SSH Remote MCP
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@SSH Remote MCPdiagnose my web server and verify nginx is listening on port 80"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
π‘οΈ SSH Remote MCP β Matlock Edition
"Never trust raw command piping. Verify state forensically. Contain the blast radius."
An enterprise-grade Model Context Protocol (MCP) server engineered with Grab's Matlock Agent Mindset for safe, deterministic, and audited remote infrastructure management.
β‘ The Problem with Commodity SSH MCPs
Traditional SSH MCPs treat the remote server like a dumb stdin/stdout pipe:
Blind Execution / Command Injection: Raw multiline scripts and unescaped quotes corrupt remote configuration files or cause hanging heredocs.
Zero Blast-Radius Control: A hallucinated
rm -rf /or recursive permission change runs unconditionally, permanently bricking nodes.No Forensic Verification: Commands returning exit code
0are assumed successful, even when background services fail to bind ports or immediately enter crash loops.Dangerous Remote File Mutations: Overwriting remote files without backup snapshots or unified diff inspection leads to silent data loss.
Session Hanging on Long Tasks: Builds, container pulls, or migrations cause client stdio timeouts.
Related MCP server: ssh-pro-mcp
ποΈ The Matlock Architecture
ββββββββββββββββββββββββββββββββββββββββββ
β AI Agent / Client β
βββββββββββββββββββββ¬βββββββββββββββββββββ
β JSON-RPC (MCP)
βΌ
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β SSH REMOTE MCP β
β β
β βββββββββββββββββββββββββ βββββββββββββββββββββββββββ βββββββββββββββββββββββββββ β
β β 3-Tier Blast Radius β β Forensic Assertion β β Safe SFTP Engine β β
β β Containment β β Engine β β (Atomic + Diff + Roll) β β
β β β β β β β β
β β β’ Tier 1: Safe Read β β β’ Port Listening Verify β β β’ Auto .matlock.bak β β
β β β’ Tier 2: Mutating β β β’ Process Liveness Checkβ β β’ Base64 Safe Transfer β β
β β β’ Tier 3: Block/Gate β β β’ File State Check β β β’ Unified Git Diffs β β
β β (Safety Bypass Tkn) β β β’ HTTP Health Probe β β β’ 1-Click Rollback β β
β βββββββββββββββββββββββββ βββββββββββββββββββββββββββ βββββββββββββββββββββββββββ β
β β
β ββββββββββββββββββββββββββββββββββββ βββββββββββββββββββββββββββββββββββββββββββ β
β β Background Task Envelope β β Multiplexed Session & Profile Store β β
β β (Detached + Poll + Kill) β β (~/.matlock/profiles.json) β β
β ββββββββββββββββββββββββββββββββββββ βββββββββββββββββββββββββββββββββββββββββββ β
ββββββββββββββββββββββββββββββββββββββββββββ¬ββββββββββββββββββββββββββββββββββββββββββββββ
β SSH2 / SFTP Keepalive Pool
βΌ
βββββββββββββββββββββ
β Remote Host β
β (Homelab / Cloud) β
βββββββββββββββββββββπ§° Available Tools (10 Primitives)
1. Command Execution & Telemetry
Tool | Description | Matlock Feature |
| Executes shell commands on remote target. | 3-Tier classification ( |
| Gathers a full forensic host telemetry snapshot. | OS, kernel, uptime, load avg, memory (MB), disk usage, Docker containers, listening ports, top processes in 1 roundtrip. |
2. Long-Running Task Envelope
Tool | Description | Matlock Feature |
| Detaches long tasks into background runner subshells. | Generates task ID, runner script, captures exit codes to disk without hanging MCP stdio. |
| Polls background task status. | Process liveness check, exit code inspection, and real-time log tailing. |
| Signals or terminates background task. | Supports |
3. Safe Atomic SFTP Primitives
Tool | Description | Matlock Feature |
| Reads file content with line slicing. | Line range parameters ( |
| Atomic file write with automatic backup. | Creates |
| Restores modified file from backup. | Atomic restoration from |
| Structured directory file explorer. | Parsed permissions, owner, size, and modification timestamps. |
4. Profile, Key Bootstrap & Credential Isolation
Tool | Description | Matlock Feature |
| Manages saved hosts in | Zero raw private key transmission across MCP parameters; references credentials securely by profile name. |
| 1-Click Password to Key Setup. | Tα»± tαΊ‘o SSH key, kαΊΏt nα»i bαΊ±ng password, inject vΓ o |
| Universal Agent IDE Installer. | CΓ i ΔαΊ·t tα»± Δα»ng |
π 3-Tier Blast Radius Containment
Tier 1 (Safe / Telemetry): Read-only inspection (
ls,cat,df,free,ps,docker ps,ss). Automatically executed.Tier 2 (Mutating): System mutations (
mkdir,systemctl restart,docker compose up -d,apt install). Executed with pre/post flight forensic assertions.Tier 3 (Destructive): High-risk operations (
rm -rf /,mkfs,dd to /dev/sd*,shutdown,reboot,iptables -F,kill -9 1). Interpreted and BLOCKED before transmission unless explicitconfirmDangerToken: trueis supplied.
