSSH 客户端尝试 SFTP,但路由器或 NAS 只理解经典的 scp 协议。文件仍然必须完整到达并安全地替换其目标。
问题: “这台旧设备还能接收经过校验的文件吗?”
原始 SSH
$ scp app.conf operator@router:/etc/app.conf
subsystem request failed on channel 0
scp: Connection closed通常的下一步是记起旧式标志、重试复制,然后运行一个单独的哈希命令——如果设备有哈希工具的话。
结构化 MCP 结果
ssh_upload({ "profile": "router", "local_path": "./app.conf",
"remote_path": "/etc/app.conf", "sudo": true,
"mode": "644", "owner": "root:root", "verify": true }){
"files": [{
"path": "/etc/app.conf",
"written": true,
"verified": "verified",
"reason": null,
"bytes": 1284
}]
}代理获得什么
原始 SSH | 结构化 MCP | 你的收益 |
现代 SFTP 模式在第一个错误处停止 | 经典 scp 回退是自动的且被记住 | 旧设备仍然可用 |
成功的复制不能证明完整性 | SHA-256 校验有明确的命名结果 | 损坏不会被误认为成功 |
直接替换可能留下部分目标 | 临时文件在传输完成后被移入到位 | 工作文件在中断中幸存 |
如果设备既没有 sha256sum 也没有 openssl,结果会显示 unavailable 并说明原因,而不是报告虚假的匹配。整个目录使用 recursive: true 并一次性批量校验其哈希。
面向 AI 代理的破坏性命令保护
防护在本地运行,在命令到达 SSH 之前。它区分可以恢复的操作和破坏承载数据的容器的操作,并检查链和批次内的命令顺序。
在破坏性链开始前阻止它
一个安全的备份-替换序列:
cp -r /srv/app /srv/app.bak && mv /srv/app /srv/app-old && rm -rf /srv/app顺序错误的相同操作:
rm -rf /srv/app && cp -r /srv/app /srv/app.bak && mv /srv/app /srv/app-old
# REFUSED before the first command runsshell 会删除目录,然后才发现备份源已经没了。防护看到后面的步骤读取了已被前面步骤破坏的目标,因此整个调用留在你的机器上。同样的检查也能捕获
dropdb app && pg_dump app > backup.sql。
拒绝不可逆的丢失,警告可恢复的更改
拒绝——容器本身 | 仅警告——其内容 |
|
|
|
|
| 编辑单个任务 |
|
|
|
|
docker compose down -v 被拒绝,因为 -v 会移除命名的 Docker 卷,包括数据库卷。没有 -v 时,停止服务不会被当作同样的不可逆操作。
递归删除文件系统根目录、主目录或 /etc、/var 和 /usr 等系统树也会被拒绝,包括符号链接指向这些位置的情况。未解析的目标如 rm -rf "$DIR"/* 也会被拒绝:“无法检查”不会被当作“安全”。
确认有意的破坏性命令
没有什么是永久禁止的。在已审查的命令中添加 # CONFIRMED-DESTRUCTIVE 即可放行。当防护拒绝批次中的一条时,整个批次在执行前停止,因此服务器永远不会处于半运行操作之后的状态。
防护在单次调用内工作。它无法将一次调用中的删除与下一次调用中的读取联系起来,也无法推理它不认识的工具。它是安全带,不是策略引擎:可恢复的操作仍然由你决定。路径限制和引号规则记录在 docs/security.md 中。
用于服务器操作的 SSH MCP 工具
18 个工具。完整参数和示例见 docs/tools.md。
MCP 工具安全注解
标准 MCP 注解告诉客户端哪些工具是只读的、破坏性的、幂等的或开放世界的。参见完整表格。
运行 SSH 命令并管理远程文件
工具 | 功能 |
| 运行一条命令或一个批次,带破坏性命令防护和可选的分离执行 |
| 读取一个或多个文件,文本或二进制 |
| 以原子重命名和可选的 SHA-256 校验写入文件 |
| 列出目录,支持可选的通配符和递归 |
监控长时间运行的 SSH 任务
工具 | 功能 |
| 后台任务的状态:运行中、已完成或丢失 |
| 从字节偏移处读取累积输出 |
| 列出任务,清理超过 TTL 的已完成任务 |
| 向任务的整个进程组发送信号 |
搜索日志并检查服务器健康
工具 | 功能 |
| 一个或多个日志的最后 N 行,支持通配符 |
| 跨日志进行模式搜索 |
| 一次性健康快照:服务、资源、Docker、网络、错误 |
| 传输控制:统计、重载、测试、列表、关闭 |
通过 SSH 上传和下载文件
带完整性检查的二进制安全传输。详情见 docs/transfer.md。
工具 | 功能 |
| 上传文件或目录 |
| 下载文件或目录 |
对于二进制和大文件,请使用
ssh_upload/ssh_download—— base64 块和 heredoc 不是二进制安全的,也不是原子的。
通过 SSH 审计 Linux 服务器
只读并批量化为一次往返。详情见 docs/audit.md。
工具 | 功能 |
| 系统、磁盘、内存、网络、ssh、服务、Docker、防火墙、更新 |
| 域名的证书过期、SAN、链和续期钩子 |
| 磁盘去哪了: |
|
|
Windows SSH 兼容模式
Windows 会自动使用兼容模式。当连接多路复用不可用时,服务器会切换为每条命令一个连接。基于密钥的 SSH 仍可使用相同的工具——无需单独设置,也没有 Windows 特有的实现。
破坏性命令防护参见面向 AI 代理的破坏性命令保护。
设置 SSH MCP 服务器
先运行30 秒内安装中的包,然后创建配置文件。
创建 SSH 连接配置文件
把它放在你喜欢的位置——通常放在代理自己的配置旁边。下面的示例使用 ~/.claude/ssh-profiles.json;对于其他代理,替换目录即可(~/.codex/、~/.qwen/、~/.config/opencode/):
{
"profiles": {
"production": {
"host": "server.example.com",
"username": "admin",
"port": 22,
"privateKeyPath": "~/.ssh/your_private_key"
}
}
}显式选择 SSH 配置文件
服务器没有可回退的默认配置文件:每个配置文件都对应一台不同的机器,而发错机器的命令不是事后一条错误消息就能撤销的。不带名称询问时,返回结果会列出可供选择的名称:
ssh_exec({ command: "uptime" })
→ No profile specified. Name one explicitly: production服务器无法用于 SSH 的配置文件——没有 host、没有 username,或 mode: "local"——会被静默跳过,无法识别的字段会被原样保留,因此该文件可以与其他工具共享。带有损坏字段的配置文件则是另一种情况:它会连同字段和值一起被点名,而其他正常的配置文件继续正常工作。
每个配置文件可选地包含一个 pathSecurity 块,用于将文件工具可能访问的路径加入白名单或黑名单——参见 docs/security.md。
将 SSH 密码和口令移出配置文件
优先使用密钥。如果密码或加密密钥口令不可避免,请将其放在单独的 secrets 文件中,绝不能放在配置文件本身:
{
"secretsFile": "~/.config/ssh-mcp/secrets.json",
"profiles": {
"production": {
"host": "server.example.com",
"username": "admin"
}
}
}secrets 文件以配置文件名为键——参见 secrets.json.example:
{
"production": { "password": "..." }
}secrets 文件必须只有你本人可读(chmod 600)。相对路径相对于配置文件解析;secrets 不会出现在 argv 中,并且会在日志中被遮蔽。参见凭据安全。
配置 Claude Code、Codex 和其他 MCP 客户端
选择你使用的客户端,并将其指向同一个配置文件。
Claude Code
一条命令;-s user 让服务器在每个项目中都可用:
claude mcp add ssh -s user \
-e SSH_PROFILES_FILE="$HOME/.claude/ssh-profiles.json" \
-- npx -y @hypnosis/ssh-mcp-serverCodex CLI
codex mcp add ssh \
--env SSH_PROFILES_FILE="$HOME/.codex/ssh-profiles.json" \
-- npx -y @hypnosis/ssh-mcp-serveropencode
将其放入 ~/.config/opencode/opencode.json:
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"ssh": {
"type": "local",
"command": ["npx", "-y", "@hypnosis/ssh-mcp-server"],
"enabled": true,
"environment": {
"SSH_PROFILES_FILE": "~/.config/opencode/ssh-profiles.json"
}
}
}
}Qwen Code
一条命令,与其他相同:
qwen mcp add ssh \
-e SSH_PROFILES_FILE="$HOME/.qwen/ssh-profiles.json" \
npx -y @hypnosis/ssh-mcp-server其他 MCP 客户端
Gemini CLI、Hermes、Cline、编辑器插件或你自己的代理都以相同方式工作。它们只需要一个要运行的命令和一个环境变量。
重启你的 MCP 客户端
重启客户端,然后运行 ssh_monitor({ action: "list" }) 以确认配置文件已加载。
SSH MCP 服务器配置
变量 | 作用 | 默认值 |
| 配置文件 JSON 的路径——必填 | — |
|
|
|
| 回退项,仅在 |
|
| 日志行中的时间戳 |
|
| 共享连接在最后一条命令后保持存活的秒数; |
|
| 控制套接字存放位置 |
|
| 配置文件缓存 TTL(毫秒) |
|
| 配置文件更改时重新加载 |
|
共享连接刻意比本进程存活得更久:退出时关闭它会切断同一台机器上另一个窗口正在使用的通道。
SSH MCP 服务器限制
取消: 关闭 SSH 可能会让远程命令继续运行。当控制很重要时,请使用分离任务。
原子写入: BSD 和 macOS 无法预先检查跨文件系统的重命名。
SSH MCP 服务器路线图
针对 macOS SSH 主机进行完整测试运行
在 Windows 上进行端到端兼容性测试
多主机审计——在一次调用中比较多个 SSH 配置文件的健康状态
从现有的
~/.ssh/config导入配置文件针对大文件和不稳定连接的可恢复传输
远程操作时间线——命令、传输和防护决策汇聚在一条审计轨迹中
现成的 SSH 故障排查手册
到达模型的回答—— 已完成: 命令输出、匹配的日志行、机器名称和快照部分在字段中传递,而不仅仅是文本更小的 MCP 工具模式—— 已完成: 工具列表轻了 10%,分离任务现在会显示它写入的最后几行,而不是被盲目轮询
开发和测试 SSH MCP 服务器
npm install
npm run build # tsc
npx tsc --noEmit # types, plus dead declarations
npm run test:unit # unit tests
npm run lab:up # start the two test containers
npm run test:live # live suite against those containers实时测试套件针对真实容器运行——一个 BusyBox,一个 coreutils——因为两者会在细微之处产生分歧,而模拟对象只会附和编写它的人。布局参见 docs/architecture.md。
喜欢 SSH MCP Server 吗?⭐
如果你喜欢这个工具,在 GitHub 上给它点个星标——这能帮助更多人发现这个项目。
为 SSH MCP 服务器做贡献
欢迎在 github.com/hypnosis/ssh-mcp-server 提交 Issue 和拉取请求。
许可证
MIT——参见 LICENSE。
Available Tools
18 toolsssh_audit_baselineARead-only
Reports how a machine is set up: sshd, firewall, pending updates, failed services, docker, listening ports and disk, each section marked CRITICAL, WARNING or OK. Reads only, in one round trip instead of a dozen commands. For load and health at this moment rather than settings, use ssh_snapshot.
