ssh-mcp is an MCP server that enables AI assistants to securely execute commands and transfer files on remote servers via SSH. It integrates with your existing ~/.ssh/config for connection details.
list_servers: View all configured SSH servers, optionally filtered by group, showing names, groups, and descriptions.
list_groups: View all server groups with their descriptions and member counts.
execute: Run a shell command on a single SSH server with configurable timeout, working directory, and optional bypass of dangerous command detection.
execute_on_group: Run a shell command in parallel across all servers in a group, with fail-fast mode and per-server timeouts.
upload_file: Upload a local file to a remote server via SFTP, with path validation to prevent sensitive file access.
download_file: Download a file from a remote server to a local destination via SFTP, with path validation on both ends.
Security & deployment features include dangerous command detection, automatic credential redaction in logs, connection pooling, host key verification, JSON audit logging, and flexible deployment via stdio or HTTP transport (suitable for Docker/network environments).
Supported as a TLS-terminating reverse proxy option for securing HTTP transport deployments in production environments.
Supports Datadog log integration through JSON log format output, allowing structured logging events to be consumed by Datadog's log aggregation platform.
Provides Docker container deployment options with prebuilt images, volume mounting for SSH configuration, and containerized execution environments.
Hosts the project repository and publishes Docker images to GitHub Container Registry for containerized deployments.
Mentioned as a use case for traffic patterns that influenced HTTP keepalive timeout configuration optimizations.
Supported as a TLS-terminating reverse proxy option for securing HTTP transport deployments in production environments.
Built with Python 3.11+ and provides pip installation options, though this is primarily an implementation detail rather than a target service.
Supports Splunk log integration through JSON log format output, allowing structured logging events to be consumed by Splunk's log aggregation platform.
Uses TOML format for server configuration files, defining server groups, descriptions, and organizational structure for SSH infrastructure.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@ssh-mcp check the disk usage on all servers in the production group"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
SSH MCP server that lets AI assistants execute commands on remote servers.
ssh-mcp is a Model Context Protocol server that gives AI assistants like Claude direct access to your SSH infrastructure. Once configured, Claude can run commands, transfer files, and query server groups across your fleet without leaving the conversation.
Connection details are read from your existing ~/.ssh/config. No credentials are stored in the MCP configuration.
Related MCP server: ssh-mcp-server
Run shell commands on individual servers or across entire groups in parallel
SFTP file upload and download over the existing SSH session
Connection pooling — reuses SSH connections across tool calls
Dangerous command detection — warns before executing destructive operations
Server groups for organizing hosts (production, staging, per-service)
SSH config integration — reads host, port, user, and identity from ~/.ssh/config
Custom config path via SSH_MCP_CONFIG environment variable
dry_run previews — see which server, command, working directory and timeout would be used, without connecting
SFTP local-path confinement — every local path stays inside a configured transfer_root
stdio or streamable-HTTP transport, with bearer-token auth for network deployments
Built-in ssh-mcp healthcheck subcommand for Docker's HEALTHCHECK
Optional OpenTelemetry tracing — the API ships with the MCP SDK; add an SDK and exporter to record anything
# Run directly with uvx (no install required)
uvx blc-ssh-mcp
# Or install with pip
pip install blc-ssh-mcpRequires Python 3.11+. Install uv to use uvx.
The PyPI package is
blc-ssh-mcp, notssh-mcp. The namessh-mcpon PyPI belongs to an unrelated project by a different author. Installing it will not give you this server. Releases before 0.6.1 documented the wrong name — if you followed those instructions, uninstallssh-mcpand installblc-ssh-mcp.
A prebuilt image is published to GitHub Container Registry for linux/amd64 and linux/arm64 (0.8.1 and newer — 0.8.0 and earlier are amd64-only and will not run on Apple Silicon or AWS Graviton):
docker pull ghcr.io/blackaxgit/ssh-mcp:latestOr run with Docker Compose:
services:
ssh-mcp:
image: ghcr.io/blackaxgit/ssh-mcp:latest
stdin_open: true
restart: unless-stopped
environment:
SSH_MCP_CONFIG: /config/servers.toml
volumes:
- ./servers.toml:/config/servers.toml:ro
- ~/.ssh:/home/sshmcp/.ssh:roThe image uses a non-root sshmcp user (uid 1000). Mount your SSH keys and config file read-only. compose.yaml in the repo carries a fuller example — it builds from the local Dockerfile rather than pulling the published image, and includes the HTTP-transport service, ulimits and healthcheck guidance omitted above.
mkdir -p ~/.config/ssh-mcp
cp config/servers.example.toml ~/.config/ssh-mcp/servers.tomlEdit ~/.config/ssh-mcp/servers.toml and add your servers. Server names must match Host entries in ~/.ssh/config.
Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or the equivalent on your platform:
{
"mcpServers": {
"ssh-mcp": {
"command": "uvx",
"args": ["blc-ssh-mcp"]
}
}
}To use a non-default config path, pass the environment variable:
{
"mcpServers": {
"ssh-mcp": {
"command": "uvx",
"args": ["blc-ssh-mcp"],
"env": {
"SSH_MCP_CONFIG": "/path/to/servers.toml"
}
}
}
}Restart Claude Desktop after editing the config.