π 1-Click Universal Auto-Installer (CΓ i tα»± Δα»ng cho mα»i Agent IDE)
ssh-remote-mcp tΓch hợp sαΊ΅n bα» Auto-Installer thΓ΄ng minh, tα»± Δα»ng quΓ©t vΓ cΓ i ΔαΊ·t vΓ o mα»i Agent IDE cΓ³ trΓͺn mΓ‘y tΓnh cα»§a bαΊ‘n (Claude Desktop, VS Code Native MCP, Antigravity, Cursor, Windsurf, Cline, Roo Code, Continue, Zed):
# 1-Click CΓ i ΔαΊ·t tα»± Δα»ng qua NPX (tα»± Δα»ng nhαΊn diα»n IDE vΓ cαΊ₯u hΓ¬nh an toΓ n):
npx github:nguyenquocanhz/ssh-remote-mcp install
# HoαΊ·c cΓ i tα»« local repo:
node dist/index.js install
# Xem danh sΓ‘ch cΓ‘c IDE Δược phΓ‘t hiα»n trΓͺn mΓ‘y:
npx github:nguyenquocanhz/ssh-remote-mcp list
# CΓ i ΔαΊ·t Γ©p buα»c cho tαΊ₯t cαΊ£ IDE (kα» cαΊ£ chΖ°a khα»i tαΊ‘o config):
npx github:nguyenquocanhz/ssh-remote-mcp install --allβ¨ TΓnh nΔng an toΓ n cα»§a Auto-Installer:
KhΓ΄ng ghi ΔΓ¨ dα»― liα»u cΕ©: Giα»― nguyΓͺn 100% cΓ‘c MCP server Δang cΓ³ (
zmp-mcp,unityMCP,...).Tα»± Δα»ng sao lΖ°u: TαΊ‘o file snapshot
.matlock.bak.<timestamp>trΖ°α»c khi chα»nh sα»a.Hα» trợ Δa nα»n tαΊ£ng: Windows, macOS, Linux.
βοΈ CαΊ₯u hΓ¬nh thα»§ cΓ΄ng (Manual Configuration)
NαΊΏu bαΊ‘n muα»n cαΊ₯u hΓ¬nh thα»§ cΓ΄ng vΓ o file config cα»§a IDE:
CΓ‘ch 1: ChαΊ‘y trα»±c tiαΊΏp qua NPX tα»« GitHub:
{
"mcpServers": {
"ssh-remote-mcp": {
"command": "npx",
"args": [
"-y",
"github:nguyenquocanhz/ssh-remote-mcp"
]
}
}
}CΓ‘ch 2: ChαΊ‘y tα»« source code cα»₯c bα»:
cd D:\ssh-remote-mcp
npm install
npm run buildCαΊ₯u hΓ¬nh trong mcp_config.json:
{
"mcpServers": {
"ssh-remote-mcp": {
"command": "node",
"args": [
"D:\\ssh-remote-mcp\\dist\\index.js"
]
}
}
}π§ͺ Verification & Evidence
Run the integrated automated forensic test suite:
node test-matlock.jsVerified against Homelab Node (192.168.100.169):
β
ssh_host_diagnose: OS Ubuntu 24.04.5 LTS, 15 Docker containers detected (zaloapp-backendhealthy on port 8088).β
ssh_exec: Post-flight assertions verified Port 8088 listening andcloudflaredactive.β Blast-Radius: Destructive
rm -rf /blocked by Matlock guardrails.β Safe SFTP: Atomic backup created, unified diff generated, rolled back cleanly.
