Skip to main content
Glama

πŸ›‘οΈ SSH Remote MCP β€” Matlock Edition

"Never trust raw command piping. Verify state forensically. Contain the blast radius."
An enterprise-grade Model Context Protocol (MCP) server engineered with Grab's Matlock Agent Mindset for safe, deterministic, and audited remote infrastructure management.


⚑ The Problem with Commodity SSH MCPs

Traditional SSH MCPs treat the remote server like a dumb stdin/stdout pipe:

  1. Blind Execution / Command Injection: Raw multiline scripts and unescaped quotes corrupt remote configuration files or cause hanging heredocs.

  2. Zero Blast-Radius Control: A hallucinated rm -rf / or recursive permission change runs unconditionally, permanently bricking nodes.

  3. No Forensic Verification: Commands returning exit code 0 are assumed successful, even when background services fail to bind ports or immediately enter crash loops.

  4. Dangerous Remote File Mutations: Overwriting remote files without backup snapshots or unified diff inspection leads to silent data loss.

  5. Session Hanging on Long Tasks: Builds, container pulls, or migrations cause client stdio timeouts.


Related MCP server: ssh-pro-mcp

πŸ›οΈ The Matlock Architecture

                       β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”
                       β”‚           AI Agent / Client            β”‚
                       β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜
                                           β”‚ JSON-RPC (MCP)
                                           β–Ό
β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”
β”‚                                 SSH REMOTE MCP                                         β”‚
β”‚                                                                                        β”‚
β”‚  β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”  β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”  β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”  β”‚
β”‚  β”‚ 3-Tier Blast Radius   β”‚  β”‚   Forensic Assertion    β”‚  β”‚   Safe SFTP Engine      β”‚  β”‚
β”‚  β”‚     Containment       β”‚  β”‚         Engine          β”‚  β”‚  (Atomic + Diff + Roll) β”‚  β”‚
β”‚  β”‚                       β”‚  β”‚                         β”‚  β”‚                         β”‚  β”‚
β”‚  β”‚ β€’ Tier 1: Safe Read   β”‚  β”‚ β€’ Port Listening Verify β”‚  β”‚ β€’ Auto .matlock.bak     β”‚  β”‚
β”‚  β”‚ β€’ Tier 2: Mutating    β”‚  β”‚ β€’ Process Liveness Checkβ”‚  β”‚ β€’ Base64 Safe Transfer  β”‚  β”‚
β”‚  β”‚ β€’ Tier 3: Block/Gate  β”‚  β”‚ β€’ File State Check      β”‚  β”‚ β€’ Unified Git Diffs     β”‚  β”‚
β”‚  β”‚   (Safety Bypass Tkn) β”‚  β”‚ β€’ HTTP Health Probe     β”‚  β”‚ β€’ 1-Click Rollback      β”‚  β”‚
β”‚  β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜  β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜  β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜  β”‚
β”‚                                                                                        β”‚
β”‚  β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”  β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”     β”‚
β”‚  β”‚   Background Task Envelope       β”‚  β”‚     Multiplexed Session & Profile Store β”‚     β”‚
β”‚  β”‚   (Detached + Poll + Kill)       β”‚  β”‚     (~/.matlock/profiles.json)          β”‚     β”‚
β”‚  β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜  β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜     β”‚
β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜
                                           β”‚ SSH2 / SFTP Keepalive Pool
                                           β–Ό
                                 β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”
                                 β”‚    Remote Host    β”‚
                                 β”‚ (Homelab / Cloud) β”‚
                                 β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜

🧰 Available Tools (10 Primitives)

1. Command Execution & Telemetry

Tool

Description

Matlock Feature

ssh_exec

Executes shell commands on remote target.

3-Tier classification (TIER_1_SAFE, TIER_2_MUTATING, TIER_3_DESTRUCTIVE), post-flight assertions, exit-code validation.

ssh_host_diagnose

Gathers a full forensic host telemetry snapshot.