| Name | Required | Description | Default |
|---|---|---|---|
| compact | No | Trim the long sections. false = whole, much larger answer. Default: true | |
| include | No | system, disk, mem, net, ssh, services, docker, firewall, updates. Default: all | |
| profile | Yes | Machine name. | |
| include_sudo_sections | No | Run the sections that need root as root: sshd -T for ssh, ufw and iptables rules for firewall. Without it those sections name what they could not read instead of guessing. Default: false |
Output Schema
| Name | Required | Description |
|---|---|---|
| os | No | |
| net | No | |
| ssh | No | |
| disk | No | |
| load | No | |
| docker | No | |
| kernel | No | |
| legend | No | What the words in this answer mean. A key names the field before the value — "state=limited", "jobs[].state=lost" — and only the values this answer actually used are listed. |
| memory | No | |
| uptime | No | |
| updates | No | |
| date_utc | No | |
| firewall | No | |
| hostname | No | |
| services | No | |
| red_flags | No | |
| unavailable | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotation already declares readOnlyHint=true, and the description reinforces this with 'Reads only'. It adds useful behavioral context beyond the annotation by stating that sections are marked CRITICAL/WARNING/OK and that it replaces 'a dozen commands' in one round trip. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences with no filler: the first defines purpose and output shape, the second states safety and efficiency, and the third routes to the sibling tool. The most important scoping information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only audit tool, the description covers what it reports, how the output is categorized, why it is efficient, and which sibling to use in the alternate use case. Combined with full parameter documentation and an output schema, nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with every parameter documented including defaults and allowed values. The tool description contributes high-level context but does not need to compensate for missing parameter docs, so the baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Reports how a machine is set up', then enumerates exact domains (sshd, firewall, updates, services, docker, ports, disk) and the severity marking scheme. It also distinguishes itself from ssh_snapshot, so an agent can tell it apart from the closest sibling.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit routing guidance: 'For load and health at this moment rather than settings, use ssh_snapshot.' It also frames the tool as a one-round-trip setup audit, making the intended use case clear without ambiguity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_disk_breakdownARead-only
Finds what filled a disk: free space per filesystem, the largest directories under each path given, and what docker, journald and package caches hold. Reads only, nothing is deleted. For how full the disks are at all, ssh_snapshot answers in one line.
| Name | Required | Description | Default |
|---|---|---|---|
| sudo | No | Read as root. Straight away for places a plain user cannot read (/root, /var/lib/docker); otherwise retry with true when the answer names what it could not read. Default: false The cache section then reads root's home, not the profile user's. | |
| paths | No | Where to look. Naming the suspect beats walking the whole filesystem. Default: ["/"] | |
| top_n | No | Largest directories named per path. Default: 20 | |
| profile | Yes | Machine name. |
Output Schema
| Name | Required | Description |
|---|---|---|
| cache | No | |
| docker | No | |
| largest | No | |
| var_log | No | |
| journald | No | |
| unreadable | No | Not looked into: the sizes above leave these out |
| filesystems | No | |
| unavailable | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, and the description reinforces this with 'Reads only, nothing is deleted.' It adds useful context about what areas are inspected (docker, journald, package caches) without contradicting the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences. The first explains scope and read-only behavior, and the second routes to the alternative for a different need. There is no filler or repeated schema content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With a rich input schema, an output schema, and a readOnlyHint annotation, the description covers what an agent needs: what it inspects, that it is safe, and how it relates to ssh_snapshot. No critical behavioral or selection information is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description does not add parameter-specific meaning beyond the schema, but it does relate the tool's purpose to the 'paths' concept. It neither improves nor harms parameter understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb-resource pair ('Finds what filled a disk') and enumerates the concrete outputs: free space per filesystem, largest directories per path, and cache contents. It also differentiates itself from ssh_snapshot by framing this as the detailed breakdown versus the one-line fullness answer.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a clear alternative and selection rule: use ssh_snapshot when only overall disk fullness is needed, and this tool when a breakdown is required. It could be slightly more explicit about when not to use the tool, but the guidance is strong enough for an agent to make the right choice.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_downloadADestructiveIdempotent
Copies a file or directory from a server to this machine, checked by sha256 on both sides. To read a text file rather than keep it, ssh_file_read skips the disk.