β Background Envelope: Detached runner script executed
for loop, polled output, and returned exit code 0.
Available Tools
12 toolsmcp_auto_installB
Automatically detect and install/configure ssh-remote-mcp (or any MCP server) into all Agent IDEs on this computer (Claude Desktop, VS Code, Cursor, Windsurf, Antigravity, Cline, Roo Code, Zed, Continue).
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | Installation mode: local node script or global npx (default: local) | |
| dryRun | No | Preview installation without writing changes. | |
| forceAll | No | Force install into all supported IDEs even if directory does not yet exist. | |
| targetIdeIds | No | Optional list of specific IDE IDs to target (e.g. ["claude", "vscode", "cursor", "gemini"]). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It is a mutating tool that writes config into nine different IDEs, yet the description never says whether existing entries are overwritten, backed up, or reversible, whether elevated permissions are needed, or what happens on partial failure. dryRun is only explained by the schema, not by the description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence, front-loaded with the verb and the primary target, with the IDE list as trailing detail. No waste, though the parenthetical aside slightly delays the concrete scope.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutating, multi-target config tool with no annotations and no output schema, the description covers what and where but not the safety profile an agent needs (overwrite/rollback behavior, permissions, side effects). Adequate but with meaningful gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and includes an enum and per-parameter descriptions, so the schema does the heavy lifting (baseline 3). The description adds no format or interaction detail beyond naming target IDEs in its scope sentence.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb pair (detect and install/configure) and a concrete resource (ssh-remote-mcp or any MCP server) and enumerates the target IDEs. This clearly separates it from the ssh_*/sftp_* siblings, which operate on remote hosts, not local IDE configuration. It stops short of describing what configuration changes are actually made, so 5 is not warranted.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Use is implied by the description (run this to wire an MCP server into local IDEs) but there is no explicit when-to-use, when-not, or alternative named. With 11 sibling tools in a different domain, some guidance on prerequisites (e.g. is a running ssh host needed first?) would help.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sftp_list_dirB
List remote directory entries with structured file metadata (type, permissions, owner, size, modified date).
| Name | Required | Description | Default |
|---|---|---|---|
| target | No | Optional SSH connection target. If omitted, uses default profile (homelab). | |
| dirPath | Yes | Absolute remote directory path. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry behavioral context. It discloses that results include structured file metadata, which is useful, but it omits auth requirements, default connection behavior when target is omitted, and any handling of symlinks, hidden files, or errors.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with no wasted words. The metadata list is compact and directly relevant to the tool's output.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The schema fully documents the two parameters and the description names the returned metadata fields, which is helpful given there is no output schema. Still, the description lacks usage guidance and key operational context, leaving it only minimally complete for an SFTP listing tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the nested target object and dirPath are already well documented. The description adds no parameter-level meaning beyond the schema, making the baseline score of 3 appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'List remote directory entries.' It also names the returned metadata fields (type, permissions, owner, size, modified date), which helps distinguish it from file-reading siblings. However, it does not explicitly contrast itself with alternatives such as sftp_read_file.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description offers no when-to-use or when-not-to-use guidance. It does not mention alternatives like sftp_read_file for file contents, nor does it describe prerequisites or selection context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sftp_read_fileB
Safely read remote file with line range slicing (startLine/endLine) and SHA-256 integrity checksum.
| Name | Required | Description | Default |
|---|---|---|---|
| target | No | Optional SSH connection target. If omitted, uses default profile (homelab). | |
| endLine | No | 1-indexed ending line. | |
| filePath | Yes | Absolute remote file path. | |
| maxBytes | No | Max bytes to read. | |
| startLine | No | 1-indexed starting line. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It does disclose two real behavioral traits β the line-range slicing model and SHA-256 integrity verification ('safely') β which are not in the schema. However it omits truncation behavior when maxBytes is hit, encoding assumptions, and error semantics for missing files or auth failure, leaving material gaps for a read tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, front-loaded with the core action, with the differentiating features attached rather than buried. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so the description should at least sketch the return shape; it only implies a checksum is returned. For a 5-param tool with a nested connection target, the absence of any return-value or error-handling detail leaves a moderate gap, though the schema itself is fully described.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so host/port/profile/privateKeyPath/filePath/startLine/endLine/maxBytes are already documented. The description only restates startLine/endLine in parentheses and adds no syntax, ordering, or interaction rules (e.g., how maxBytes interacts with endLine). Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('read remote file') plus its distinctive features (line-range slicing, SHA-256 checksum). It clearly separates itself from write-oriented siblings like sftp_write_safe and sftp_list_dir, though it never names an alternative explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance, no mention of prerequisites, and no routing to alternatives such as sftp_list_dir or sftp_read variants. The agent gets no signal about when this tool is preferred over ssh_exec for reading content.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sftp_rollback_fileC
Instantly rollback a modified remote file to its previous .matlock.bak snapshot.