OS, kernel, uptime, load avg, memory (MB), disk usage, Docker containers, listening ports, top processes in 1 roundtrip.

2. Long-Running Task Envelope

Tool

Description

Matlock Feature

ssh_exec_background

Detaches long tasks into background runner subshells.

Generates task ID, runner script, captures exit codes to disk without hanging MCP stdio.

ssh_task_poll

Polls background task status.

Process liveness check, exit code inspection, and real-time log tailing.

ssh_task_kill

Signals or terminates background task.

Supports SIGTERM / SIGKILL cleanly.

3. Safe Atomic SFTP Primitives

Tool

Description

Matlock Feature

sftp_read_file

Reads file content with line slicing.

Line range parameters (startLine, endLine), SHA-256 integrity hash.

sftp_write_safe

Atomic file write with automatic backup.

Creates .matlock.bak.<timestamp>, base64 transfer, atomic swap, and returns a Unified Diff (diff -u).

sftp_rollback_file

Restores modified file from backup.

Atomic restoration from .matlock.bak.latest or specific backup.

sftp_list_dir

Structured directory file explorer.

Parsed permissions, owner, size, and modification timestamps.

4. Profile, Key Bootstrap & Credential Isolation

Tool

Description

Matlock Feature

ssh_profile_manage

Manages saved hosts in ~/.matlock/profiles.json.

Zero raw private key transmission across MCP parameters; references credentials securely by profile name.

ssh_key_bootstrap

1-Click Password to Key Setup.

Tα»± tαΊ‘o SSH key, kαΊΏt nα»‘i bαΊ±ng password, inject vΓ o authorized_keys, xΓ‘c minh vΓ  lΖ°u profile khΓ΄ng cαΊ§n gΓ΅ pass nα»―a.

mcp_auto_install

Universal Agent IDE Installer.

CΓ i Δ‘αΊ·t tα»± Δ‘α»™ng ssh-remote-mcp vΓ o mọi IDE (Claude, VS Code, Cursor, Windsurf...).


πŸ”’ 3-Tier Blast Radius Containment

  • Tier 1 (Safe / Telemetry): Read-only inspection (ls, cat, df, free, ps, docker ps, ss). Automatically executed.

  • Tier 2 (Mutating): System mutations (mkdir, systemctl restart, docker compose up -d, apt install). Executed with pre/post flight forensic assertions.

  • Tier 3 (Destructive): High-risk operations (rm -rf /, mkfs, dd to /dev/sd*, shutdown, reboot, iptables -F, kill -9 1). Interpreted and BLOCKED before transmission unless explicit confirmDangerToken: true is supplied.


πŸš€ 1-Click Universal Auto-Installer (CΓ i tα»± Δ‘α»™ng cho mọi Agent IDE)

ssh-remote-mcp tΓ­ch hợp sαΊ΅n bα»™ Auto-Installer thΓ΄ng minh, tα»± Δ‘α»™ng quΓ©t vΓ  cΓ i Δ‘αΊ·t vΓ o mọi Agent IDE cΓ³ trΓͺn mΓ‘y tΓ­nh cα»§a bαΊ‘n (Claude Desktop, VS Code Native MCP, Antigravity, Cursor, Windsurf, Cline, Roo Code, Continue, Zed):

# 1-Click CΓ i Δ‘αΊ·t tα»± Δ‘α»™ng qua NPX (tα»± Δ‘α»™ng nhαΊ­n diện IDE vΓ  cαΊ₯u hΓ¬nh an toΓ n):
npx github:nguyenquocanhz/ssh-remote-mcp install

# HoαΊ·c cΓ i tα»« local repo:
node dist/index.js install

# Xem danh sΓ‘ch cΓ‘c IDE được phΓ‘t hiện trΓͺn mΓ‘y:
npx github:nguyenquocanhz/ssh-remote-mcp list

# CΓ i Δ‘αΊ·t Γ©p buα»™c cho tαΊ₯t cαΊ£ IDE (kể cαΊ£ chΖ°a khởi tαΊ‘o config):
npx github:nguyenquocanhz/ssh-remote-mcp install --all

✨ TΓ­nh nΔƒng an toΓ n cα»§a Auto-Installer:

  • KhΓ΄ng ghi Δ‘Γ¨ dα»― liệu cΕ©: Giα»― nguyΓͺn 100% cΓ‘c MCP server Δ‘ang cΓ³ (zmp-mcp, unityMCP,...).