| Name | Required | Description | Default |
|---|---|---|---|
| sudo | No | For /root and the like. A root copy stages in /tmp, is fetched and removed — the machine needs room. Default: false | |
| verify | No | sha256 on both sides, per file. "unavailable" = no sha256 on the machine = delivered, not broken. "mismatched" fails the call and replaces nothing. Default: true | |
| profile | Yes | Machine name. | |
| timeout | No | Milliseconds. No ceiling by default — a transfer runs as long as it takes. | |
| recursive | No | Only to force it — a directory is recognised on its own. | |
| local_path | Yes | Where it lands on this machine. | |
| remote_path | Yes | What to fetch from the server. |
Output Schema
| Name | Required | Description |
|---|---|---|
| files | No | |
| legend | No | What the words in this answer mean. A key names the field before the value — "state=limited", "jobs[].state=lost" — and only the values this answer actually used are listed. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide idempotentHint and destructiveHint, and the description adds meaningful behavioral detail: 'checked by sha256 on both sides.' This goes beyond the annotations by explaining the verification mechanism. It does not explicitly state that an existing local_path may be overwritten, but the destructiveHint annotation covers the general risk, and the schema's verify parameter adds mismatch semantics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences with no redundant wording. The core action and verification detail are front-loaded, and the sibling alternative follows in a clearly conditional form. Every sentence contributes useful information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the rich input schema, output schema, and annotations, the description is complete enough for an agent to know what the tool does, when to use it, and when not to. It covers direction, verification, and the key sibling alternative, with no missing information necessary for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all seven parameters in detail. The description adds no parameter-level meaning beyond the schema; it only restates the overall transfer and verification behavior. A baseline of 3 is appropriate since the schema carries the semantic weight.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action and resource: 'Copies a file or directory from a server to this machine.' This clearly identifies the tool's direction and purpose. It also differentiates from ssh_file_read by noting the alternative is for reading text without keeping a copy, and the title 'Download from a server' reinforces the intent.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly provides an alternative and a usage condition: 'To read a text file rather than keep it, ssh_file_read skips the disk.' This tells an agent when to prefer a sibling tool instead. The copy direction is unambiguous, so there is no confusion with ssh_upload.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_execADestructive
Runs one command or a list of them on a server, each with its own exit code, stdout and stderr. Work measured in minutes belongs in detach, not in a longer timeout. Reach for it last — files, logs, transfers, health and jobs each have a tool that batches the round trips and parses the answer.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Directory to start in, detached jobs included. Cannot be entered -> the command stops, it does not run elsewhere. | |
| sudo | No | Execute command(s) with sudo. Default: false | |
| detach | No | Background job on the server: returns an id at once, outlives this call, timeout does not apply. Follow with ssh_job_status / ssh_job_output, stop with ssh_job_kill. One command. With sudo the job runs as root and every later call follows it as root, provided the profile has a password or sudo needs none. Default: false | |
| command | Yes | One command, or a list: ["hostname", "whoami"]. Each runs in its own shell — no shared variable, no shared cd; cwd applies to all. A non-zero exit does not stop the list. | |
| profile | Yes | Machine name. | |
| timeout | No | Milliseconds, per command in a list, not for the whole list; default 30000. Work measured in minutes -> detach, not a bigger number. |
Output Schema
| Name | Required | Description |
|---|---|---|
| job_id | No | |
| legend | No | What the words in this answer mean. A key names the field before the value — "state=limited", "jobs[].state=lost" — and only the values this answer actually used are listed. |
| commands | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the destructiveHint annotation, the description adds behavior: each command returns its own exit code, stdout, and stderr, and long-running work should be detached rather than given a bigger timeout. It doesn't fully warn about the arbitrary-command risk, but the annotation and phrasing imply raw execution.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences carry both the core behavior and the key usage caveat. Every clause earns its place, and the most important routing guidance comes second but remains succinct.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The combination of a rich schema, output schema, and a description that covers command granularity and tool routing gives an agent enough to invoke this correctly. It does not name the exact sibling tools, but the categories are identifiable from the sibling list.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already explains every parameter. The description reinforces the detach-vs-timeout tradeoff at a high level, but adds no new parameter-specific meaning. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: running one command or a list on a server, with per-command exit code, stdout, and stderr. It also differentiates from specialized siblings by saying files, logs, transfers, health, and jobs each have their own tool, making this the raw fallback.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit when-not-to-use guidance: work measured in minutes belongs in detach, not a longer timeout. It also tells the agent to prefer category-specific tools because they batch round trips and parse answers, which is clear routing advice.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_file_listARead-only
Lists a directory on a server: every entry with its size, mode, owner and modification time, as fields. A directory it was not allowed to enter is named rather than left out, and a listing cut short by the output limit says so. To see what is inside a file, use ssh_file_read.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Directory to list. | |
| sudo | No | List as root, for directories the profile user cannot open. Default: false | |
| pattern | No | Glob matched on the machine: "*.conf". Without it every entry comes back. | |
| profile | Yes | Machine name. | |
| recursive | No | Descend into subdirectories. A deep tree is cut at the output limit and says so. Default: false |
Output Schema
| Name | Required | Description |
|---|---|---|
| path | No | |
| legend | No | What the words in this answer mean. A key names the field before the value — "state=limited", "jobs[].state=lost" — and only the values this answer actually used are listed. |
| entries | No | |
| truncated | No | The output limit cut the answer: the directory holds more than entries lists. |
| unreadable | No | Directories nobody was allowed to enter. Their contents are missing from entries, and a list short by the one that mattered looks complete. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint annotation, it discloses useful behavioral edge cases: unreadable directories are named rather than silently omitted, and listings truncated by the output limit are explicitly flagged. This gives the agent accurate expectations for permission failures and large listings.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences with no filler: core purpose first, then key behavioral guarantees, then the routing note to ssh_file_read. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With a readOnlyHint, 100% schema parameter coverage, and an output schema present, the description covers the remaining contextual needs: result contents, error behavior, truncation signaling, and the relationship to the closest sibling. Nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the input schema fully documents all five parameters. The description adds context about output fields and truncation but not new parameter-level semantics, matching the baseline for fully documented schemas.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Lists a directory on a server' and names the returned fields (size, mode, owner, modification time). It distinguishes itself from ssh_file_read by explicitly directing file-content needs to that sibling.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It clearly states the tool's use case (listing directories) and provides an explicit alternative for the adjacent case ('To see what is inside a file, use ssh_file_read'). No ambiguity remains about which sibling to pick for file-content access.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_file_readARead-only
Reads text files from a server, several of them in one call. A file it could not read is named with the reason, never returned empty or cut short as if that were the content. To look for something inside logs rather than read them, ssh_log_search greps on the server.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | One path, or a list: ["/etc/hosts", "/etc/resolv.conf"]. An unreadable file costs the list nothing — the others still come back. | |
| sudo | No | Read as root, for files the profile user cannot open. Default: false | |
| binary | No | Fetch over the transport, not the command channel; answer in base64. The safe way for non-text, implies encoding=base64. Default: false | |
| profile | Yes | Machine name. | |
| encoding | No | base64 keeps non-text bytes intact but still goes through the command channel and its size limit. Real binary -> binary below. Default: utf8 | utf8 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true, which the description does not contradict. The description adds meaningful behavioral context beyond annotations: unreadable files are reported with the reason, never returned as empty or truncated content, and multiple files can be read in one call. These are useful operational details not captured by the annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no filler. The primary purpose and batch capability are front-loaded, followed by error behavior and an alternative tool reference. Every sentence earns its place and the structure is clean.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With a rich schema that documents all parameters, the description covers the core behavior (batch read, error handling) and names an alternative. Since there is no output schema, the error-behavior note partially clarifies return semantics, though the exact response structure isn't specified. For a read-only tool, this is adequate and nothing critical is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% — every parameter (path, sudo, binary, profile, encoding) has a detailed schema description with defaults and enums where applicable. The tool description itself adds no additional parameter semantics beyond the schema, so this dimension sits at the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence states a specific verb ('reads') and resource ('text files from a server') and highlights the batch capability ('several of them in one call'). It explicitly distinguishes itself from ssh_log_search, but does not address other siblings like ssh_file_list or ssh_file_write, so differentiation is partial.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides an explicit alternative: 'To look for something inside logs rather than read them, ssh_log_search greps on the server.' This is clear when-not-to-use guidance for one specific scenario, but it does not mention when to use ssh_file_list or other file tools, so coverage is limited.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_file_writeADestructiveIdempotent
Writes text files on a server, several in one call, each with its own path, permissions, owner and sudo. A file is replaced whole and never appears half-written; there is no append. For something that already exists on this machine, use ssh_upload.
| Name | Required | Description | Default |
|---|---|---|---|
| files | Yes | One file, or a list — mode and sudo decided per file, not per call. | |
| profile | Yes | Machine name. |
Output Schema
| Name | Required | Description |
|---|---|---|
| files | No | |
| legend | No | What the words in this answer mean. A key names the field before the value — "state=limited", "jobs[].state=lost" — and only the values this answer actually used are listed. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the idempotent and destructive hints, the description discloses that files are replaced whole, atomically, and never appended to. This adds useful behavioral context that the annotations alone do not provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, all high-signal: the core action, the atomic/replace behavior, and the sibling alternative. No filler or redundant restatement.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the rich input schema, annotations, and output schema, the description covers the essential behavioral semantics and alternative routing. Nothing critical is missing for an agent to invoke this correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already explains each parameter thoroughly. The description contributes the multi-file and per-file ownership/sudo framing, but most parameter-level meaning is in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: writes files on a server. It also differentiates itself from the closest sibling by saying anything already on this machine should use ssh_upload.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly names ssh_upload as the alternative for files that already exist locally, and clarifies the tool supports multiple files in one call. The no-append note also sets an important boundary.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_job_killADestructiveIdempotent
Stops a detached job and everything it started — the signal reaches the whole process group. A job that had already finished is reported as gone, not as a refusal.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Job id returned by ssh_exec with detach: true. A job started with sudo is reached as root from the id alone — nothing extra to pass. | |
| signal | No | KILL only when TERM was already ignored. | TERM |
| profile | Yes | Machine name. |
Output Schema
| Name | Required | Description |
|---|---|---|
| id | No | |
| legend | No | What the words in this answer mean. A key names the field before the value — "state=limited", "jobs[].state=lost" — and only the values this answer actually used are listed. |
| reason | No | |
| signal | No | What was actually sent, which is not always what was asked for. |
| outcome | No | signalled — the signal reached the process group of the job; gone — the job had already ended, so there was nothing to stop; nopid — the job recorded no pid, so there was nothing to signal; missing — the server knows no job under this id; no-answer — the server did not answer the stop request, so the job state is unknown. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint and idempotentHint. The description adds valuable context: the signal reaches the whole process group, and already-finished jobs are reported as 'gone' rather than a refusal. This goes beyond the annotation hints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences that front-load the primary action and then clarify an edge case. No redundancy or wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is sufficient for a destructive operation with an output schema. It explains the scope of destruction (process group) and the idempotent edge case. Combined with schema documentation for parameters and annotation hints, an agent has what it needs to call correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers all 3 parameters with descriptions, so baseline is 3. The tool description itself does not add any parameter-specific meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Stops), resource (detached job), and clarifies it reaches the entire process group. Distinguishes from sibling tools like ssh_job_list and ssh_job_status which are non-destructive. Also clarifies behavior for already-finished jobs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for stopping detached background jobs, but does not explicitly mention alternatives or conditions when not to use. It clarifies that it targets detached jobs, giving scope, but lacks explicit when-not guidance or reference to alternative sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_job_listARead-only
Lists the detached jobs on a machine with their state, jobs started with sudo included — for when an id was not kept. Ids and states only; for what a job printed, use ssh_job_output.