| Name | Required | Description | Default |
|---|---|---|---|
| target | No | Optional SSH connection target. If omitted, uses default profile (homelab). | |
| filePath | Yes | Absolute remote file path to restore. | |
| backupPath | No | Specific backup file path (if omitted, uses .matlock.bak.latest). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. 'Instantly rollback' implies a mutating, destructive overwrite, but the description never states that the current file contents are replaced (data loss), what happens if no .matlock.bak exists, whether permissions are required, or what the result is. Only the snapshot source is disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler, correctly leading with the action and the target mechanism. It is arguably too terse for a destructive operation, but as a structure/conciseness matter it is efficient and well-ordered.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive rollback tool with a nested SSH target object, no annotations, and no output schema, the description is materially incomplete. It omits overwrite/data-loss semantics, failure behavior when no backup exists, and any relation to the sibling write tool, leaving an agent unequipped to call it safely.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents filePath, backupPath, and the nested SSH target fields; the baseline is 3. The description's mention of the '.matlock.bak snapshot' loosely maps to backupPath but adds no syntax or format detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (rollback) and resource (modified remote file) and names the exact snapshot mechanism (.matlock.bak). It does not explicitly differentiate itself from siblings like sftp_write_safe or sftp_read_file, but the operation is clear enough for an agent to select it.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no explicit when/when-not guidance. It does not say this is meant to undo a prior sftp_write_safe, that a valid snapshot must already exist, or how it relates to the alternative of re-writing the file. Usage must be inferred from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sftp_write_safeA
Safe atomic remote file write: creates automated remote backup (.matlock.bak.), writes atomically, and returns a unified diff patch and SHA-256 hashes.
| Name | Required | Description | Default |
|---|---|---|---|
| target | No | Optional SSH connection target. If omitted, uses default profile (homelab). | |
| content | Yes | Complete content to write into file. | |
| filePath | Yes | Absolute remote file path to write. | |
| createBackup | No | Whether to create .matlock.bak snapshot (default true). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden and does well: it discloses the backup naming scheme (.matlock.bak.<timestamp>), that the write is atomic, and that the response includes a unified diff and SHA-256 hashes. It stops short of stating what happens when an existing backup is present, whether parent directories are created, or required permissions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single dense sentence with the key value proposition ('Safe atomic') front-loaded and the three side effects listed after a colon. Zero filler, though the crammed list is slightly harder to parse than separate clauses would be.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations and no output schema, the description covers the essential traits: it is destructive-ish (overwrites a remote file), it makes a timestamped backup, and it returns diff and SHA-256 evidence. Remaining gaps (error behavior on missing paths, directory permissions) are minor and mostly addressable by the required parameters.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter including the nested target object is already documented, making 3 the baseline. The description's mention of backup creation and diff/hash output loosely relates to createBackup but adds no syntax or format detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('atomic remote file write') and enumerates three concrete behaviors: backup creation, atomic write, and returning a diff plus SHA-256 hashes. It clearly separates this from sftp_read_file, but it never names or contrasts with the closest sibling, sftp_rollback_file, which is the natural pair for this operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The word 'Safe' hints at intent, but there is no explicit when-to-use guidance and no mention of alternatives such as ssh_exec or the relationship to sftp_rollback_file. An agent must infer that it should prefer this over writing a file via ssh_exec, and no exclusions or preconditions are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_execB
Execute shell command on remote host with Matlock 3-Tier blast-radius containment and post-flight state assertions (verifies listening ports, process liveness, file existence). Blocks destructive operations unless confirmed.