  • Tα»± Δ‘α»™ng sao lΖ°u: TαΊ‘o file snapshot .matlock.bak.<timestamp> trΖ°α»›c khi chỉnh sα»­a.

  • Hα»— trợ Δ‘a nền tαΊ£ng: Windows, macOS, Linux.


βš™οΈ CαΊ₯u hΓ¬nh thα»§ cΓ΄ng (Manual Configuration)

NαΊΏu bαΊ‘n muα»‘n cαΊ₯u hΓ¬nh thα»§ cΓ΄ng vΓ o file config cα»§a IDE:

CΓ‘ch 1: ChαΊ‘y trα»±c tiαΊΏp qua NPX tα»« GitHub:

{
  "mcpServers": {
    "ssh-remote-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "github:nguyenquocanhz/ssh-remote-mcp"
      ]
    }
  }
}

CΓ‘ch 2: ChαΊ‘y tα»« source code cα»₯c bα»™:

cd D:\ssh-remote-mcp
npm install
npm run build

CαΊ₯u hΓ¬nh trong mcp_config.json:

{
  "mcpServers": {
    "ssh-remote-mcp": {
      "command": "node",
      "args": [
        "D:\\ssh-remote-mcp\\dist\\index.js"
      ]
    }
  }
}

πŸ§ͺ Verification & Evidence

Run the integrated automated forensic test suite:

node test-matlock.js

Verified against Homelab Node (192.168.100.169):

  • βœ… ssh_host_diagnose: OS Ubuntu 24.04.5 LTS, 15 Docker containers detected (zaloapp-backend healthy on port 8088).

  • βœ… ssh_exec: Post-flight assertions verified Port 8088 listening and cloudflared active.

  • βœ… Blast-Radius: Destructive rm -rf / blocked by Matlock guardrails.

  • βœ… Safe SFTP: Atomic backup created, unified diff generated, rolled back cleanly.

  • βœ… Background Envelope: Detached runner script executed for loop, polled output, and returned exit code 0.

Available Tools

12 tools
mcp_auto_installB

Automatically detect and install/configure ssh-remote-mcp (or any MCP server) into all Agent IDEs on this computer (Claude Desktop, VS Code, Cursor, Windsurf, Antigravity, Cline, Roo Code, Zed, Continue).

ParametersJSON Schema
NameRequiredDescriptionDefault
modeNoInstallation mode: local node script or global npx (default: local)
dryRunNoPreview installation without writing changes.
forceAllNoForce install into all supported IDEs even if directory does not yet exist.
targetIdeIdsNoOptional list of specific IDE IDs to target (e.g. ["claude", "vscode", "cursor", "gemini"]).

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It is a mutating tool that writes config into nine different IDEs, yet the description never says whether existing entries are overwritten, backed up, or reversible, whether elevated permissions are needed, or what happens on partial failure. dryRun is only explained by the schema, not by the description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence, front-loaded with the verb and the primary target, with the IDE list as trailing detail. No waste, though the parenthetical aside slightly delays the concrete scope.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutating, multi-target config tool with no annotations and no output schema, the description covers what and where but not the safety profile an agent needs (overwrite/rollback behavior, permissions, side effects). Adequate but with meaningful gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and includes an enum and per-parameter descriptions, so the schema does the heavy lifting (baseline 3). The description adds no format or interaction detail beyond naming target IDEs in its scope sentence.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb pair (detect and install/configure) and a concrete resource (ssh-remote-mcp or any MCP server) and enumerates the target IDEs. This clearly separates it from the ssh_*/sftp_* siblings, which operate on remote hosts, not local IDE configuration. It stops short of describing what configuration changes are actually made, so 5 is not warranted.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Use is implied by the description (run this to wire an MCP server into local IDEs) but there is no explicit when-to-use, when-not, or alternative named. With 11 sibling tools in a different domain, some guidance on prerequisites (e.g. is a running ssh host needed first?) would help.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sftp_list_dirB