If you use Claude Code instead of Claude Desktop, you can set everything up from the terminal:
# 1. Add the MCP server
claude mcp add ssh-mcp -- uvx blc-ssh-mcp
# 2. Create the config directory and copy the example
mkdir -p ~/.config/ssh-mcp
curl -sL https://raw.githubusercontent.com/blackaxgit/ssh-mcp/main/config/servers.example.toml \
> ~/.config/ssh-mcp/servers.toml
# 3. Edit with your servers (server names must match ~/.ssh/config Host entries)
${EDITOR:-nano} ~/.config/ssh-mcp/servers.toml
# 4. Restrict permissions
chmod 600 ~/.config/ssh-mcp/servers.tomlTo use a custom config path:
claude mcp add ssh-mcp -e SSH_MCP_CONFIG=/path/to/servers.toml -- uvx blc-ssh-mcpVariable | Default | Purpose |
| — | Absolute path to a TOML config file. Overrides the default search path. |
|
| Log output format. Set to |
|
| MCP transport. |
|
| Bind address for HTTP transport. Binding to any non-localhost value (e.g. |
|
| TCP port for HTTP transport. |
| — | Shared bearer secret. When set, every request must carry |
| — | Path to a file containing the bearer token (alternative to |
|
| Authentication mode. |
| — | Magic-string escape hatch. Must equal literal |
|
| uvicorn |
|
| uvicorn |
|
| uvicorn |
|
| Set to |
| — | Comma-separated extra Host-header values the SDK's DNS-rebinding protection should permit (e.g. |
|
| Directory SFTP transfers are confined to. Takes precedence over |
|
| Honoured when searching for |
|
| Base directory for the default transfer root. |
|
| For local development / CI only. Set to |
fd exhaustion mitigation: the Docker base image inherits a 1024 fd limit by default. Under sustained burst traffic that can run out quickly. Raise it in your compose file:
ssh-mcp:
# ...
ulimits:
nofile:
soft: 65536
hard: 65536Pair that with the SSH_MCP_HTTP_KEEPALIVE_TIMEOUT / SSH_MCP_HTTP_LIMIT_CONCURRENCY knobs above for a full fix.
ssh-mcp exposes the MCP streamable HTTP transport as an alternative to stdio. This lets MCP-aware clients connect over the network instead of launching a subprocess, which is useful for containerized deployments, shared-team servers, or anything that needs to survive a client restart.
WARNING: ssh-mcp serves plain HTTP, not HTTPS. The bearer token is transmitted in cleartext on every request. Deploying on a public IP without a TLS-terminating reverse proxy (Caddy, nginx, Traefik) exposes the token to any network observer — equivalent to publishing a root shell. Always terminate TLS before ssh-mcp reaches the network.
Security first. ssh-mcp runs shell commands on remote servers. Exposing the HTTP endpoint without authentication is equivalent to exposing a root shell. The startup code enforces this:
Binding to 127.0.0.1 / localhost / ::1 without a token is allowed — this matches the single-user workstation model.
Binding to ANY other address without SSH_MCP_HTTP_TOKEN raises RuntimeError at startup and the process exits.
The MCP SDK's DNS-rebinding protection is enabled by default. Remote clients connecting via a hostname must have it listed in SSH_MCP_HTTP_ALLOWED_HOSTS.
Streamable HTTP requests are capped at 4 MiB by the MCP SDK — an oversized request gets HTTP 413 before its JSON is parsed or a session is created. This sits comfortably above max_command_bytes' 1 MiB ceiling, so no operator action is needed.
serverInfo in the MCP initialize response now reports ssh-mcp's own version (previously it reported the SDK's version instead).
Bearer-token comparison uses hmac.compare_digest to prevent timing attacks.
Local loopback (no auth needed):
SSH_MCP_TRANSPORT=http ssh-mcp
# → listening on http://127.0.0.1:8000/mcpContainer deployment with bearer auth:
TOKEN=$(openssl rand -hex 32)
docker run -d \
-p 8000:8000 \
-e SSH_MCP_TRANSPORT=http \
-e SSH_MCP_HTTP_HOST=0.0.0.0 \
-e SSH_MCP_HTTP_TOKEN="$TOKEN" \
-e SSH_MCP_HTTP_STATELESS=true \
-e SSH_MCP_HTTP_ALLOWED_HOSTS='ssh-mcp.internal:*' \
-v ~/.ssh:/home/sshmcp/.ssh:ro \
-v ./servers.toml:/config/servers.toml:ro \
-e SSH_MCP_CONFIG=/config/servers.toml \
ghcr.io/blackaxgit/ssh-mcp:latestClients connect with:
Authorization: Bearer <TOKEN>
Host: ssh-mcp.internalFor stateful sessions (default), MCPServer maintains per-client context across requests. For stateless deployments behind a load balancer, set SSH_MCP_HTTP_STATELESS=true — each request is handled independently with no server-side session.