| Name | Required | Description | Default |
|---|---|---|---|
| env | No | Optional environment variables to pass into remote process. | |
| target | No | Optional SSH connection target. If omitted, uses default profile (homelab). | |
| command | Yes | The exact shell command to execute. | |
| timeoutMs | No | Timeout in ms (default 60000ms). | |
| assertions | No | Optional forensic post-flight assertions. | |
| workingDir | No | Remote directory to cd into prior to command. | |
| confirmDangerToken | No | Must be true to execute Tier 3 destructive operations (e.g. root rm -rf, reboot, mkfs). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It usefully discloses the containment tiers, destructive-operation blocking, and that assertions run post-flight (ports, processes, files). It omits what happens when a command is blocked or an assertion fails, and says nothing about execution/auth behavior beyond the schema's key-vs-password note.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single dense sentence that front-loads the action and then the safety machinery; no wasted filler. The faintly marketing tone ('Matlock 3-Tier blast-radius') is tolerable but slightly reduces crispness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive-capable tool with nested params, no annotations, and no output schema, the description covers the guardrail story but leaves notable gaps: return format, assertion-failure behavior, and timeout/blocking semantics. Adequate but not complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all seven parameters are already documented in the schema; baseline is 3. The description adds only a general mention of assertions (listening ports, process liveness, file existence) that the schema already enumerates, so it adds little param-level value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Execute shell command on remote host') and adds distinguishing machinery (3-Tier blast-radius containment, post-flight assertions). It doesn't name a sibling to contrast against (e.g. ssh_exec_background), so it falls short of a 5, but the core purpose is unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies when it applies by warning that destructive operations are blocked unless confirmed, which tells the agent a confirmDangerToken path exists. However it never says when to prefer this over ssh_exec_background or ssh_task_poll for long-running work, leaving sibling routing to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_exec_backgroundA
Launch long-running command in a detached background subshell (avoids client timeout). Returns a taskId to poll logs and status.
| Name | Required | Description | Default |
|---|---|---|---|
| target | No | Optional SSH connection target. If omitted, uses default profile (homelab). | |
| command | Yes | Long-running command (e.g. docker compose build, npm build). | |
| taskTag | No | Human-readable tag prefix for taskId (e.g. "deploy", "cronjob"). | |
| workingDir | No | Remote working directory. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden and does add real value: it discloses the detached subshell mechanism, the timeout-avoidance rationale, and that a taskId is returned as the handle for later polling. It omits failure/auth behavior and whether logs persist, but the core lifecycle is conveyed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the action and mechanism, then the return contract. No filler; every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a background-exec tool with no output schema and a fully documented nested target schema, the description supplies the key missing piece: the return value (taskId) and its polling purpose. Remaining gaps (error handling, log retention) are minor.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, including the nested target object, so the schema already defines every parameter. The description only references taskId implicitly via polling, adding nothing beyond what the structured fields provide β the baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (launch) and resource (long-running command) plus the execution mode (detached background subshell). This implicitly distinguishes it from the synchronous ssh_exec sibling, since an agent knows foreground vs background from the description alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"Long-running command" and "avoids client timeout" give a clear condition for selecting this over ssh_exec, and the mention of polling logs/status points toward ssh_task_poll. It stops short of explicitly naming those siblings or stating when NOT to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_host_diagnoseB
Comprehensive host telemetry snapshot in a single round-trip: OS, Kernel, Uptime, Load Avg, RAM, Disk, Docker containers, Listening Ports, and Top Processes.
