Skip to main content
Glama
nqmn

SSH Remote MCP Server

by nqmn

adremote-mcp

MCP server for safe remote SSH operations with plan approval, audit log, and credential management.

Quick Start

Use a virtual environment created by the same OS that will launch the MCP server. Do not share one venv between Windows and WSL/Linux.

Windows

irm https://raw.githubusercontent.com/nqmn/adremote-mcp/main/install.ps1 | iex

The installer clones the repo into %USERPROFILE%\adremote-mcp, creates .venv-win, and prints the exact paths to paste into your MCP config.

To install into a custom directory:

& ([scriptblock]::Create((irm https://raw.githubusercontent.com/nqmn/adremote-mcp/main/install.ps1))) -InstallDir "C:\tools\adremote-mcp"

WSL / Linux

curl -fsSL https://raw.githubusercontent.com/nqmn/adremote-mcp/main/install.sh | bash

The installer clones the repo into ~/adremote-mcp, creates .venv-linux, and prints the exact paths to paste into your MCP config.

To install into a custom directory:

ADREMOTE_DIR=/opt/adremote-mcp curl -fsSL https://raw.githubusercontent.com/nqmn/adremote-mcp/main/install.sh | bash

Already cloned the repo?

Run the installer directly from the repo root — it detects ssh_mcp_server.py and installs in place:

.\install.ps1          # Windows
./install.sh           # WSL/Linux

MCP config (after install)

The installer prints the exact paths. General form:

{
  "mcpServers": {
    "ssh-remote": {
      "command": "/home/user/adremote-mcp/.venv-linux/bin/python",
      "args": ["/home/user/adremote-mcp/ssh_mcp_server.py"]
    }
  }
}

Windows example:

{
  "mcpServers": {
    "ssh-remote": {
      "command": "C:\\Users\\YourName\\adremote-mcp\\.venv-win\\Scripts\\python.exe",
      "args": ["C:\\Users\\YourName\\adremote-mcp\\ssh_mcp_server.py"]
    }
  }
}

config.json runtime behavior

You can place a config.json file beside ssh_mcp_server.py to control whether plan approval is required for tools that normally create approval-backed plans automatically.

{
  "auto-mode": "disabled"
}

Modes:

  • disabled: current behavior. ssh_execute, ssh_upload_file, and ssh_setup_key_auth create a plan and wait for approval when they would normally require one.

  • enabled: bypass the approval prompt. Those same tools auto-approve their internal plan and execute immediately.

Tools that are explicitly plan-oriented, such as ssh_plan_command and ssh_plan_edit, still return a stored plan because they are manual review tools by design.

Portable Launchers

You can also point an MCP client at the included launcher for the matching OS:

  • Windows: <install-dir>\run-ssh-mcp.cmd

  • WSL/Linux: <install-dir>/run-ssh-mcp.sh

The launchers prefer the OS-specific venv and then fall back to python3 or python. On Windows, SSH_MCP_PYTHON can be set to force a specific Python interpreter.

For WSL/Linux clients, use command: "/bin/sh" with args: ["/path/to/adremote-mcp/run-ssh-mcp.sh"] if the script is not marked executable.

Direct Run

After installing dependencies, you can run the server directly:

Windows:

.\.venv-win\Scripts\python.exe .\ssh_mcp_server.py

WSL/Linux:

./.venv-linux/bin/python ssh_mcp_server.py

Automatic Setup

Download this repo, run Claude or Codex, and ask it to add this folder as a global MCP server for your current OS. After that, you can use it directly from chat.

Troubleshooting

If Windows reports:

No Python at '"/usr/bin\python.exe'

the MCP is pointing at a venv created by WSL/Linux. Create a Windows venv with .\install.ps1 and update the MCP command to .venv-win\Scripts\python.exe.

Related MCP server: MCP SSH Server

Features

  • Works with MCP-compatible clients on Windows and Linux

  • Connect to remote servers via SSH

  • Native SSH jump-host / bastion support

  • Direct execution for simple read-only commands such as ls, pwd, and whoami

  • Plan-and-approve flow for non-trivial commands and remote file edits

  • Full plan details shown immediately on creation — no extra lookup needed

  • Read remote files and apply managed remote edits with verification and backups

  • Upload/download files via SFTP

  • Manage multiple connections

  • Health monitoring

  • Human-readable audit log via ssh_read_audit_log

Usage Examples

Connect with password:

Connect to 192.168.1.100 with username ubuntu and password mypass

or in shorter form:

ssh 192.168.1.100:22 ubuntu mypass

The MCP first tests the SSH connection with your username and password. If the login works, it generates or installs an SSH key, saves the key-based credential locally, and does not save the password. The password is only used the first time.