The Docker image includes a built-in ssh-mcp healthcheck CLI subcommand that
Docker's HEALTHCHECK directive invokes automatically. No inline Python, no
curl, no manual compose surgery required. The subcommand:
Auto-detects the transport via SSH_MCP_TRANSPORT:
stdio mode: verifies the package imports and servers.toml parses
http mode: sends a real MCP initialize JSON-RPC POST and checks for any non-5xx response
Reads the same auth env vars as the server (SSH_MCP_HTTP_TOKEN, SSH_MCP_HTTP_TOKEN_FILE, SSH_MCP_HTTP_AUTH) — never logs the token
Exits 0 if healthy, 1 otherwise
Uses Python stdlib only (no curl/wget dependency)
Applies a 3-second timeout to the HTTP probe. The stdio probe has no timeout of its own and relies on Docker's --timeout=5s (importing the server costs ~0.3s)
Run manually for debugging:
docker exec ssh-mcp ssh-mcp healthcheck && echo "healthy"Check current status:
docker inspect ssh-mcp --format '{{.State.Health.Status}}'To override the baked-in settings in your compose file:
healthcheck:
test: ["CMD", "ssh-mcp", "healthcheck"]
interval: 15s
timeout: 5s
retries: 3
start_period: 10sTracing uses the OpenTelemetry API, which ships as a required dependency of the MCP SDK — there is nothing to opt into at the ssh-mcp layer:
uv pip install opentelemetry-sdk opentelemetry-exporter-otlp # or your exporter of choicessh-mcp's own spans and the MCP SDK's own request-handling spans are both created unconditionally; without an SDK and exporter installed, span creation is a no-op and nothing is recorded or exported.
Spans produced:
mcp.tool.<name> — one per MCP tool call, tagged mcp.tool.name. Exceptions are recorded with StatusCode.ERROR.
ssh.execute, ssh.upload, ssh.download — the SSH/SFTP operation inside the tool call.
Span attributes go through the same credential redaction as the audit log (see Security).
If your reverse proxy (Caddy, nginx, Traefik, Envoy, Cloudflare Access, etc.) already authenticates requests before they reach ssh-mcp, you can disable the built-in bearer middleware with SSH_MCP_HTTP_AUTH=none. This mode is deliberately hard to enable on a public bind — you must also set a verbose acknowledgement env var:
docker run -d \
--network internal \
-e SSH_MCP_TRANSPORT=http \
-e SSH_MCP_HTTP_HOST=0.0.0.0 \
-e SSH_MCP_HTTP_AUTH=none \
-e SSH_MCP_HTTP_NETWORK_NO_AUTH=I_ACCEPT_RCE_RISK \
-e SSH_MCP_HTTP_ALLOWED_HOSTS='ssh-mcp.internal:*' \
-v ~/.ssh:/home/sshmcp/.ssh:ro \
-v ./servers.toml:/config/servers.toml:ro \
-e SSH_MCP_CONFIG=/config/servers.toml \
ghcr.io/blackaxgit/ssh-mcp:latestWARNING: SSH_MCP_HTTP_AUTH=none + SSH_MCP_HTTP_NETWORK_NO_AUTH=I_ACCEPT_RCE_RISK is a remote code execution surface. The magic-string acknowledgement exists so operators physically type the words "I ACCEPT RCE RISK" before opting in. Every tool call reaches a shell on every managed SSH server. Use this only when:
ssh-mcp is on a private Docker network not reachable from the host's public interface, AND
The reverse proxy fronting it enforces authentication (basic auth, OAuth, mTLS, Cloudflare Access, etc.), AND
You have audit logging on the proxy that's immutable to the ssh-mcp process.
For localhost binds without auth, no acknowledgement is needed — that matches the historical stdio deployment model.
Checked in order:
$SSH_MCP_CONFIG environment variable
$XDG_CONFIG_HOME/ssh-mcp/servers.toml, falling back to ~/.config/ssh-mcp/servers.toml (default)
config/servers.toml relative to the package (development only)
Example servers.toml:
[settings]
ssh_config_path = "~/.ssh/config"
command_timeout = 30 # SSH *connect* timeout in seconds, range 1..3600
max_output_bytes = 51200 # truncate captured output at this many bytes, per stream
max_command_bytes = 65536 # reject longer command strings at the tool boundary (1024..1048576)
connection_idle_timeout = 300 # seconds; eviction scan runs every 60s
known_hosts = true # false removes MITM protection
max_parallel_hosts = 10 # process-wide concurrency cap for group execution (1..100)
[groups]
production = { description = "Production servers" }
staging = { description = "Staging servers" }
[servers.web-prod-01]
description = "Production web server"
groups = ["production"]
[servers.web-staging-01]
description = "Staging web server"
groups = ["staging"]
jump_host = "bastion"
[servers.db-prod-01]
description = "Production database"
groups = ["production"]
user = "dbadmin"Note two things about the timeouts, because the names invite confusion:
command_timeout is the SSH connection-establishment timeout, not the command execution timeout.
Per-command timeout comes from the timeout argument of execute / execute_on_group (default 30) — unless the server block sets timeout = N, which wins over the caller's argument.
max_parallel_hosts bounds the whole process, not a single call: the semaphore is built once at startup, so concurrent execute_on_group calls share the same budget rather than each getting their own.