| Name | Required | Description | Default |
|---|---|---|---|
| profile | Yes | Machine name. |
Output Schema
| Name | Required | Description |
|---|---|---|
| jobs | No | |
| legend | No | What the words in this answer mean. A key names the field before the value — "state=limited", "jobs[].state=lost" — and only the values this answer actually used are listed. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, and the description adds meaningful behavioral detail beyond that: it lists detached jobs including sudo-started ones, and clarifies that only IDs and states are returned. This goes beyond the annotation without contradicting it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler. The core purpose is front-loaded, followed by a scope caveat and a pointer to an alternative. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter read-only tool with an output schema, the description is complete. It explains scope, inclusion of sudo jobs, return content, and when to use it, while relying on annotations and the output schema for the rest.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% because the only parameter, 'profile', is documented as 'Machine name.' The description does not add parameter-level meaning beyond the schema, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Lists') and resource ('detached jobs on a machine with their state'), and adds a distinguishing constraint ('jobs started with sudo included'). It also explicitly differentiates itself from ssh_job_output by limiting scope to 'Ids and states only', so an agent can select it correctly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit when-to-use guidance: 'for when an id was not kept'. It also names the alternative for related needs: 'for what a job printed, use ssh_job_output'. This directly helps an agent choose between sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_job_outputARead-only
Returns what a detached job has written so far, stdout and stderr together, from a byte offset you choose. For whether the job is still running rather than what it printed, ssh_job_status answers in one line.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Job id returned by ssh_exec with detach: true. A job started with sudo is reached as root from the id alone — nothing extra to pass. | |
| offset | No | Byte offset to read from; the answer names the next one. | |
| profile | Yes | Machine name. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true, which covers safety, and the description adds meaningful behavioral context: reads only output produced 'so far' (non-blocking), merges stdout and stderr, and supports reading from a chosen byte offset with the next offset returned. This goes beyond annotation data without contradicting it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences carry the full purpose, the key behavioral detail, and the alternative-tool routing. The most important information is front-loaded, and there is no filler or repetition of schema fields.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only streaming tool with a complete schema, the description is largely sufficient: it conveys non-blocking behavior, combined streams, byte-offset seeking, and the cursor semantics. There is no output schema, so a bit more detail about the exact return shape would push this to 5, but nothing essential to invoking it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all three parameters. The tool description itself does not add new parameter-level meaning beyond what the schema says; it merely restates the offset concept. This meets the baseline for full schema coverage but does not exceed it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Returns what a detached job has written so far', and clarifies that stdout and stderr are combined. It also distinguishes this from ssh_job_status by explicitly contrasting output content with run-state. This leaves no ambiguity about the tool's core function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The second sentence gives clear routing guidance: if an agent cares whether the job is still running, use ssh_job_status instead. This is an explicit condition that selects between two closely related siblings, which is exactly what an agent needs.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_job_statusARead-only
Reports the state of a detached job, with the last lines it wrote so you can see where it got to. lost means no exit code was left behind, not that the work failed — ssh_job_output still has the output.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Job id returned by ssh_exec with detach: true. A job started with sudo is reached as root from the id alone — nothing extra to pass. | |
| profile | Yes | Machine name. |
Output Schema
| Name | Required | Description |
|---|---|---|
| jobs | No | |
| legend | No | What the words in this answer mean. A key names the field before the value — "state=limited", "jobs[].state=lost" — and only the values this answer actually used are listed. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark the tool as read-only, so the description adds value by explaining the 'lost' status semantics and clarifying that 'lost' does not mean the work failed. It also discloses that the output remains available via ssh_job_output, which is useful behavioral context beyond what the annotations state.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences convey the core purpose, the extra output detail, and the important 'lost' edge-case semantics. Every phrase carries meaning, and the key information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only status tool with complete schema descriptions and an output schema present, the description covers all essential context. The 'lost' clarification removes a likely source of confusion, and the readOnlyHint addresses safety.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides 100% parameter coverage with descriptive text for both 'id' and 'profile', including the note about sudo. The tool description itself adds no additional parameter-level meaning, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Reports') and a specific resource ('the state of a detached job'), and also states it includes the last lines written for progress visibility. This distinguishes it from sibling tools like ssh_job_output (which retrieves full output) and ssh_job_list (which lists jobs).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes clear when to use this tool: to check the state of a detached job and see where it got to via its last lines. It also gives an implicit when-not by pointing to ssh_job_output for cases where the job is 'lost' but output still exists. It does not explicitly contrast with ssh_job_list, but the single-job framing is enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_log_searchARead-only
Greps log files on the server and returns the matching lines with their paths, or the paths alone when line bodies are not wanted. An empty answer means no match, never a failed search — files that could not be read are listed apart. For the tail of a file rather than a search through it, ssh_log_tail is cheaper. A container is searched by name instead of by path.
| Name | Required | Description | Default |
|---|---|---|---|
| from | No | Which end maxMatches keeps: "end" newest (scans the whole file), "start" oldest (stops reading at the cap). Default: end | end |
| path | No | One path, a list, or a glob in the file name: "/var/log/*.log". Expanded by the server's find, not a shell — a name with a space or a newline stays one name. A glob in the directory part is refused. | |
| sudo | No | Read as root. Straight away for places a plain user cannot read (/root, /var/lib/docker); otherwise retry with true when the answer names what it could not read. Default: false | |
| query | Yes | Regex, grep -E dialect. | |
| since | No | Window: "today" | "2026-08-19" | "2h" | "3d", the day taken from the server. Skips files untouched in it (count reported). A window of a day or more then keeps only lines dated inside — 2026-08-19, Aug 19, 19/Aug/2026; a shorter one filters files and leaves their lines alone. Undated file: searched whole and named. | |
| context | No | Lines around each match, as grep -C. Excluded by namesOnly. Default: 0 | |
| profile | Yes | Machine name. | |
| timeout | No | Milliseconds per file, default 30000. Raise for multi-gigabyte files with from: "end". | |
| container | No | Read this container's output instead of a file: docker is asked where it writes, and the answer names the file it read. Whatever cannot be read this way — a driver that keeps no file, an engine that is not docker, a name nothing answers to — comes back said aloud, naming ssh_exec as the way through. The file belongs to root, so sudo: true. Give this or path, never both. | |
| namesOnly | No | Answer = matching paths, no line bodies. One command for the whole list; maxMatches and context do not apply. Default: false | |
| recursive | No | Walk the whole tree, not one level. With a glob: "/etc/nginx/*.conf" reaches those at any depth. Symlinked files are searched, symlinked dirs not descended. Default: false | |
| maxMatches | No | Cap per file; reaching it is reported. Default: 200 | |
| caseSensitive | No | false = case ignored. Default: false |
Output Schema
| Name | Required | Description |
|---|---|---|
| files | No | Matching file names, for namesOnly. |
| lines | No | The matching lines. context:true marks a neighbour shown alongside, not a match. |
| source | No | Named only when container was asked: the engine, the driver and the file the lines were read from. |
| limited | No | maxMatches was reached — more exist than are shown. |
| matches | No | Lines in the answer — matches plus any context lines; with namesOnly, matching files. |
| truncated | No | Output was cut mid-answer: incomplete, not empty. |
| files_skipped | No | Left unread by the since window. |
| files_undated | No | No recognisable timestamp: searched whole, the window was not applied. |
| files_searched | No | |
| files_unreadable | No | Opened with an error — not proof the text is absent. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds significant behavioral clarity beyond the readOnlyHint annotation: an empty answer means no match, never a failed search, and unreadable files are listed apart. This prevents an agent from misinterpreting an empty result as an error. The readOnly annotation already covers mutation safety, so the added semantics are above baseline.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two dense sentences with no wasted words. The core purpose, output distinction, no-match semantics, failure handling, sibling alternative, and container usage are all packed in efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With a full input schema and an output schema present, the description covers the non-obvious behavioral gotchas an agent needs: empty-result semantics, unreadable-file reporting, and the tail alternative. It could have mentioned the output structure explicitly, but the output schema already supplies that.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents every parameter thoroughly. The description reinforces the container-by-name notion and the line-bodies-versus-paths choice, but it does not add meaning beyond what the parameter descriptions already supply. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a precise verb and object: 'Greps log files on the server and returns the matching lines with their paths.' It also distinguishes the paths-only mode and immediately contrasts itself with ssh_log_tail, so an agent can disambiguate it from the closest sibling without inspecting the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly names when a sibling is cheaper: 'For the tail of a file rather than a search through it, ssh_log_tail is cheaper.' It also conveys the container-vs-path usage pattern. It does not enumerate all alternatives among the many siblings, but the relevant distinction is covered.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_log_tailARead-only