List remote directory entries with structured file metadata (type, permissions, owner, size, modified date).

ParametersJSON Schema
NameRequiredDescriptionDefault
targetNoOptional SSH connection target. If omitted, uses default profile (homelab).
dirPathYesAbsolute remote directory path.

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry behavioral context. It discloses that results include structured file metadata, which is useful, but it omits auth requirements, default connection behavior when target is omitted, and any handling of symlinks, hidden files, or errors.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence with no wasted words. The metadata list is compact and directly relevant to the tool's output.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The schema fully documents the two parameters and the description names the returned metadata fields, which is helpful given there is no output schema. Still, the description lacks usage guidance and key operational context, leaving it only minimally complete for an SFTP listing tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the nested target object and dirPath are already well documented. The description adds no parameter-level meaning beyond the schema, making the baseline score of 3 appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'List remote directory entries.' It also names the returned metadata fields (type, permissions, owner, size, modified date), which helps distinguish it from file-reading siblings. However, it does not explicitly contrast itself with alternatives such as sftp_read_file.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description offers no when-to-use or when-not-to-use guidance. It does not mention alternatives like sftp_read_file for file contents, nor does it describe prerequisites or selection context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sftp_read_fileB

Safely read remote file with line range slicing (startLine/endLine) and SHA-256 integrity checksum.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetNoOptional SSH connection target. If omitted, uses default profile (homelab).
endLineNo1-indexed ending line.
filePathYesAbsolute remote file path.
maxBytesNoMax bytes to read.
startLineNo1-indexed starting line.

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It does disclose two real behavioral traits β€” the line-range slicing model and SHA-256 integrity verification ('safely') β€” which are not in the schema. However it omits truncation behavior when maxBytes is hit, encoding assumptions, and error semantics for missing files or auth failure, leaving material gaps for a read tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One sentence, front-loaded with the core action, with the differentiating features attached rather than buried. No filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so the description should at least sketch the return shape; it only implies a checksum is returned. For a 5-param tool with a nested connection target, the absence of any return-value or error-handling detail leaves a moderate gap, though the schema itself is fully described.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so host/port/profile/privateKeyPath/filePath/startLine/endLine/maxBytes are already documented. The description only restates startLine/endLine in parentheses and adds no syntax, ordering, or interaction rules (e.g., how maxBytes interacts with endLine). Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('read remote file') plus its distinctive features (line-range slicing, SHA-256 checksum). It clearly separates itself from write-oriented siblings like sftp_write_safe and sftp_list_dir, though it never names an alternative explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use guidance, no mention of prerequisites, and no routing to alternatives such as sftp_list_dir or sftp_read variants. The agent gets no signal about when this tool is preferred over ssh_exec for reading content.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sftp_rollback_fileC

Instantly rollback a modified remote file to its previous .matlock.bak snapshot.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetNoOptional SSH connection target. If omitted, uses default profile (homelab).
filePathYesAbsolute remote file path to restore.
backupPathNoSpecific backup file path (if omitted, uses .matlock.bak.latest).