Connect with password for a one-off session:

ssh 192.168.1.100:22 ubuntu mypass, save_credentials false

This keeps the live connection only. No reusable credential is saved and no automatic key bootstrap is attempted.

Connect later using the saved name:

ssh saved-name

After the first successful setup, just use the saved credential name to connect again.

Managed SSH key bootstrap:

ssh_setup_key_auth no longer installs a key immediately. It now creates a high-risk plan because it modifies remote authorized_keys and stores a local credential. Review and approve that plan with:

  • ssh_setup_key_auth

  • ssh_approve_plan

  • ssh_execute_plan

Connect with an encrypted (passphrase-protected) private key:

Connect to 10.0.2.15 as ubuntu using private key ~/.ssh/id_ed25519 with passphrase mysecret

or via tool parameters:

{
  "hostname": "10.0.2.15",
  "username": "ubuntu",
  "private_key_path": "~/.ssh/id_ed25519",
  "private_key_passphrase": "mysecret"
}

The passphrase is stored alongside the saved credential so future calls to ssh_connect_saved do not require it again. You can still supply private_key_passphrase on ssh_connect_saved to override the stored value for a single session.

Connect through a jump host:

Use the jump_host object on ssh_connect or ssh_save_credentials:

{
  "hostname": "10.0.2.15",
  "username": "ubuntu",
  "private_key_path": "~/.ssh/id_ed25519",
  "jump_host": {
    "hostname": "203.0.113.10",
    "username": "bastion",
    "private_key_path": "~/.ssh/id_ed25519",
    "port": 22
  }
}

Jump host keys can also be passphrase-protected — add private_key_passphrase inside the jump_host object.

This uses a native SSH tunnel to the target host and saved credentials retain the same jump-host configuration. For reusable saved credentials, the jump host must use private_key_path rather than a password.

Execute commands:

Run `ls` in /home on the remote server
Run `pwd` on the remote server
Run `whoami` on the remote server

Simple read-only commands from the allowlist execute directly. Commands outside that allowlist are blocked from direct execution and returned as plans that must be reviewed and approved before they run.

Plans are stored locally so they survive MCP server restarts. Each plan expires after 24 hours; expired plans must be recreated.

Use ssh_get_plan to retrieve the full stored plan body, including payload and approval metadata, when the chat output no longer shows it.

Each stored plan also keeps a compact approval summary with:

  • tool

  • target

  • action

  • summary

  • plan id

Clients can use that summary directly for permission prompts without fetching the full plan body every time.

Managed command plans:

Use these tools for commands outside the direct allowlist:

  • ssh_plan_command

  • ssh_approve_plan

  • ssh_execute_plan

  • ssh_list_plans

  • ssh_get_plan

  • ssh_reject_plan

Typical flow:

  1. Create a command plan with ssh_plan_command

  2. Review the returned risk and rollback details

  3. Approve it with ssh_approve_plan

  4. Execute it with ssh_execute_plan

Remote file reads and edits:

Read a remote file directly:

Read /etc/nginx/nginx.conf on the server

For remote edits, use the managed edit lane:

  • ssh_read_file

  • ssh_plan_edit

  • ssh_approve_plan

  • ssh_execute_plan

ssh_plan_edit stores the current file hash, requires approval, and ssh_execute_plan writes the new content only after approval. Before writing, the server creates a timestamped .ssh-mcp.bak.<timestamp> backup and verifies the post-write SHA256 hash.

File transfers:

Upload local file.txt to /home/user/ on the server
Download /var/log/app.log from the server

ssh_upload_file now creates an approval-backed plan before writing to the remote host. After approval, ssh_execute_plan uploads the file and verifies the remote SHA256 hash. ssh_download_file remains a direct read path to local allowed roots.

Audit log:

Show me the audit log
Show last 10 audit events
Show only approved plans in the audit log

Use ssh_read_audit_log to view a human-readable history of all plan lifecycle events. Each entry shows the timestamp, event type, plan ID, kind, connection, risk level, and summary. Use limit to cap the number of entries and event_filter to narrow by event type (plan_created, plan_approved, plan_rejected, plan_executed, plan_expired).