Per-server overrides (hostname, port, user, identity_file, jump_host, default_dir, timeout) take precedence over ~/.ssh/config. See config/servers.example.toml for the annotated reference.
Restrict config file permissions to your user:
chmod 600 ~/.config/ssh-mcp/servers.tomlTool | Description |
| List configured servers; optionally filter by group |
| List server groups with member counts |
| Run a shell command on a single server (supports |
| Run a command on all servers in a group (parallel; supports |
| Upload a file to a server via SFTP. Local path is relative to |
| Download a file from a server via SFTP. Local path is relative to |
dry_run=true on either execute tool returns a [DRY RUN] preview of the server, command, working directory, timeout and force flag without opening a connection. Dangerous-command detection still runs, so a rejection can be previewed; if force=true would bypass a match, the preview carries an explicit ⚠️ DANGEROUS banner.
Command strings longer than max_command_bytes (default 65536 encoded UTF-8 bytes) are rejected at the tool boundary, before redaction or dangerous-command matching runs. Single SFTP transfers are capped at 100 MiB: an oversized upload is refused outright, an oversized download only logs a warning (the bytes are already on disk). Use rsync or scp for anything larger.
Dangerous command blocking. ssh-mcp rejects commands that match known destructive patterns unless the tool caller passes force=true:
Recursive deletes of /, ~, $HOME, $USER — combined (rm -rf /) and split (rm -r -f /, rm --recursive --force /) flag forms, in any flag order
find / -delete, find / -exec rm
Block-device wipes: shred /dev/*, wipefs /dev/*, blkdiscard /dev/*, sgdisk -Z /dev/*
Partition-table destruction: parted /dev/… mklabel, fdisk /dev/sd*
mkfs, dd if=… and the reordered dd of=… if=… form
Redirects into a block device or auth database: > /dev/sd*, > /dev/nvme*, > /dev/hd*, > /etc/{passwd,shadow,gshadow,sudoers}
chmod 777 / — flag before or after the mode (chmod -R 777 /, chmod 777 -R /)
Fork bombs (spaced and adjacent variants)
Payload-execution wrappers: base64 -d | bash|sh|zsh|python|perl|ruby, eval "…", python|python3|perl|ruby -c, bash -c
Host-availability destruction, matched only in command position (string start, after a shell separator, or after sudo/doas): reboot, poweroff, halt, shutdown, init 0|6, telinit 0|6, systemctl reboot|poweroff|halt|kexec, iptables|ip6tables -F|--flush, nft flush ruleset, userdel, passwd -l
Note the payload-execution bullet — it catches ordinary commands too.
bash -c '…',python3 -c '…'andeval …are blocked by default even when entirely benign. Wrap them differently (a script file, a heredoc) or passforce=truefor an audited call. The host-availability bullet is anchored the other way on purpose, so read-only diagnostics likelast rebootorgrep reboot /var/log/messagesare not blocked — the cost of that anchor is thatsudo -n rebootslips past it.
ASCII control characters (null bytes, \x01..\x1f, \x7f) are normalized to spaces before matching, so rm\x00-rf / is caught just like rm -rf /. Line breaks are matched both ways — as whitespace and as the statement separator they are — because rm -rf\n/ needs the first reading and a second line reboot needs the second, where it sits in command position rather than reading as an argument to line one. The regexes are fuzz-tested with Hypothesis on every CI run.
This is a TRIPWIRE, not a security boundary. The regex catches obvious accidents and shortcut destructive commands. It does NOT defend against a motivated attacker:
The base64/
eval/-cwrappers above are matched literally; any rewrite the regex does not spell out (a different decoder, a temp file,sh <<'EOF') gets throughShell hex escapes (
$'\x72\x6d -rf /') are interpreted AFTER regex matchingUnicode homoglyphs (Cyrillic
р, Greekρ) do not match LatinrIndirection via
$(...)and`...`can hide intent — those are not matched at allIf you need real isolation for untrusted tool callers, sandbox at a lower layer: run ssh-mcp inside a container with a restricted SSH config, use
ForceCommandon the managed servers, or auditforce=falseusage via the structured logs. The dangerous-command filter exists to stop LLM accidents and typos, not adversaries.
The bypass is not recorded in the audit log. Audit records carry server, command, exit_code and duration_ms only; force is emitted solely as an OpenTelemetry span attribute (ssh.force), and therefore only when an OpenTelemetry SDK and exporter are configured. The tracing API itself now ships as a required dependency of the MCP SDK, so spans are always created — but with no SDK installed they are no-ops that record nothing. A block is logged as a warning on the operational logger, not the audit logger. If you need a paper trail for bypasses, export traces or withhold force=true at the MCP client. Do not grant force=true to untrusted MCP clients.
Credential redaction in logs. ssh-mcp automatically redacts known credential patterns (MySQL -p<pass>, --password=, PGPASSWORD=, Authorization: Bearer, URL basic-auth user:pass@host, plus any env var ending in _PASSWORD, _SECRET, _TOKEN, _KEY, _CREDENTIAL, _PWD) from audit logs and OTel span attributes before they reach stderr or trace backends. The asyncssh internal channel logger is suppressed to WARNING level so it never emits the raw command.