Returns the last lines of one or more log files, whatever their size — nothing is shipped here to be trimmed locally. A container is read by name instead of by path, through the file its driver writes. To look for something rather than read the end, use ssh_log_search.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | One path, a list, or a glob in the file name: "/var/log/*.log". Expanded by the server's find, not a shell — a name with a space or a newline stays one name. A glob in the directory part is refused. | |
| sudo | No | Read as root. Straight away for places a plain user cannot read (/root, /var/lib/docker); otherwise retry with true when the answer names what it could not read. Default: false | |
| lines | No | How many lines from the end. Default: 100 | |
| profile | Yes | Machine name. | |
| container | No | Read this container's output instead of a file: docker is asked where it writes, and the answer names the file it read. Whatever cannot be read this way — a driver that keeps no file, an engine that is not docker, a name nothing answers to — comes back said aloud, naming ssh_exec as the way through. The file belongs to root, so sudo: true. Give this or path, never both. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint annotation, the description adds behavioral context: 'whatever their size — nothing is shipped here to be trimmed locally' and explains container resolution 'through the file its driver writes.' These clarify how the tool behaves without contradicting the annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three purposeful sentences: core behavior and scope come first, container nuance follows, and the sibling alternative closes. No filler, no repetition of schema details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only tail tool, the description plus fully described schema covers file paths, globs, container mode, sudo behavior, and search routing. It does not describe the return format, but that is reasonably inferable from 'returns the last lines' and no output schema exists.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameter descriptions already carry the meaning. The main description adds tailing/container framing but does not materially extend individual parameter semantics beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'Returns the last lines of one or more log files'. It also distinguishes itself from the sibling ssh_log_search by explicitly contrasting tailing with searching for something.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly routes the agent: 'To look for something rather than read the end, use ssh_log_search.' It also clarifies the container-read path vs ordinary file paths, giving concrete context for when each mode applies.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_monitorAIdempotent
Looks after the SSH connections themselves, not the machines behind them: lists the configured profiles, tests one, reports pool statistics, closes a connection or reloads the profile file. Start here on a machine you have not used yet — test names the state before anything else runs.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Which of the five to do. close and reload drop live connections; the other three only read. | |
| profile | No | Which machine. Required for stats, test and close; list and reload take none. |
Output Schema
| Name | Required | Description |
|---|---|---|
| state | No | ready — logged in, commands run; limited — logged in and commands run, but the shell is not POSIX; no-route — the server was never reached; rejected — the server was reached and refused the login. null — nothing was checked: only the test action reaches the server. |
| action | No | |
| broken | No | |
| legend | No | What the words in this answer mean. A key names the field before the value — "state=limited", "jobs[].state=lost" — and only the values this answer actually used are listed. |
| profile | No | |
| profiles | No | |
| exit_code | No | |
| latency_ms | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description reveals important behavioral nuance beyond the annotations: close and reload drop live connections while the other actions only read. Annotations already signal idempotent and non-destructive, so this is additive rather than repetitive, and it does not contradict the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core scope and followed by practical guidance. Every phrase earns its place; there is no redundant filler or repetition of schema content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With only two parameters, an output schema, and strong annotations, the description covers the essential usage guidance, side-effect differences, and conceptual scope. It could explicitly enumerate which action to use in which scenario, but the existing context is sufficient for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, with both parameters already well described in the schema. The description adds a high-level summary of actions but does not materially improve on the schema's per-parameter semantics, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb-and-resource purpose: managing SSH connections themselves, listing profiles, testing, reporting pool stats, closing, and reloading. It explicitly distinguishes itself from tools that operate on machines behind the connections, which differentiates it from the many ssh_ sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives concrete usage context: 'Start here on a machine you have not used yet' and recommends that 'test names the state before anything else runs.' It does not explicitly name which sibling tools to use instead, but its scope exclusion ('not the machines behind them') makes the appropriate context clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_service_statusARead-only
Reports one systemd unit: whether it is loaded, active and enabled, with the tail of its journal. A machine without systemd comes back as NOT CHECKED, never as a stopped service — that would read as an outage which is not there. For every failed unit at once, ssh_audit_baseline names them.
| Name | Required | Description | Default |
|---|---|---|---|
| sudo | No | Read as root. Straight away for places a plain user cannot read (/root, /var/lib/docker); otherwise retry with true when the answer names what it could not read. Default: false Without it the journal comes back trimmed to what the profile user may see. | |
| unit | Yes | Unit name, e.g. "nginx" or "nginx.service". | |
| since | No | Journal window, as journalctl reads it: "1h ago", "today", "2026-08-19". | |
| profile | Yes | Machine name. | |
| log_lines | No | Journal lines returned. Default: 50 |
Output Schema
| Name | Required | Description |
|---|---|---|
| unit | No | |
| legend | No | What the words in this answer mean. A key names the field before the value — "state=limited", "jobs[].state=lost" — and only the values this answer actually used are listed. |
| enabled | No | |
| outcome | No | checked — systemd answered, and the fields below carry its measurement; no_systemd — there was nobody to ask on this server, so the service was not measured; no_unit — systemd knows no such unit, which is not the same as a unit that is stopped. |
| restart | No | |
| sub_state | No | |
| recent_log | No | |
| status_head | No | |
| active_state | No | |
| restart_after | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With readOnlyHint=true, the safety profile is already known, so the description adds valuable behavioral context beyond annotations: the NOT CHECKED distinction for non-systemd machines and the journal-tail behavior. This prevents a false outage conclusion and clarifies return semantics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences with no filler. The main purpose is front-loaded, and each subsequent sentence contributes either a behavioral caveat or a sibling alternative. Nothing is repeated from the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the output schema exists and the input schema fully documents parameters, the description covers the essential agent-facing context: single-unit scope, journal tail, systemd-absence semantics, and the relevant sibling tool. No critical gap remains.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the input schema already documents all five parameters well. The description does not materially add parameter-level detail beyond the schema, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Reports one systemd unit: whether it is loaded, active and enabled, with the tail of its journal.' It also differentiates from ssh_audit_baseline by noting that sibling names failed units at once, making the tool's single-unit scope clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives an explicit alternative and condition: 'For every failed unit at once, ssh_audit_baseline names them.' It also provides a crucial usage caveat—machines without systemd return NOT CHECKED, not stopped—so an agent knows when not to interpret the result as an outage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_snapshotARead-only
Reports how a machine is doing right now: cpu, memory, disk, containers, listening ports, services and recent errors, in one round trip. Whatever could not be measured comes back null and marked unavailable, never as a zero that reads like an idle machine. For how the machine is set up rather than how it is running, use ssh_audit_baseline.
| Name | Required | Description | Default |
|---|---|---|---|
| profile | Yes | Machine name. |
Output Schema
| Name | Required | Description |
|---|---|---|
| load | No | |
| ports | No | |
| cpu_pct | No | |
| mem_pct | No | |
| disk_pct | No | |
| services | No | |
| listening | No | |
| containers | No | |
| error_lines | No | |
| unavailable | No | |
| recent_errors | No | |
| services_running | No | |
| containers_running | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish readOnlyHint=true, so the read-only nature is covered. The description adds valuable behavioral context: unmeasured values return null and are marked unavailable rather than zero, preventing misinterpretation. This goes beyond annotations by defining output semantics, so a 4 is justified.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no filler. It front-loads the core purpose, adds the critical null-behavior detail, and ends with the alternative. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that an output schema exists (which explains return structure) and the description covers what it measures, the round-trip efficiency, and the null unavailable convention, nothing essential is missing for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The sole parameter 'profile' is already fully described in the schema as 'Machine name.' (100% coverage). The description does not add any further detail about the parameter, so baseline 3 applies—the schema carries the full semantic load.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reports current machine health (cpu, memory, disk, containers, listening ports, services, recent errors) in one round trip, and explicitly contrasts it with ssh_audit_baseline for setup vs. running state. This makes its purpose unambiguous and distinguishes it from siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on when to use this tool: for current operational status, and when not to (for configuration use ssh_audit_baseline). This directly names the alternative and the condition, leaving no ambiguity about selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_tls_checkARead-only
Checks the TLS certificate a domain serves — days left, whether the name matches a SAN, the issuer and whether renewal is configured — with the handshake made from the server itself, so it sees what that machine sees, including hosts closed to the outside. A null field means the check could not run, not that the certificate is bad. Run it per domain, once ssh_audit_baseline has named the sites.