Connection health and inventory:

Check health of all SSH connections
Show me all active SSH connections

Requirements

  • Python 3.10+

  • paramiko

  • mcp

Latest Update

Version 1.2.0 improves plan visibility and adds a readable audit log tool:

  • All plan-creating tools (ssh_execute, ssh_plan_command, ssh_plan_edit, ssh_upload_file, ssh_setup_key_auth) now return full plan details including risk, rollback plan, and payload immediately on creation — no need to call ssh_get_plan separately

  • New ssh_read_audit_log tool reads .ssh_mcp_audit.jsonl and formats it into a human-readable event history with timestamps, event labels, and extra context per entry

  • ssh_read_audit_log supports limit (number of recent entries) and event_filter (narrow by event type)

Version 1.1.0 adds orchestration for non-trivial remote actions:

  • ssh_execute now runs only a conservative allowlist of simple read-only commands directly

  • Commands outside the allowlist are converted into plans that require approval before execution

  • New tools support managed remote reads and edits: ssh_read_file, ssh_plan_edit, ssh_approve_plan, ssh_execute_plan, ssh_list_plans, and ssh_reject_plan

  • ssh_setup_key_auth now creates an approval-backed plan before modifying remote authorized_keys or saving a credential

  • ssh_upload_file now creates an approval-backed plan before writing a file to the remote host

  • Approval-backed plans are now persisted locally and expire after 24 hours

  • Audit events are appended to .ssh_mcp_audit.jsonl in the current workspace folder

  • Each plan now stores a compact approval summary for low-token permission prompts

  • Managed remote edits create a timestamped backup and verify the resulting file hash after writing

Version 1.0.3 persists the private key passphrase in saved credentials:

  • private_key_passphrase is now stored in the credential file when saving via ssh_connect or ssh_save_credentials

  • ssh_connect_saved uses the stored passphrase automatically — no need to supply it on every call

  • Supplying private_key_passphrase on ssh_connect_saved overrides the stored value for that session only

  • ssh_list_saved_credentials shows private key (passphrase saved) when a passphrase is stored

Version 1.0.2 adds support for passphrase-protected (encrypted) private keys:

  • private_key_passphrase accepted on ssh_connect, ssh_connect_saved, and ssh_save_credentials

  • Applies to both the target host key and the jump host key

  • Clear error messages when a key is encrypted but no passphrase is supplied, or when the passphrase is wrong

Version 1.0.1 adds safer and more practical day-to-day SSH workflows:

  • Direct logins still save reusable credentials by default, but save_credentials=false now cleanly opts out for password sessions too

  • Saved credential flows now include connect, save, list, delete, and manual key setup helpers

  • Host trust and file transfer rules are stricter, with local root restrictions and trust-on-first-use host pinning

  • Native jump-host connections are supported for both live sessions and saved credentials

  • Saved credentials are key-based, so no master password is required for normal use

  • Manually saved private key paths are validated when you save them, not later on first connect

Support

Available Tools

12 tools
ssh_connectA

Connect to a remote Ubuntu server via SSH

ParametersJSON Schema
NameRequiredDescriptionDefault
hostnameNoRemote server hostname or IP address
usernameNoSSH username
passwordNoSSH password for first-time bootstrap when no private key is available
private_key_pathNoPath to private key file (optional)
portNoSSH port (default: 22)
connection_nameNoName for this connection (default: hostname)
known_hosts_pathNoOptional path to a known_hosts file to trust in addition to system host keys
trust_unknown_hostNoAllow connecting to hosts not present in known_hosts. Defaults to false.
saved_credential_nameNoLoad connection details from a saved local credential entry
save_credentialsNoPersist a reusable local credential after a successful connect. Defaults to true for direct logins with password or private key. Password logins are converted into saved key-based credentials.
credential_nameNoName to use when saving credentials locally. Defaults to connection_name or hostname.
jump_hostNoOptional SSH jump host (bastion) used to reach the target via native SSH tunneling

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden for behavioral disclosure. It mentions bootstrap password usage, credential saving behavior (conversion to key-based), and trust_unknown_host details. However, it doesn't describe what happens on failure or session management beyond connection, so 4.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, which is concise, but it lacks structure for the 12-parameter complexity. Important behavioral details (like credential saving) are not front-loaded. A longer description with structured details would be more helpful, so 3.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (12 params, nested objects, no output schema), the description is incomplete. It doesn't explain return values or connection lifetime. Annotations are absent. The description covers purpose and some behavior but misses key context about success/failure indicators.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description adds value by explaining the purpose of password (first-time bootstrap) and save_credentials behavior (conversion to key-based), which goes beyond schema. Nested jump_host adds complexity, but the description references it indirectly. Score 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Connect') and the resource ('remote Ubuntu server via SSH'), with the verb+resource pattern. It distinguishes from siblings like ssh_execute or ssh_download_file but doesn't explicitly differentiate from ssh_connect_saved, so 4.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool vs alternatives like ssh_connect_saved or ssh_setup_key_auth. The presence of many sibling tools suggests a need for usage context, yet the description only states the basic purpose. A 3 reflects the minimal viable guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_connect_savedB

Connect to a remote server using a saved local SSH credential name

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesSaved credential name to use for the connection
connection_nameNoOptional active connection name override