Known limitation: command OUTPUT is NOT redacted. If you run
cat /etc/mysql/my.cnf,env | grep PASSWORD, orkubectl get secret X -o yaml, the stdout/stderr returned to the MCP client will contain plaintext secrets. The redaction pipeline only filters the COMMAND string (what you asked to run), not the OUTPUT (what it printed). Avoid running commands that print secrets via ssh-mcp — pass credentials through env vars, Docker/K8s secrets, or dedicated config files instead.
{REDACTED+ELIDED}means more than a secret was cut. Redaction replaces from the credential marker to the end of the whitespace-delimited token, so a shell separator inside that token is consumed with it — before 0.8.1,echo --password=X;rebootwas logged asecho --password={REDACTED}and the chained command did not appear in the record at all, though it ran. The secret is still never partially printed; the placeholder changes instead, so the log does not read as a faithful transcript. It errs toward flagging, so a password that merely contains;,|,&, a backtick or$(is flagged too.
Local path confinement (new in 0.6.0; versions ≤ 0.5.6 are affected by the flaw it fixes — see CHANGELOG.md). SFTP upload_file and download_file no longer accept arbitrary absolute local paths. Every local path is relative to a configured transfer root and is resolved one component at a time beneath it, refusing a symbolic link at any component:
[settings]
transfer_root = "~/.local/share/ssh-mcp/transfers" # default; honours $XDG_DATA_HOMEOverride with the SSH_MCP_TRANSFER_ROOT environment variable. The directory is created 0700 on demand, must be owned by the user running ssh-mcp, and must not itself be a symlink — ssh-mcp refuses to start a transfer otherwise.
Consequences, all deliberate:
Absolute local paths and .. are rejected. Sub-directories are allowed, but they must already exist.
Downloads do not overwrite. An existing destination fails rather than being silently replaced. A failed transfer removes its own partial file.
Remote non-regular files (symlinks, devices, FIFOs) are refused on a best-effort basis. SFTP protocol v3 offers no atomic no-follow open, so a remote server that swaps the file between the check and the open can still win that race; the local destination stays confined regardless.
Remote paths keep the existing sensitive-path denylist — a tripwire, not a boundary, matched as a substring after normalizing // and ./ away, case-insensitively. It covers /etc/{shadow,gshadow,passwd,sudoers} and /etc/ssh/ssh_host_*; .ssh/{authorized_keys,id_rsa,id_ed25519,id_ecdsa,id_dsa,identity,config,known_hosts}; .aws/{credentials,config}, .azure/accesstokens.json, .config/gcloud/{credentials,access_tokens}.db; .kube/config, /etc/kubernetes/{admin,kubelet}.conf, /var/lib/kubelet/pki/; .netrc, .pgpass, .git-credentials, .docker/config.json; /proc/{self,<pid>}/{environ,mem,cmdline,maps,stack,status}, /proc/{kcore,kallsyms}; the MySQL / PostgreSQL / MongoDB data directories under /var/lib/; and the Windows SAM / SECURITY hives plus \users\administrator\.ssh\. Public keys are **not** exempt — the old *.pub carve-out was a string check on a caller-supplied name and was removed.
Prior versions validated the caller's path string against a denylist and then handed that string to asyncssh, which resolved it independently — so anything not enumerated was writable. Confinement replaces enumeration: ssh-mcp opens the local file itself and never lets a caller-supplied path reach the SFTP library.
Migrating from ≤ 0.5.x: replace absolute local paths with names relative to transfer_root, or set transfer_root to the directory you were already using. There is no flag to restore the old behaviour.
Host key verification is on by default (known_hosts = true). Disabling StrictHostKeyChecking in ~/.ssh/config weakens MITM protection and should be avoided in production.
Audit logging. Every tool call is logged to stderr with server, command, exit_code, duration_ms, and (for SFTP) byte counts. SFTP operations emit three-stage events: sftp.upload.start → sftp.upload.complete (or sftp.upload.failed), each tagged with a stable connection_id so a single transfer is grep-correlatable.
For production log aggregation, set SSH_MCP_LOG_FORMAT=json to emit single-line JSON events:
{"event": "sftp.upload.complete bytes=4096 duration_ms=183", "level": "info", "timestamp": "2026-04-08T16:00:11.761575Z", "server": "web-prod-01", "operation": "upload", "local_path": "releases/app.tar.gz", "remote_path": "/var/www/release.tar.gz", "connection_id": "web-prod-01-4242-a3f1c9d2"}When running in Docker, capture stderr with docker logs for the audit trail.
For vulnerability reports, see SECURITY.md. Do not open public GitHub issues for security concerns.
git clone https://github.com/blackaxgit/ssh-mcp.git
cd ssh-mcp
uv sync --locked --extra dev
uv run pytest
uv run ruff check src/ tests/See CONTRIBUTING.md for guidelines on making changes and submitting pull requests.
See CHANGELOG.md.
Mozilla Public License 2.0. See LICENSE.
Download a file from a remote server via SFTP.