| Name | Required | Description | Default |
|---|---|---|---|
| port | No | Default: 443 | |
| sudo | No | Read the renewal config as root. Without it "no hook configured" only means "could not look". Default: false | |
| domain | Yes | The name to ask for, e.g. "example.com". | |
| profile | Yes | Machine name. | |
| check_renew_hook | No | Also look for the renewal config. Default: true |
Output Schema
| Name | Required | Description |
|---|---|---|
| port | No | |
| domain | No | |
| issuer | No | |
| san_text | No | |
| not_after | No | |
| days_until_expiry | No | |
| renew_hook_evidence | No | |
| renew_hook_configured | No | |
| san_includes_hostname | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint annotation, the description reveals that the handshake is made from the server itself, so it sees hosts closed to the outside, and clarifies that null fields mean the check could not run rather than certificate failure. This is meaningful behavioral context the annotation does not provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is information-dense and front-loads the core purpose, then adds null semantics and usage sequencing. The first sentence is a bit long with several em-dash interruptions, but every clause adds signal and there is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With annotations declaring read-only behavior, an output schema present, and 100% parameter coverage, the description adds the remaining needed context: what the check sees, how to interpret nulls, and when to run it relative to ssh_audit_baseline. Nothing critical is missing for an agent to select and call this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the input schema already documents all five parameters. The tool description adds useful context around domains and null results, but it does not add new parameter-level meaning beyond what the schema provides, matching the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Checks') and resource ('the TLS certificate a domain serves'), and enumerates the concrete outputs: days left, SAN match, issuer, renewal configuration. This clearly differentiates it from sibling SSH tools like ssh_exec or ssh_audit_baseline.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says to 'Run it per domain, once ssh_audit_baseline has named the sites,' giving a clear prerequisite and invocation pattern. It does not enumerate when not to use it or name alternatives, but the sequencing guidance is actionable and specific.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_uploadADestructiveIdempotent
Copies a local file or directory to a server, checked by sha256 on both sides and never left half-written at the target. A directory replaces the target whole — whatever was there and is not in the source is gone with it; merge: true keeps it instead. For text you can paste, ssh_file_write is cheaper; piping base64 through ssh_exec truncates silently.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | Octal, one value for every file sent. Omit to keep local permissions. | |
| sudo | No | For /etc, /opt and the like, and for setting an owner. Data stages in /tmp first — the machine needs room for a second copy. Default: false | |
| merge | No | Directories only. true = what the target holds and the source does not stays — uploads, .env, logs; same-named files are taken from the source. The tree is still put in place whole, by one rename. mode and owner then cover the kept files too. Default: false | |
| owner | No | "root:root", every file and directory sent. Needs sudo; without it the answer says it was not applied. | |
| verify | No | sha256 on both sides, per file. "unavailable" = no sha256 on the machine = delivered, not broken. "mismatched" fails the call and replaces nothing. Default: true | |
| profile | Yes | Machine name. | |
| timeout | No | Milliseconds. No ceiling by default — a transfer runs as long as it takes. | |
| overwrite | No | false = refuse rather than replace, including when the target cannot be checked. A directory is judged whole, not per file. Default: true | |
| recursive | No | Only to force it — a directory is recognised on its own. | |
| local_path | Yes | A file or a directory on this machine. | |
| remote_path | Yes | Where it goes on the server. A sent directory becomes this path itself and replaces it whole, not file by file — with merge: true what the source lacks stays. |
Output Schema
| Name | Required | Description |
|---|---|---|
| files | No | |
| legend | No | What the words in this answer mean. A key names the field before the value — "state=limited", "jobs[].state=lost" — and only the values this answer actually used are listed. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the idempotentHint and destructiveHint annotations, the description discloses the critical behavior: sha256 verification on both sides, atomic writes that are never half-left, and full replacement of the target directory unless merge:true is set. This is substantive behavioral detail, not just a restatement of annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each earning its place: the first states the action and key guarantees, the second clarifies the destructive directory behavior, and the third routes to an alternative. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the rich parameter schema, the output schema, and annotations, the description covers the essential operational invariants: atomicity, verification, destructive replacement, and the relevant alternative. Nothing needed to correctly invoke the tool is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already covers all 11 parameters richly, so the baseline is 3. The description adds cross-cutting meaning not obvious from individual parameters: the transfer is atomic, directories replace the target whole, and verification is built in. This is useful, but the per-parameter semantic burden is largely carried by the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Copies a local file or directory to a server.' It also distinguishes itself from siblings by noting that ssh_file_write is cheaper for pasteable text, making the tool's role clear against the other SSH tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly gives a decision rule: for text you can paste, use ssh_file_write instead, and warns that piping base64 through ssh_exec truncates silently. This tells an agent when not to use this tool and which sibling to prefer.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
12 tool updates
v2.3.3- Changed
ssh_audit_baseline4 fields changed- changed
Input schema / properties / include_sudo_sections / descriptionPrevious value: -"Read sshd config as sshd sees it (sshd -T), needs root. Without it the ssh section says so instead of guessing from the file. Default: false"New value: +"Run the sections that need root as root: sshd -T for ssh, ufw and iptables rules for firewall. Without it those sections name what they could not read instead of guessing. Default: false" - added
Output schema / properties / firewall / properties / iptables / properties / status / descriptionAdded value: +"not_installed — the tool is absent from the server, so it filters nothing here; no_access — the tool is there, but reading its rules needs root: what it allows is unknown; read — the rules were read, and the fields beside this one come from them." - added
Output schema / properties / firewall / properties / ufw / properties / status / descriptionAdded value: +"not_installed — the tool is absent from the server, so it filters nothing here; no_access — the tool is there, but reading its rules needs root: what it allows is unknown; read — the rules were read, and the fields beside this one come from them." - added
Output schema / properties / legendAdded value: +{ + "additionalProperties": { + "type": "string" + }, + "description": "What the words in this answer mean. A key names the field before the value — \"state=limited\", \"jobs[].state=lost\" — and only the values this answer actually used are listed.", + "type": "object" +}
- Changed
ssh_download4 fields changed- changed
Input schema / properties / verify / descriptionPrevious value: -"sha256 on both sides, per file. \"unavailable\" = no sha256 on the machine = delivered, not broken. Default: true"New value: +"sha256 on both sides, per file. \"unavailable\" = no sha256 on the machine = delivered, not broken. \"mismatched\" fails the call and replaces nothing. Default: true" - added
Output schema / properties / files / items / properties / verified / descriptionAdded value: +"How the sha256 check ended, not whether the data landed — written says that. verified — sha256 was compared after the write and matched; mismatched — sha256 was compared and differed: nothing was replaced, and the path still holds what it held before; unavailable — the check had nothing to work with, and reason says what was missing; skipped — no comparison ran: none was asked for, or nothing landed to compare." - changed
Output schema / properties / files / items / properties / verified / enumPrevious value: -[ - "verified", - "unavailable", - "skipped" -]New value: +[ + "verified", + "mismatched", + "unavailable", + "skipped" +] - added
Output schema / properties / files / items / properties / written / descriptionAdded value: +"Whether the data reached the path. Permissions and owner are a separate matter: one that did not apply is named in reason, and written stays true."