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. 'Instantly rollback' implies a mutating, destructive overwrite, but the description never states that the current file contents are replaced (data loss), what happens if no .matlock.bak exists, whether permissions are required, or what the result is. Only the snapshot source is disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with zero filler, correctly leading with the action and the target mechanism. It is arguably too terse for a destructive operation, but as a structure/conciseness matter it is efficient and well-ordered.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive rollback tool with a nested SSH target object, no annotations, and no output schema, the description is materially incomplete. It omits overwrite/data-loss semantics, failure behavior when no backup exists, and any relation to the sibling write tool, leaving an agent unequipped to call it safely.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents filePath, backupPath, and the nested SSH target fields; the baseline is 3. The description's mention of the '.matlock.bak snapshot' loosely maps to backupPath but adds no syntax or format detail beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (rollback) and resource (modified remote file) and names the exact snapshot mechanism (.matlock.bak). It does not explicitly differentiate itself from siblings like sftp_write_safe or sftp_read_file, but the operation is clear enough for an agent to select it.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no explicit when/when-not guidance. It does not say this is meant to undo a prior sftp_write_safe, that a valid snapshot must already exist, or how it relates to the alternative of re-writing the file. Usage must be inferred from the name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sftp_write_safeA

Safe atomic remote file write: creates automated remote backup (.matlock.bak.), writes atomically, and returns a unified diff patch and SHA-256 hashes.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetNoOptional SSH connection target. If omitted, uses default profile (homelab).
contentYesComplete content to write into file.
filePathYesAbsolute remote file path to write.
createBackupNoWhether to create .matlock.bak snapshot (default true).

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden and does well: it discloses the backup naming scheme (.matlock.bak.<timestamp>), that the write is atomic, and that the response includes a unified diff and SHA-256 hashes. It stops short of stating what happens when an existing backup is present, whether parent directories are created, or required permissions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence with the key value proposition ('Safe atomic') front-loaded and the three side effects listed after a colon. Zero filler, though the crammed list is slightly harder to parse than separate clauses would be.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation tool with no annotations and no output schema, the description covers the essential traits: it is destructive-ish (overwrites a remote file), it makes a timestamped backup, and it returns diff and SHA-256 evidence. Remaining gaps (error behavior on missing paths, directory permissions) are minor and mostly addressable by the required parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so every parameter including the nested target object is already documented, making 3 the baseline. The description's mention of backup creation and diff/hash output loosely relates to createBackup but adds no syntax or format detail beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ('atomic remote file write') and enumerates three concrete behaviors: backup creation, atomic write, and returning a diff plus SHA-256 hashes. It clearly separates this from sftp_read_file, but it never names or contrasts with the closest sibling, sftp_rollback_file, which is the natural pair for this operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The word 'Safe' hints at intent, but there is no explicit when-to-use guidance and no mention of alternatives such as ssh_exec or the relationship to sftp_rollback_file. An agent must infer that it should prefer this over writing a file via ssh_exec, and no exclusions or preconditions are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_execB

Execute shell command on remote host with Matlock 3-Tier blast-radius containment and post-flight state assertions (verifies listening ports, process liveness, file existence). Blocks destructive operations unless confirmed.

ParametersJSON Schema
NameRequiredDescriptionDefault
envNoOptional environment variables to pass into remote process.
targetNoOptional SSH connection target. If omitted, uses default profile (homelab).
commandYesThe exact shell command to execute.
timeoutMsNoTimeout in ms (default 60000ms).
assertionsNoOptional forensic post-flight assertions.
workingDirNoRemote directory to cd into prior to command.
confirmDangerTokenNoMust be true to execute Tier 3 destructive operations (e.g. root rm -rf, reboot, mkfs).