Args:
server: Server name (e.g. 'pro-dicentra').
remote_path: Path to the remote file — normally absolute, though a
relative path is not rejected, just resolved by the remote SFTP
server against the SSH login directory. Must be a regular file —
symlinks, devices, FIFOs, and other non-regular remote
files are refused. Rejected if it contains .. anywhere or
matches the same sensitive-path denylist upload_file enforces.
Size is NOT capped here (upload's 100 MiB limit has no download
counterpart) — an oversized transfer only logs a warning, after
the bytes are already on disk.
local_path: Destination path, RELATIVE to the configured
transfer_root (see [settings] in servers.toml, or the
SSH_MCP_TRANSFER_ROOT environment variable). Absolute
paths, .., . components and embedded NUL bytes are
rejected, as is a symlink at any component of the path.
Sub-directories are allowed,
but every intermediate directory must already exist under
transfer_root. NO-CLOBBER: if a file already exists at
the destination, the download fails rather than silently
overwriting it — remove or rename the existing file first.
A failed or cancelled download unlinks the partial file it
created, so a retry is not blocked by its own leftovers.
Returns: Confirmation message with file size.
| Name | Required | Description | Default |
|---|---|---|---|
| server | Yes | ||
| local_path | Yes | ||
| remote_path | Yes |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, but the description thoroughly discloses side effects: no-clobber behavior, unlink of partial files on failure/cancellation, rejection of symlinks and sensitive paths, and path validation. This gives full transparency about what the tool will and will not do.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is lengthy but every sentence adds essential detail about path handling, security, and failure semantics. It is well-structured with clear parameter labels and a concise Returns section, avoiding redundancy and staying focused on actionable information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complete absence of annotations and schema-level descriptions, the tool description provides all necessary context: parameters, constraints, side effects, and return value. An agent can safely and correctly invoke this tool based solely on the description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite the input schema having no descriptions (0% coverage), the description text fully explains each parameter: server, remote_path, and local_path, including their path constraints, security restrictions, and behavior (e.g., no-clobber). This effectively compensates for the schema's lack of descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('Download a file from a remote server via SFTP') and resource (file). It is distinguishable from sibling tools like upload_file and execute, as it focuses specifically on downloading a single file.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The usage scenario is implied by the purpose and the detailed constraints (e.g., path rules, no-clobber, partial file cleanup). It does not explicitly contrast with alternatives, but the unambiguous operation and constraints make the appropriate usage clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Execute a shell command on a single SSH server.
Args:
server: Server name (e.g. 'web-prod-01'). Must match a configured server.
Use list_servers to see available servers.
command: Shell command to execute on the remote server (exactly as it
would be typed at a bash prompt). Rejected if it exceeds
max_command_bytes (default 65536 encoded UTF-8 bytes).
timeout: Command timeout in seconds. Default 30. Not range-checked,
and NOT authoritative: a timeout set on the server's entry
in servers.toml overrides this argument outright, so a
per-server 30 wins over a caller-supplied 600.
working_dir: Absolute remote directory to cd into before running the
command. Uses the server's default_dir from servers.toml
if omitted, or the SSH login directory if neither is set.
force: If True, bypass the dangerous-command detection patterns. Use
only for audited bulk operations. The block list is ~25 regexes
and is broader than "obviously destructive": besides rm -rf /,
mkfs, dd-to-disk, chmod 777 /, redirects into /dev/sd* and
/etc/{passwd,shadow,gshadow,sudoers}, find -delete / -exec rm,
shred / wipefs / blkdiscard / sgdisk on /dev/, partition-table
edits, and fork bombs, it also rejects ordinary interpreter
wrappers — bash -c ..., python3 -c ... (also perl/ruby
-c/-e), eval "...", and base64 -d | sh. Harmless
commands in those forms need force=True too. Default False.
dry_run: If True, do NOT connect or execute. Return a preview describing
what would run (server, command, working_dir, timeout, force).
Dangerous-command detection still runs so rejection can be
previewed. Useful for LLM plans that want to validate intent
before committing. Default False.
Returns:
Formatted command execution result with stdout, stderr, and exit code.
Long output is truncated at max_output_bytes (default 50 KiB) PER
STREAM — stdout and stderr get independent budgets, so the combined
worst case is 2x that setting. A truncated stream ends with
[... output truncated at N bytes], and hitting the cap TERMINATES
the remote process rather than letting it keep writing.
| Name | Required | Description | Default |
|---|---|---|---|
| force | No | ||
| server | Yes | ||
| command | Yes | ||
| dry_run | No | ||
| timeout | No | ||
| working_dir | No |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and succeeds. It discloses dangerous-command detection and force bypass behavior, timeout override from servers.toml, dry_run's no-execution preview behavior, per-stream output truncation limits, and that hitting the output cap terminates the remote process. These are non-obvious behaviors essential for safe invocation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long, but it is well-structured with Args and Returns sections, and the one-sentence purpose is front-loaded. The detailed force list and timeout caveats are high-value for a command-execution tool where the agent could otherwise invoke it incorrectly; no section is redundant with the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex 6-parameter tool with no annotations, the description is complete: it covers server discovery, command size limits, defaulting behavior, dangerous-command safety, dry-run behavior, output truncation, and process termination. The Returns section also explains what the agent can expect clearly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description documents every parameter with meaning beyond the schema: server must match a configured entry, command size limits, timeout precedence semantics, working_dir fallbacks, force safety implications, and dry_run preview behavior. It fully compensates for the schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening sentence uses a specific verb ('Execute') with a resource ('shell command') and scope ('single SSH server'), immediately distinguishing this tool from sibling execute_on_group. The parameter documentation further clarifies that server must be a configured server name discoverable via list_servers.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: use this for a single SSH server, and tells the agent to call list_servers to discover valid server names. It stops just short of explicitly saying 'for multiple servers, use execute_on_group instead', so it lacks a fully explicit alternative statement.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Execute a shell command on all servers in a group in parallel.