- Changed
ssh_file_list1 field changed- changed
Output schema / (root)Previous value: -nullNew value: +{ + "properties": { + "entries": { + "items": { + "properties": { + "group": { + "type": "string" + }, + "mode": { + "description": "Octal, as chmod takes it: \"644\", \"4755\" — not the rwx letters ls prints.", + "type": "string" + }, + "mtime": { + "description": "Seconds since epoch, UTC.", + "type": "number" + }, + "name": { + "description": "Name inside the listed directory; with recursive, the path below it. Never a full path, so it reads the same either way.", + "type": "string" + }, + "owner": { + "type": "string" + }, + "size": { + "type": "number" + }, + "target": { + "type": [ + "string", + "null" + ] + }, + "type": { + "description": "What the entry is, which decides what size means for it. file — a regular file, and size is its bytes; dir — a directory: size is the directory entry itself, never the sum of what it holds; symlink — a symbolic link — target says where it points, and size is the length of that path; other — a socket, fifo or device node: there is no content to read here.", + "enum": [ + "file", + "dir", + "symlink", + "other" + ], + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "legend": { + "additionalProperties": { + "type": "string" + }, + "description": "What the words in this answer mean. A key names the field before the value — \"state=limited\", \"jobs[].state=lost\" — and only the values this answer actually used are listed.", + "type": "object" + }, + "path": { + "type": "string" + }, + "truncated": { + "description": "The output limit cut the answer: the directory holds more than entries lists.", + "type": "boolean" + }, + "unreadable": { + "description": "Directories nobody was allowed to enter. Their contents are missing from entries, and a list short by the one that mattered looks complete.", + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" +}
- Changed
ssh_file_write4 fields changed- changed
Input schema / properties / files / oneOfPrevious value: -[ - { - "properties": { - "binary": { - "description": "content is base64, decoded before writing. Default: false", - "type": "boolean" - }, - "content": { - "description": "The whole new content, written byte for byte. Replaces the file, never extends it; no trailing newline is added.", - "type": "string" - }, - "mode": { - "description": "Octal string, \"644\". Applied before the file takes its place.", - "type": "string" - }, - "path": { - "description": "Where the file goes.", - "type": "string" - }, - "sudo": { - "description": "Write as root — /etc and anywhere the profile user cannot write. Default: false", - "type": "boolean" - }, - "verify": { - "description": "Compare sha256 before the file takes its place. Default: false", - "type": "boolean" - } - }, - "required": [ - "path", - "content" - ], - "type": "object" - }, - { - "items": { - "properties": { - "binary": { - "description": "content is base64, decoded before writing. Default: false", - "type": "boolean" - }, - "content": { - "description": "The whole new content, written byte for byte. Replaces the file, never extends it; no trailing newline is added.", - "type": "string" - }, - "mode": { - "description": "Octal string, \"644\". Applied before the file takes its place.", - "type": "string" - }, - "path": { - "description": "Where the file goes.", - "type": "string" - }, - "sudo": { - "description": "Write as root — /etc and anywhere the profile user cannot write. Default: false", - "type": "boolean" - }, - "verify": { - "description": "Compare sha256 before the file takes its place. Default: false", - "type": "boolean" - } - }, - "required": [ - "path", - "content" - ], - "type": "object" - }, - "type": "array" - } -]New value: +[ + { + "properties": { + "binary": { + "description": "content is base64, decoded before writing. Default: false", + "type": "boolean" + }, + "content": { + "description": "The whole new content, written byte for byte. Replaces the file, never extends it; no trailing newline is added.", + "type": "string" + }, + "mode": { + "description": "Octal string, \"644\", for this file alone. Applied before the file takes its place.", + "type": "string" + }, + "owner": { + "description": "\"root:root\", for this file alone. Set before the file takes its place. Needs sudo; without it the answer says it was not applied.", + "type": "string" + }, + "path": { + "description": "Where the file goes.", + "type": "string" + }, + "sudo": { + "description": "Write as root, for this file alone — /etc and anywhere the profile user cannot write. Default: false", + "type": "boolean" + }, + "verify": { + "description": "Compare sha256 before the file takes its place. A mismatch fails the call and leaves the path as it was. Default: true", + "type": "boolean" + } + }, + "required": [ + "path", + "content" + ], + "type": "object" + }, + { + "items": { + "properties": { + "binary": { + "description": "content is base64, decoded before writing. Default: false", + "type": "boolean" + }, + "content": { + "description": "The whole new content, written byte for byte. Replaces the file, never extends it; no trailing newline is added.", + "type": "string" + }, + "mode": { + "description": "Octal string, \"644\", for this file alone. Applied before the file takes its place.", + "type": "string" + }, + "owner": { + "description": "\"root:root\", for this file alone. Set before the file takes its place. Needs sudo; without it the answer says it was not applied.", + "type": "string" + }, + "path": { + "description": "Where the file goes.", + "type": "string" + }, + "sudo": { + "description": "Write as root, for this file alone — /etc and anywhere the profile user cannot write. Default: false", + "type": "boolean" + }, + "verify": { + "description": "Compare sha256 before the file takes its place. A mismatch fails the call and leaves the path as it was. Default: true", + "type": "boolean" + } + }, + "required": [ + "path", + "content" + ], + "type": "object" + }, + "type": "array" + } +] - added
Output schema / properties / files / items / properties / verified / descriptionAdded value: +"How the sha256 check ended, not whether the data landed — written says that. verified — sha256 was compared after the write and matched; mismatched — sha256 was compared and differed: nothing was replaced, and the path still holds what it held before; unavailable — the check had nothing to work with, and reason says what was missing; skipped — no comparison ran: none was asked for, or nothing landed to compare." - changed
Output schema / properties / files / items / properties / verified / enumPrevious value: -[ - "verified", - "unavailable", - "skipped" -]New value: +[ + "verified", + "mismatched", + "unavailable", + "skipped" +] - added
Output schema / properties / files / items / properties / written / descriptionAdded value: +"Whether the data reached the path. Permissions and owner are a separate matter: one that did not apply is named in reason, and written stays true."
- Changed
ssh_job_kill2 fields changed- added
Output schema / properties / outcome / descriptionAdded value: +"signalled — the signal reached the process group of the job; gone — the job had already ended, so there was nothing to stop; nopid — the job recorded no pid, so there was nothing to signal; missing — the server knows no job under this id; no-answer — the server did not answer the stop request, so the job state is unknown." - added
Output schema / properties / signal / descriptionAdded value: +"What was actually sent, which is not always what was asked for."
- Changed
ssh_job_list2 fields changed- added
Output schema / properties / jobs / items / properties / started_at / descriptionAdded value: +"Seconds since the epoch; null — the server did not record it." - added
Output schema / properties / jobs / items / properties / state / descriptionAdded value: +"running — started and still running: this is not the outcome, come back later; finished — the job ended and reported its exit code; lost — the job is gone and left no exit code behind; missing — the server knows no job under this id."
- Changed
ssh_job_status2 fields changed- added
Output schema / properties / jobs / items / properties / started_at / descriptionAdded value: +"Seconds since the epoch; null — the server did not record it." - added
Output schema / properties / jobs / items / properties / state / descriptionAdded value: +"running — started and still running: this is not the outcome, come back later; finished — the job ended and reported its exit code; lost — the job is gone and left no exit code behind; missing — the server knows no job under this id."
- Changed
ssh_log_search4 fields changed- added
Input schema / properties / containerAdded value: +{ + "description": "Read this container's output instead of a file: docker is asked where it writes, and the answer names the file it read. Whatever cannot be read this way — a driver that keeps no file, an engine that is not docker, a name nothing answers to — comes back said aloud, naming ssh_exec as the way through. The file belongs to root, so sudo: true. Give this or path, never both.", + "type": "string" +} - changed
Input schema / properties / since / descriptionPrevious value: -"Window: \"today\" | \"2026-08-19\" | \"2h\" | \"3d\", the day taken from the server. Skips files untouched in it (count reported), then keeps only lines dated inside — 2026-08-19, Aug 19, 19/Aug/2026. Undated file: searched whole and named. Under a day filters files, not lines."New value: +"Window: \"today\" | \"2026-08-19\" | \"2h\" | \"3d\", the day taken from the server. Skips files untouched in it (count reported). A window of a day or more then keeps only lines dated inside — 2026-08-19, Aug 19, 19/Aug/2026; a shorter one filters files and leaves their lines alone. Undated file: searched whole and named." - changed
Input schema / requiredPrevious value: -[ - "profile", - "path", - "query" -]New value: +[ + "profile", + "query" +] - added
Output schema / properties / sourceAdded value: +{ + "description": "Named only when container was asked: the engine, the driver and the file the lines were read from.", + "type": "string" +}
- Changed
ssh_log_tail2 fields changed- added
Input schema / properties / containerAdded value: +{ + "description": "Read this container's output instead of a file: docker is asked where it writes, and the answer names the file it read. Whatever cannot be read this way — a driver that keeps no file, an engine that is not docker, a name nothing answers to — comes back said aloud, naming ssh_exec as the way through. The file belongs to root, so sudo: true. Give this or path, never both.", + "type": "string" +} - changed
Input schema / requiredPrevious value: -[ - "profile", - "path" -]New value: +[ + "profile" +]
- Changed
ssh_monitor2 fields changed- changed
Input schema / properties / action / descriptionPrevious value: -"Which of the five to do."New value: +"Which of the five to do. close and reload drop live connections; the other three only read." - added
Output schema / properties / state / descriptionAdded value: +"ready — logged in, commands run; limited — logged in and commands run, but the shell is not POSIX; no-route — the server was never reached; rejected — the server was reached and refused the login. null — nothing was checked: only the test action reaches the server."