| Name | Required | Description | Default |
|---|---|---|---|
| target | No | Optional SSH connection target. If omitted, uses default profile (homelab). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses a genuine behavioral trait (single round-trip, bundling many reads) and implies a read-only telemetry operation, but never states it is non-destructive, whether it needs sudo for some sections (Docker, ports), or what happens on connection failure. Partial coverage only.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; the enumerated payload list is dense but each item earns its place by telling the agent what data it will get back. Slightly list-heavy but appropriately sized.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description usefully catalogs the returned data categories, which is its main contribution. However, it omits auth/permission expectations, failure behavior, and confirms nothing about safety for a tool that opens an SSH session to a remote machine.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
One nested parameter with 100% schema description coverage, so the schema already documents host, port, profile, username, password, and privateKeyPath. The description adds nothing about the target/profile resolution beyond what the schema's own descriptions say (default profile 'homelab'). Baseline 3 is correct.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a clear resource (remote host) and enumerates exactly what the snapshot returns: OS, kernel, uptime, load, RAM, disk, Docker, ports, top processes. This distinguishes it from ssh_exec (arbitrary command execution) without naming siblings. Specific and concrete, though it never explicitly contrasts itself with the exec/sftp family.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied rather than stated: 'in a single round-trip' hints that this is preferable to multiple ssh_exec calls when you want a broad host overview. There is no explicit when-to-use, when-not-to-use, or named alternative, so the agent must infer the routing decision.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_key_bootstrapA
1-Click SSH Key Bootstrap: If you only have a VPS password, this tool automatically generates a local SSH key pair, connects via password, securely installs the public key into ~/.ssh/authorized_keys, verifies key-based login, and saves a named profile so you never need to use passwords again.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | VPS IP address or domain name. | |
| port | No | SSH port (default: 22). | |
| keyName | No | Local key name (default: "matlock_ed25519"). | |
| password | Yes | Temporary VPS root or user password. | |
| username | No | SSH user (default: "root"). | |
| profileName | No | Name for the saved profile (e.g. "my-vps"). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does a good job: it discloses the workflow, side effects (installing the public key, saving a profile), and prerequisites (password). It lacks details about idempotency, overwrite behavior, failure handling, or security caveats like where the private key is stored.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The definition is a single front-loaded sentence that leads with the tool name and conditional, then lists the actions in order. It is dense but every clause is substantive, with no filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex, six-parameter mutating tool with no annotations and no output schema, the description adequately covers the purpose and end-to-end workflow. It falls short of full completeness by omitting failure modes, security considerations, and what the tool returns after verification.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all six parameters thoroughly. The description only alludes to the saved profile and generated key, adding no parameter syntax or constraints beyond what is already in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (bootstrap) and resource (SSH key) and enumerates the exact steps: generating a local key pair, connecting via password, installing the public key, verifying key login, and saving a profile. It distinguishes itself from execution-oriented siblings by requiring only a VPS password and implying a one-time setup scenario.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives a clear condition for use: 'If you only have a VPS password.' This tells the agent exactly when to choose this tool over key-based alternatives, though it never names a sibling tool explicitly or states when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_profile_manageB
List, save, or remove saved SSH host profiles in ~/.matlock/profiles.json.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action to perform. | |
| profile | No | Profile data (required if action is save). | |
| profileName | No | Profile name (required if action is delete). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full behavioral burden. It discloses the storage location, but for a mutation tool (save/remove) it says nothing about reversibility, side effects, required permissions, or how existing profiles are affected β significant gaps for zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that names the operations, the resource, and the persistence location with zero filler. Nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with a nested object parameter, no annotations, and no output schema, the description covers purpose and storage path but omits mutation behavior and result expectations. The schema handles parameter structure, but the behavioral gap keeps it at a minimum-viable level.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the schema already encodes the action enum and the 'required if action is save/delete' conditions for the other parameters. The description adds no syntax or format detail beyond what the schema provides, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific set of verbs (List, save, remove) against a clear resource (saved SSH host profiles) and even names the storage file (~/.matlock/profiles.json). This clearly separates it from execution/transfer siblings, though it doesn't explicitly contrast with any named alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It lists the supported operations but gives no guidance on when to use this over a sibling (e.g., ssh_exec or ssh_key_bootstrap), no prerequisites, and no conditions for choosing an action. The agent is left to infer usage from the enum alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_task_killC
Terminate or signal a running background task by taskId.
| Name | Required | Description | Default |
|---|---|---|---|
| signal | No | Termination signal (default SIGTERM). | |
| target | No | Optional SSH connection target. If omitted, uses default profile (homelab). | |
| taskId | Yes | The taskId to terminate. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It does not say whether termination is irreversible, whether the task record is removed or merely signaled, or what SIGKILL does versus SIGTERM beyond the schema's enum; 'terminate or signal' leaves the lifecycle effect ambiguous.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with no filler, front-loading the verb and the required identifier. Nothing in it is redundant or padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive lifecycle operation with no annotations and no output schema, the description is thin: it omits irreversibility, the fate of the task after signaling, and whether target is needed only for cross-host tasks. The schema covers parameters but the description does not compensate for the missing safety profile.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, including signal default (SIGTERM), port default (22), and target fallback behavior, so the schema already does the heavy lifting. The description adds nothing beyond what the schema documents, which is the baseline case.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear specific verb ('Terminate or signal') plus resource ('running background task') and an identifying key ('by taskId'). This is implicitly distinct from siblings like ssh_task_poll (status) and ssh_exec_background (creation), though no sibling is named explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No statement of when to use this versus ssh_task_poll or how to reap the result, and no mention that the task must have been started by ssh_exec_background. The only contextual hint (target omitted β default profile 'homelab') lives in the schema, not the description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_task_pollA
Check status, exit code, and inspect log tail of a background task launched via ssh_exec_background.