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It usefully discloses the containment tiers, destructive-operation blocking, and that assertions run post-flight (ports, processes, files). It omits what happens when a command is blocked or an assertion fails, and says nothing about execution/auth behavior beyond the schema's key-vs-password note.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence that front-loads the action and then the safety machinery; no wasted filler. The faintly marketing tone ('Matlock 3-Tier blast-radius') is tolerable but slightly reduces crispness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive-capable tool with nested params, no annotations, and no output schema, the description covers the guardrail story but leaves notable gaps: return format, assertion-failure behavior, and timeout/blocking semantics. Adequate but not complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all seven parameters are already documented in the schema; baseline is 3. The description adds only a general mention of assertions (listening ports, process liveness, file existence) that the schema already enumerates, so it adds little param-level value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Execute shell command on remote host') and adds distinguishing machinery (3-Tier blast-radius containment, post-flight assertions). It doesn't name a sibling to contrast against (e.g. ssh_exec_background), so it falls short of a 5, but the core purpose is unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implies when it applies by warning that destructive operations are blocked unless confirmed, which tells the agent a confirmDangerToken path exists. However it never says when to prefer this over ssh_exec_background or ssh_task_poll for long-running work, leaving sibling routing to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_exec_backgroundA

Launch long-running command in a detached background subshell (avoids client timeout). Returns a taskId to poll logs and status.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetNoOptional SSH connection target. If omitted, uses default profile (homelab).
commandYesLong-running command (e.g. docker compose build, npm build).
taskTagNoHuman-readable tag prefix for taskId (e.g. "deploy", "cronjob").
workingDirNoRemote working directory.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden and does add real value: it discloses the detached subshell mechanism, the timeout-avoidance rationale, and that a taskId is returned as the handle for later polling. It omits failure/auth behavior and whether logs persist, but the core lifecycle is conveyed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the action and mechanism, then the return contract. No filler; every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a background-exec tool with no output schema and a fully documented nested target schema, the description supplies the key missing piece: the return value (taskId) and its polling purpose. Remaining gaps (error handling, log retention) are minor.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, including the nested target object, so the schema already defines every parameter. The description only references taskId implicitly via polling, adding nothing beyond what the structured fields provide β€” the baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (launch) and resource (long-running command) plus the execution mode (detached background subshell). This implicitly distinguishes it from the synchronous ssh_exec sibling, since an agent knows foreground vs background from the description alone.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"Long-running command" and "avoids client timeout" give a clear condition for selecting this over ssh_exec, and the mention of polling logs/status points toward ssh_task_poll. It stops short of explicitly naming those siblings or stating when NOT to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_host_diagnoseB

Comprehensive host telemetry snapshot in a single round-trip: OS, Kernel, Uptime, Load Avg, RAM, Disk, Docker containers, Listening Ports, and Top Processes.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetNoOptional SSH connection target. If omitted, uses default profile (homelab).

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses a genuine behavioral trait (single round-trip, bundling many reads) and implies a read-only telemetry operation, but never states it is non-destructive, whether it needs sudo for some sections (Docker, ports), or what happens on connection failure. Partial coverage only.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler; the enumerated payload list is dense but each item earns its place by telling the agent what data it will get back. Slightly list-heavy but appropriately sized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and no annotations, the description usefully catalogs the returned data categories, which is its main contribution. However, it omits auth/permission expectations, failure behavior, and confirms nothing about safety for a tool that opens an SSH session to a remote machine.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

One nested parameter with 100% schema description coverage, so the schema already documents host, port, profile, username, password, and privateKeyPath. The description adds nothing about the target/profile resolution beyond what the schema's own descriptions say (default profile 'homelab'). Baseline 3 is correct.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a clear resource (remote host) and enumerates exactly what the snapshot returns: OS, kernel, uptime, load, RAM, disk, Docker, ports, top processes. This distinguishes it from ssh_exec (arbitrary command execution) without naming siblings. Specific and concrete, though it never explicitly contrasts itself with the exec/sftp family.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied rather than stated: 'in a single round-trip' hints that this is preferable to multiple ssh_exec calls when you want a broad host overview. There is no explicit when-to-use, when-not-to-use, or named alternative, so the agent must infer the routing decision.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_key_bootstrapA

1-Click SSH Key Bootstrap: If you only have a VPS password, this tool automatically generates a local SSH key pair, connects via password, securely installs the public key into ~/.ssh/authorized_keys, verifies key-based login, and saves a named profile so you never need to use passwords again.