- Changed
ssh_service_status2 fields changed- added
Output schema / properties / legendAdded value: +{ + "additionalProperties": { + "type": "string" + }, + "description": "What the words in this answer mean. A key names the field before the value — \"state=limited\", \"jobs[].state=lost\" — and only the values this answer actually used are listed.", + "type": "object" +} - added
Output schema / properties / outcome / descriptionAdded value: +"checked — systemd answered, and the fields below carry its measurement; no_systemd — there was nobody to ask on this server, so the service was not measured; no_unit — systemd knows no such unit, which is not the same as a unit that is stopped."
- Changed
ssh_upload8 fields changed- added
Input schema / properties / mergeAdded value: +{ + "default": false, + "description": "Directories only. true = what the target holds and the source does not stays — uploads, .env, logs; same-named files are taken from the source. The tree is still put in place whole, by one rename. mode and owner then cover the kept files too. Default: false", + "type": "boolean" +} - changed
Input schema / properties / owner / descriptionPrevious value: -"\"root:root\", every file sent. Needs sudo; without it the answer says it was not applied."New value: +"\"root:root\", every file and directory sent. Needs sudo; without it the answer says it was not applied." - changed
Input schema / properties / remote_path / descriptionPrevious value: -"Where it goes on the server. A sent directory becomes this path itself and replaces it whole, not file by file."New value: +"Where it goes on the server. A sent directory becomes this path itself and replaces it whole, not file by file — with merge: true what the source lacks stays." - changed
Input schema / properties / sudo / descriptionPrevious value: -"For /etc, /opt and the like. Data stages in /tmp first — the machine needs room for a second copy. Default: false"New value: +"For /etc, /opt and the like, and for setting an owner. Data stages in /tmp first — the machine needs room for a second copy. Default: false" - changed
Input schema / properties / verify / descriptionPrevious value: -"sha256 on both sides, per file. \"unavailable\" = no sha256 on the machine = delivered, not broken. Default: true"New value: +"sha256 on both sides, per file. \"unavailable\" = no sha256 on the machine = delivered, not broken. \"mismatched\" fails the call and replaces nothing. Default: true" - added
Output schema / properties / files / items / properties / verified / descriptionAdded value: +"How the sha256 check ended, not whether the data landed — written says that. verified — sha256 was compared after the write and matched; mismatched — sha256 was compared and differed: nothing was replaced, and the path still holds what it held before; unavailable — the check had nothing to work with, and reason says what was missing; skipped — no comparison ran: none was asked for, or nothing landed to compare." - changed
Output schema / properties / files / items / properties / verified / enumPrevious value: -[ - "verified", - "unavailable", - "skipped" -]New value: +[ + "verified", + "mismatched", + "unavailable", + "skipped" +] - added
Output schema / properties / files / items / properties / written / descriptionAdded value: +"Whether the data reached the path. Permissions and owner are a separate matter: one that did not apply is named in reason, and written stays true."
9 tool updates
v2.3.0- Changed
ssh_download1 field changed- added
Output schema / properties / legend / descriptionAdded value: +"What the words in this answer mean. A key names the field before the value — \"state=limited\", \"jobs[].state=lost\" — and only the values this answer actually used are listed."
- Changed
ssh_exec2 fields changed- changed
Input schema / properties / detach / descriptionPrevious value: -"Background job on the server: returns an id at once, outlives this call, timeout does not apply. Follow with ssh_job_status / ssh_job_output, stop with ssh_job_kill. One command, no sudo. Default: false"New value: +"Background job on the server: returns an id at once, outlives this call, timeout does not apply. Follow with ssh_job_status / ssh_job_output, stop with ssh_job_kill. One command. With sudo the job runs as root and every later call follows it as root, provided the profile has a password or sudo needs none. Default: false" - added
Output schema / properties / legend / descriptionAdded value: +"What the words in this answer mean. A key names the field before the value — \"state=limited\", \"jobs[].state=lost\" — and only the values this answer actually used are listed."
- Changed
ssh_file_write1 field changed- added
Output schema / properties / legend / descriptionAdded value: +"What the words in this answer mean. A key names the field before the value — \"state=limited\", \"jobs[].state=lost\" — and only the values this answer actually used are listed."
- Changed
ssh_job_kill2 fields changed- changed
Input schema / properties / id / descriptionPrevious value: -"Job id returned by ssh_exec with detach: true"New value: +"Job id returned by ssh_exec with detach: true. A job started with sudo is reached as root from the id alone — nothing extra to pass." - added
Output schema / properties / legend / descriptionAdded value: +"What the words in this answer mean. A key names the field before the value — \"state=limited\", \"jobs[].state=lost\" — and only the values this answer actually used are listed."
- Changed
ssh_job_list1 field changed- added
Output schema / properties / legend / descriptionAdded value: +"What the words in this answer mean. A key names the field before the value — \"state=limited\", \"jobs[].state=lost\" — and only the values this answer actually used are listed."
- Changed
ssh_job_output1 field changed- changed
Input schema / properties / id / descriptionPrevious value: -"Job id returned by ssh_exec with detach: true"New value: +"Job id returned by ssh_exec with detach: true. A job started with sudo is reached as root from the id alone — nothing extra to pass."
- Changed
ssh_job_status2 fields changed- changed
Input schema / properties / id / descriptionPrevious value: -"Job id returned by ssh_exec with detach: true"New value: +"Job id returned by ssh_exec with detach: true. A job started with sudo is reached as root from the id alone — nothing extra to pass." - added
Output schema / properties / legend / descriptionAdded value: +"What the words in this answer mean. A key names the field before the value — \"state=limited\", \"jobs[].state=lost\" — and only the values this answer actually used are listed."
- Changed
ssh_monitor1 field changed- added
Output schema / properties / legend / descriptionAdded value: +"What the words in this answer mean. A key names the field before the value — \"state=limited\", \"jobs[].state=lost\" — and only the values this answer actually used are listed."
- Changed
ssh_upload1 field changed- added
Output schema / properties / legend / descriptionAdded value: +"What the words in this answer mean. A key names the field before the value — \"state=limited\", \"jobs[].state=lost\" — and only the values this answer actually used are listed."
18 tool updates
v1.0.0- First observed
ssh_audit_baseline - First observed
ssh_disk_breakdown - First observed
ssh_download - First observed
ssh_exec - First observed
ssh_file_list - First observed
ssh_file_read - First observed
ssh_file_write - First observed
ssh_job_kill - First observed
ssh_job_list - First observed
ssh_job_output - First observed
ssh_job_status - First observed
ssh_log_search - First observed
ssh_log_tail - First observed
ssh_monitor - First observed
ssh_service_status - First observed
ssh_snapshot - First observed
ssh_tls_check - First observed
ssh_upload
TDQS
Scored across 18 tools
Each tool targets a distinct resource and action: file read/write/list/upload/download, job status/output/list/kill, log tail/search, and system snapshot/audit/disk/service checks are clearly separated. Cross-references such as ssh_file_read vs ssh_download and ssh_snapshot vs ssh_audit_baseline reinforce rather than blur the boundaries. ssh_exec is explicitly positioned as a last-resort generic tool, reducing overlap.
All tools share the ssh_ prefix and snake_case, and most follow a domain_action pattern like ssh_file_read, ssh_job_status, and ssh_log_search. A few one-offs such as ssh_snapshot, ssh_monitor, ssh_upload, and ssh_audit_baseline break the otherwise predictable pattern, though they remain readable and recognizable.
At 18 tools, the set is slightly above the typical 3-15 range, but it covers a broad SSH operations domain: execution, files, transfers, detached jobs, logs, monitoring, TLS, disk, and services. Each tool has a distinct role and none feels redundant, so the count is reasonable for the stated scope.
The tool surface covers the main workflows: command execution, file read/write/list/transfer, detached job lifecycle, log tailing/searching, and system/health inspection. Obvious gaps like a dedicated file delete or service start/stop are absent, but ssh_exec provides a universal fallback, so agents can work around those missing operations.
Maintenance
Related MCP Connectors
- emisarOAuthdev.emisar
Let AI operate servers without SSH. Choose actions, approve risky changes, and audit every step.
Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.
Connect AI assistants to authorized Windows and macOS devices for files, commands, and management.
Related MCP Servers
- AlicenseAqualityCmaintenanceEnables AI assistants to securely execute remote SSH commands, perform file transfers, and monitor system status through a standardized interface. It features robust security controls including command whitelisting, blacklisting, and credential isolation to prevent unauthorized operations.1011 npmMIT

cygnus-ssh-mcpofficial
AlicenseAqualityAmaintenanceEnables AI assistants to manage remote servers via SSH with 43 specialized tools for command execution, file editing, directory operations, and background tasks across Linux, macOS, and Windows.46104 PyPI8GPL 3.0- AlicenseNot gradedqualityFmaintenanceEnables AI assistants to execute commands and transfer files on remote servers over SSH connections.1MIT
- AlicenseAqualityBmaintenanceEnables AI assistants to manage remote servers via SSH with agentless command execution, file operations, and service management.9MIT