Concurrency is capped by the max_parallel_hosts setting (default 10;
configure in [settings] of servers.toml, range 1–100). The semaphore is
PROCESS-WIDE, not per call: concurrent execute_on_group calls share the same
slots and therefore serialise against each other for their share of them.
Args:
group: Group name (e.g. 'production', 'web'). Use list_groups to see
available groups.
command: Shell command to execute on every server in the group.
Rejected if it exceeds max_command_bytes (default 65536
encoded UTF-8 bytes).
timeout: Per-server command timeout in seconds. Default 30. Not
range-checked, and overridden per server by a timeout set
on that server's entry in servers.toml.
Each server has its own timer; slow servers do NOT extend the
per-server limit for others.
working_dir: Absolute remote directory to cd into on each server.
Uses each server's default_dir if omitted.
fail_fast: If True, cancel remaining tasks as soon as any server
returns a non-zero exit code or errors. Default False —
run all servers to completion and report each result.
force: If True, bypass the dangerous-command detection patterns. Use
only for audited bulk operations. The same broad block list
described under execute applies here — including plain
bash -c / python3 -c / eval wrappers. Default False.
dry_run: If True, do NOT connect or execute anywhere. Return a
per-server preview describing what would run. Dangerous-
command detection still applies. Useful for previewing
fleet-wide rollouts before committing. Default False.
Returns: Formatted summary showing per-server results, success/failure counts, and aggregate exit status.
| Name | Required | Description | Default |
|---|---|---|---|
| force | No | ||
| group | Yes | ||
| command | Yes | ||
| dry_run | No | ||
| timeout | No | ||
| fail_fast | No | ||
| working_dir | No |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral burden and does so thoroughly. It discloses parallel execution, the process-wide concurrency semaphore, per-server timeout independence, fail_fast semantics, dangerous-command detection, and dry_run's no-connect guarantee. This gives the agent a strong model of side effects and resource behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose and the most important concurrency behavior, then organized into clean Args and Returns sections. It is long, but every sentence adds operational value, and the structure makes the details scannable for an agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity — 7 parameters, fleet-wide parallel execution, failure modes, and safety controls — the description is complete. It covers behavior, defaults, parameter semantics, edge cases like serializer sharing, and the return format, leaving no significant operational gap for the agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must fully explain all 7 parameters, and it does. Every parameter receives its own Args entry with default values, constraints, and behavioral nuance, such as max_command_bytes for command, per-server timeout overrides, and force bypassing dangerous-command detection.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Execute a shell command on all servers in a group in parallel.' This clearly distinguishes it from the sibling 'execute' tool, which presumably targets a single server, and it orients the agent immediately to the group-scoped behavior.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: commands run fleet-wide across a group, and it points to list_groups to discover valid group names. It also explains when dry_run is useful for previewing rollouts. However, it does not explicitly state when to prefer this tool over the sibling 'execute' tool or when not to use it, so it stops short of fully explicit usage routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List all server groups with descriptions and member counts.
Returns: Formatted table of groups with name, description, and server count.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the return format ('Formatted table') and what columns to expect, which is helpful. However, it doesn't mention important behavioral aspects like whether this requires authentication, has rate limits, returns all groups at once or uses pagination, or if there are any access restrictions. The description adds some value but leaves significant gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately concise with two clear sentences. The first sentence states the core functionality, and the second describes the return format. There's no wasted text, though the structure could be slightly improved by combining the two sentences more fluidly or adding a brief introductory phrase.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has zero parameters, 100% schema coverage, and an output schema exists, the description is reasonably complete for a simple read operation. However, with no annotations and a read operation that likely has behavioral considerations (authentication, data scope, etc.), the description should ideally mention at least basic context about access or limitations. The output schema will handle return structure details, but behavioral transparency remains a gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters (schema coverage 100%), so the description doesn't need to explain parameters. The baseline for zero parameters is 4, as there's no parameter documentation burden. The description appropriately focuses on what the tool does rather than parameter details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('List') and resource ('server groups'), including what information is returned (descriptions and member counts). It distinguishes from sibling 'list_servers' by focusing on groups rather than individual servers. However, it doesn't explicitly differentiate from other potential group-related operations that might exist in the future.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. While it implicitly suggests this is for viewing group information rather than executing operations (like 'execute_on_group'), there are no explicit when/when-not instructions or references to sibling tools. The agent must infer usage context from the tool name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List all configured SSH servers with their groups and descriptions.
Args: group: Optional group name to filter by. Shows all servers if omitted. Use list_groups to see available group names.