ParametersJSON Schema
NameRequiredDescriptionDefault
hostYesVPS IP address or domain name.
portNoSSH port (default: 22).
keyNameNoLocal key name (default: "matlock_ed25519").
passwordYesTemporary VPS root or user password.
usernameNoSSH user (default: "root").
profileNameNoName for the saved profile (e.g. "my-vps").

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does a good job: it discloses the workflow, side effects (installing the public key, saving a profile), and prerequisites (password). It lacks details about idempotency, overwrite behavior, failure handling, or security caveats like where the private key is stored.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The definition is a single front-loaded sentence that leads with the tool name and conditional, then lists the actions in order. It is dense but every clause is substantive, with no filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex, six-parameter mutating tool with no annotations and no output schema, the description adequately covers the purpose and end-to-end workflow. It falls short of full completeness by omitting failure modes, security considerations, and what the tool returns after verification.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all six parameters thoroughly. The description only alludes to the saved profile and generated key, adding no parameter syntax or constraints beyond what is already in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (bootstrap) and resource (SSH key) and enumerates the exact steps: generating a local key pair, connecting via password, installing the public key, verifying key login, and saving a profile. It distinguishes itself from execution-oriented siblings by requiring only a VPS password and implying a one-time setup scenario.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a clear condition for use: 'If you only have a VPS password.' This tells the agent exactly when to choose this tool over key-based alternatives, though it never names a sibling tool explicitly or states when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_profile_manageB

List, save, or remove saved SSH host profiles in ~/.matlock/profiles.json.

ParametersJSON Schema
NameRequiredDescriptionDefault
actionYesAction to perform.
profileNoProfile data (required if action is save).
profileNameNoProfile name (required if action is delete).

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full behavioral burden. It discloses the storage location, but for a mutation tool (save/remove) it says nothing about reversibility, side effects, required permissions, or how existing profiles are affected β€” significant gaps for zero annotation coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence that names the operations, the resource, and the persistence location with zero filler. Nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with a nested object parameter, no annotations, and no output schema, the description covers purpose and storage path but omits mutation behavior and result expectations. The schema handles parameter structure, but the behavioral gap keeps it at a minimum-viable level.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the schema already encodes the action enum and the 'required if action is save/delete' conditions for the other parameters. The description adds no syntax or format detail beyond what the schema provides, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific set of verbs (List, save, remove) against a clear resource (saved SSH host profiles) and even names the storage file (~/.matlock/profiles.json). This clearly separates it from execution/transfer siblings, though it doesn't explicitly contrast with any named alternative.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It lists the supported operations but gives no guidance on when to use this over a sibling (e.g., ssh_exec or ssh_key_bootstrap), no prerequisites, and no conditions for choosing an action. The agent is left to infer usage from the enum alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_task_killC

Terminate or signal a running background task by taskId.

ParametersJSON Schema
NameRequiredDescriptionDefault
signalNoTermination signal (default SIGTERM).
targetNoOptional SSH connection target. If omitted, uses default profile (homelab).
taskIdYesThe taskId to terminate.

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It does not say whether termination is irreversible, whether the task record is removed or merely signaled, or what SIGKILL does versus SIGTERM beyond the schema's enum; 'terminate or signal' leaves the lifecycle effect ambiguous.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence with no filler, front-loading the verb and the required identifier. Nothing in it is redundant or padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive lifecycle operation with no annotations and no output schema, the description is thin: it omits irreversibility, the fate of the task after signaling, and whether target is needed only for cross-host tasks. The schema covers parameters but the description does not compensate for the missing safety profile.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, including signal default (SIGTERM), port default (22), and target fallback behavior, so the schema already does the heavy lifting. The description adds nothing beyond what the schema documents, which is the baseline case.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clear specific verb ('Terminate or signal') plus resource ('running background task') and an identifying key ('by taskId'). This is implicitly distinct from siblings like ssh_task_poll (status) and ssh_exec_background (creation), though no sibling is named explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No statement of when to use this versus ssh_task_poll or how to reap the result, and no mention that the task must have been started by ssh_exec_background. The only contextual hint (target omitted β†’ default profile 'homelab') lives in the schema, not the description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_task_pollA

Check status, exit code, and inspect log tail of a background task launched via ssh_exec_background.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetNoOptional SSH connection target. If omitted, uses default profile (homelab).
taskIdYesThe taskId returned by ssh_exec_background.
tailLinesNoNumber of log lines to tail (default 50).