| Name | Required | Description | Default |
|---|---|---|---|
| target | No | Optional SSH connection target. If omitted, uses default profile (homelab). | |
| taskId | Yes | The taskId returned by ssh_exec_background. | |
| tailLines | No | Number of log lines to tail (default 50). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. "Check" and "inspect" imply a non-destructive read, which is useful, but it does not say whether polling is safe to repeat, whether the task is consumed/cleared, or whether the call blocks β gaps that matter for a no-annotation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; the resource comes first and the operation list follows efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description does enumerate what is returned (status, exit code, log tail), which is the key missing piece. It does not cover whether the task persists or is cleared after polling, a minor gap given the otherwise complete coverage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, including the nested target object, taskId, and tailLines, so the schema already documents all three parameters. The description adds no format or default detail beyond what the schema provides, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb set (check status, exit code, inspect log tail) against a specific resource (a background task launched via ssh_exec_background). An agent can distinguish this from ssh_exec, ssh_exec_background, and ssh_task_kill without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Clearly ties itself to tasks launched via ssh_exec_background, which gives strong usage context. However, it never states when NOT to use it or names the alternative for stopping a task (ssh_task_kill), so routing guidance is context-rich but not complete.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
12 tool updates
v1.0.0- First observed
mcp_auto_install - First observed
sftp_list_dir - First observed
sftp_read_file - First observed
sftp_rollback_file - First observed
sftp_write_safe - First observed
ssh_exec - First observed
ssh_exec_background - First observed
ssh_host_diagnose - First observed
ssh_key_bootstrap - First observed
ssh_profile_manage - First observed
ssh_task_kill - First observed
ssh_task_poll
TDQS
Scored across 12 tools
Tools are largely distinct by resource and action: foreground vs background execution, task lifecycle, SFTP file operations, diagnostics, profiles, and setup. Minor overlap exists between ssh_profile_manage and ssh_key_bootstrap (both can save profiles), and mcp_auto_install is tangential to remote SSH operations but clearly described.
All names use snake_case with consistent resource prefixes (ssh_, sftp_, mcp_). However action ordering varies (ssh_exec vs ssh_task_poll) and mcp_auto_install breaks the prefix-based pattern, so it is not perfectly uniform.
12 tools is well within the ideal range for an SSH remote management server, covering execution, background tasks, file transfer, diagnostics, profile management, and setup without bloat.
Core workflows are covered: command exec, background task lifecycle, file read/write/list/rollback, host diagnostics, profile management, key bootstrap, and installer. Missing explicit remote file delete/mkdir/chmod or connection tunneling, but those can be achieved via ssh_exec.
Maintenance
Related MCP Connectors
- emisarOAuthdev.emisar
Let AI operate servers without SSH. Choose actions, approve risky changes, and audit every step.
Scoped, audited SSH exec, sessions, and SFTP on your saved servers without exposing credentials
Operate Linux, macOS and Windows from your LLM. Every action runs through an auditable allowlist.
Real Linux labs your AI agent deploys, routes and runs, with domains, TLS, DBs and an audit log.
Related MCP Servers
- AlicenseNot gradedqualityAmaintenanceEnables AI agents to securely execute commands on remote hosts via SSH and SFTP, with persistent shells, file transfers, screenshots, and an audit log.4MIT
- AlicenseNot gradedqualityCmaintenanceEnables AI agents to manage remote servers via SSH, including command execution, multi-host batch operations, SFTP file transfer, background job handling, DevOps diagnostics, port tunneling, and safety guardrails like high-risk command blocking and read-only mode.MIT
- AlicenseAqualityBmaintenanceEnables AI agents to securely connect to and manage remote servers via SSH, with tools for running commands, file operations, log inspection, service management, and system monitoring under configurable access controls and audit logging.1215 npm1MIT
- AlicenseNot gradedqualityAmaintenanceEnables AI tools to securely inspect remote servers by listing directories, reading configuration files, and performing authorized actions through permission controls, human-in-the-loop approvals, and audit logging. It acts as a bastion that never reveals raw SSH credentials or root passwords to the model.1MIT