Returns:
Formatted table of servers with name, groups, and description. An
unknown group is reported as a plain "Error: ..." string
rather than raised as a tool error, and a group with no members
returns "No servers found in group '<name>'".
| Name | Required | Description | Default |
|---|---|---|---|
| group | No |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description transparently details the return format as a formatted table and documents both error behavior for unknown groups and the message for empty results. Even without annotations, the outcome is clearly described.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured, with clear sections for purpose, argument, and return behavior. No unnecessary information is included.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description provides all necessary context for calling the tool: what it returns, how the parameter behaves, and how errors are surfaced. It is complete even without relying on the output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although the schema itself has no description, the tool description fully explains the only parameter: group is optional, filters by group name, and omitting it shows all servers. This fully compensates for the schema coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists all configured SSH servers along with their groups and descriptions. The scope is specific and the verb 'list' accurately conveys the read-only nature.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains how to use the optional group filter and points to list_groups for valid group names, but it does not explicitly contrast when to use this tool versus the sibling execution or file-transfer tools. Some inference is required to determine the appropriate context among the alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Upload a file to a remote server via SFTP.
Files larger than 100 MiB are refused outright — use rsync or scp for those.
Args:
server: Server name (e.g. 'pro-dicentra').
local_path: Path to the local file, RELATIVE to the configured
transfer_root (see [settings] in servers.toml, or the
SSH_MCP_TRANSFER_ROOT environment variable). Absolute
paths, .., . components and embedded NUL bytes are
rejected, as is a symlink at ANY component of the path.
Sub-directories are allowed (e.g. 'reports/q1.csv'),
but every intermediate
directory must already exist under transfer_root —
upload_file does not create them. transfer_root itself must
be a real directory owned by the running user with mode 0700,
or every transfer fails.
remote_path: Destination path on the remote server — normally absolute,
though a relative path is not rejected, just resolved by the
remote SFTP server against the SSH login directory. Rejected if
it contains .. anywhere (even inside an otherwise legitimate
filename) or matches the sensitive-path denylist
(/etc/shadow, /etc/passwd, .ssh/*,
.aws/credentials, .kube/config, .netrc, …). An
existing REGULAR file at the destination is silently
OVERWRITTEN — unlike download_file, upload does not no-clobber;
an existing non-regular target (symlink, device, FIFO) is
refused.
Returns: Confirmation message with file size.
| Name | Required | Description | Default |
|---|---|---|---|
| server | Yes | ||
| local_path | Yes | ||
| remote_path | Yes |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Despite no annotations, the description fully discloses side effects: silent overwrite of regular files, refusal of non-regular targets, rejection of symlinks, NUL bytes, and denylisted paths, as well as the exact return message.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with Args and Returns sections. Every sentence adds meaningful constraints or behavior details; no fluff or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description includes return behavior, error scenarios, and path resolution rules. Combined with the presence of an output schema (implied by 'Has output schema: true'), the agent has complete information to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although the input schema has no property descriptions, the tool description covers all three parameters (server, local_path, remote_path) with detailed constraints and examples, fully compensating for the schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose ('Upload a file to a remote server via SFTP') and distinguishes it from siblings by contrasting overwrite behavior with download_file and recommending rsync/scp for large files.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use alternatives (files >100 MiB → rsync/scp), and details preconditions (transfer_root existing, directories must already exist) and path restrictions, leaving no ambiguity about appropriate usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.1.1execute1 field changedInput schema / properties / dry_runAdded value: +{
+ "default": false,
+ "title": "Dry Run",
+ "type": "boolean"
+}execute_on_group2 fields changedInput schema / properties / dry_runAdded value: +{
+ "default": false,
+ "title": "Dry Run",
+ "type": "boolean"
+}Input schema / properties / forceAdded value: +{
+ "default": false,
+ "title": "Force",
+ "type": "boolean"
+}v0.1.0download_fileexecuteexecute_on_grouplist_groupslist_serversupload_fileScored across 6 tools
Every tool has a clearly distinct purpose: execute targets one host, execute_on_group targets a fleet, list_servers/list_groups cover inventory, and upload_file/download_file cover file transfer. The only superficially similar pair, execute and execute_on_group, is explicitly differentiated by scope and arguments.
Most tools follow a verb_noun snake_case pattern (list_servers, upload_file, download_file), but execute is a bare verb and execute_on_group uses a prepositional modifier. The naming is still predictable and readable despite these minor deviations.
Six tools is well-scoped for an SSH MCP server: single-host execution, group execution, server/group discovery, and bidirectional file transfer. Nothing feels redundant or missing enough to warrant a lower score.
Core SSH workflows are covered: inventory, single-host and group command execution, and upload/download. The main gap is that there is no group-level file transfer counterpart to execute_on_group, but agents can work around it by looping over servers.
Let AI operate servers without SSH. Choose actions, approve risky changes, and audit every step.
Scoped, audited SSH exec, sessions, and SFTP on your saved servers without exposing credentials
Operate Linux, macOS and Windows from your LLM. Every action runs through an auditable allowlist.
Plan Salesforce deploys, open pull requests and trigger pipelines from your AI client.