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. "Check" and "inspect" imply a non-destructive read, which is useful, but it does not say whether polling is safe to repeat, whether the task is consumed/cleared, or whether the call blocks – gaps that matter for a no-annotation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler; the resource comes first and the operation list follows efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description does enumerate what is returned (status, exit code, log tail), which is the key missing piece. It does not cover whether the task persists or is cleared after polling, a minor gap given the otherwise complete coverage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, including the nested target object, taskId, and tailLines, so the schema already documents all three parameters. The description adds no format or default detail beyond what the schema provides, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb set (check status, exit code, inspect log tail) against a specific resource (a background task launched via ssh_exec_background). An agent can distinguish this from ssh_exec, ssh_exec_background, and ssh_task_kill without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Clearly ties itself to tasks launched via ssh_exec_background, which gives strong usage context. However, it never states when NOT to use it or names the alternative for stopping a task (ssh_task_kill), so routing guidance is context-rich but not complete.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 12 tool updatesv1.0.0
    • First observedmcp_auto_install
    • First observedsftp_list_dir
    • First observedsftp_read_file
    • First observedsftp_rollback_file
    • First observedsftp_write_safe
    • First observedssh_exec
    • First observedssh_exec_background
    • First observedssh_host_diagnose
    • First observedssh_key_bootstrap
    • First observedssh_profile_manage
    • First observedssh_task_kill
    • First observedssh_task_poll

TDQS

A3.5/5.0

Scored across 12 tools

Disambiguation4/5

Tools are largely distinct by resource and action: foreground vs background execution, task lifecycle, SFTP file operations, diagnostics, profiles, and setup. Minor overlap exists between ssh_profile_manage and ssh_key_bootstrap (both can save profiles), and mcp_auto_install is tangential to remote SSH operations but clearly described.

Naming Consistency4/5

All names use snake_case with consistent resource prefixes (ssh_, sftp_, mcp_). However action ordering varies (ssh_exec vs ssh_task_poll) and mcp_auto_install breaks the prefix-based pattern, so it is not perfectly uniform.

Tool Count5/5

12 tools is well within the ideal range for an SSH remote management server, covering execution, background tasks, file transfer, diagnostics, profile management, and setup without bloat.

Completeness4/5

Core workflows are covered: command exec, background task lifecycle, file read/write/list/rollback, host diagnostics, profile management, key bootstrap, and installer. Missing explicit remote file delete/mkdir/chmod or connection tunneling, but those can be achieved via ssh_exec.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    A
    maintenance
    Enables AI agents to securely execute commands on remote hosts via SSH and SFTP, with persistent shells, file transfers, screenshots, and an audit log.
    4
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI agents to manage remote servers via SSH, including command execution, multi-host batch operations, SFTP file transfer, background job handling, DevOps diagnostics, port tunneling, and safety guardrails like high-risk command blocking and read-only mode.
    MIT
  • A
    license
    A
    quality
    B
    maintenance
    Enables AI agents to securely connect to and manage remote servers via SSH, with tools for running commands, file operations, log inspection, service management, and system monitoring under configurable access controls and audit logging.
    12
    15 npm
    1
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    Enables AI tools to securely inspect remote servers by listing directories, reading configuration files, and performing authorized actions through permission controls, human-in-the-loop approvals, and audit logging. It acts as a bastion that never reveals raw SSH credentials or root passwords to the model.
    1
    MIT