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must convey behavioral traits. It describes the action (connect) and input (saved credential name), but does not disclose what happens if credentials are invalid, whether a new connection is created or reused, or any side effects. Adequate but missing details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that directly states the purpose. It is concise and front-loaded, but omits necessary behavioral and usage details that could be added without making it verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 2 parameters, no output schema, and no annotations, the description is serviceable but lacks information on return behavior, connection state changes, and error conditions. It is minimally complete for a straightforward connection tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds no extra meaning beyond the schema: it mentions 'saved credential name' but the schema already describes 'name' as such. No additional context for 'connection_name' is provided.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description specifies the verb 'connect' and the resource 'remote server using a saved local SSH credential name', distinguishing it from sibling tools like ssh_connect (likely prompts for credentials) and ssh_save_credentials. It clearly indicates the tool uses saved credentials.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The tool description implies it should be used when a saved credential exists, but it does not explicitly state when to use this tool over ssh_connect or provide guidance on prerequisites like having saved credentials. No alternative tools are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_delete_saved_credentialsA

Delete a saved local SSH credential entry

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesSaved credential name to delete

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It correctly indicates a destructive action ('Delete'), but does not clarify side effects (e.g., whether deletions are irreversible or affect active connections). This is adequate but not thorough.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that directly states the tool's purpose with no unnecessary words or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has one parameter, no output schema, and no annotations, the description is minimally sufficient. However, it lacks information about return values or error handling, which would be expected for a deletion tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the parameter is well-documented in the schema. The description adds no extra meaning beyond 'delete by name', but the schema already provides sufficient detail. A score of 4 reflects that the description meets the baseline expectation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Delete a saved local SSH credential entry' uses a specific verb (Delete) and resource (saved local SSH credential entry), clearly distinguishing it from sibling tools like ssh_save_credentials or ssh_list_saved_credentials.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide guidance on when to use this tool versus alternatives, nor does it mention any prerequisites or caveats (e.g., the credential must exist before deletion).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_disconnectA

Disconnect from a remote SSH connection

ParametersJSON Schema
NameRequiredDescriptionDefault
connection_nameYesName of the SSH connection to disconnect

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It states the action (disconnect) but does not disclose any side effects or prerequisites beyond connection existence.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, clear sentence with no unnecessary words. It effectively conveys the tool's purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity of the tool (1 required param, no output schema), the description is complete enough. It lacks details like whether it closes all sessions or just one, but likely adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the description adds no additional meaning beyond the schema. However, the single parameter is clearly described in schema, so baseline 3 is appropriate plus extra clarity from schema description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'Disconnect' and the resource 'remote SSH connection', clearly indicating its action and differentiating it from sibling tools like ssh_connect or ssh_execute.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage after establishing an SSH connection, but does not provide explicit guidance on when not to use it or mention alternatives among siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_download_fileA

Download a remote file to an allowed local root via SFTP

ParametersJSON Schema
NameRequiredDescriptionDefault
connection_nameYesName of the SSH connection to use
remote_pathYesRemote file path to download
local_pathYesLocal destination path

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The phrase 'to an allowed local root' hints at a security restriction on local paths, but does not explain what happens if path is not allowed, or disclose other behaviors like overwrite policy, error handling, or authorization requirements. Since no annotations are provided, the description carries full burden, yet it omits important behavioral details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, direct, no filler. Every word adds meaning—action, resource, protocol, constraint. Ideal length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the parameter count and no output schema, the description is reasonably complete for a file download tool. However, missing details on allowed local roots, file size limits, overwrite behavior, and how the connection_name relates to established connections (e.g., must be connected?) leave room for ambiguity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All three parameters are documented in the schema with descriptions (100% coverage), so the tool's description repeats no parameter info. However, it adds context about path restrictions ('allowed local root') that the schema does not capture, adding value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly indicates the action ('download'), resource ('remote file'), and mechanism ('via SFTP') with a constraint ('to an allowed local root'). Differentiates from sibling 'ssh_upload_file' but could explicitly contrast from 'ssh_execute'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for downloading files, but does not specify when to prefer this over alternatives like 'ssh_execute' with scp, or mention prerequisites (e.g., connection must be established). No explicit when-not or exclusion conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_executeB

Execute a command on a remote SSH connection

ParametersJSON Schema
NameRequiredDescriptionDefault
connection_nameYesName of the SSH connection to use
commandYesCommand to execute on the remote server
timeoutNoCommand timeout in seconds (default: 30)

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It doesn't disclose behavioral traits like whether the command runs in a new shell, environment variables, or changes to remote state. The timeout parameter is mentioned in schema but not in description. Score 3 is appropriate as basic functionality is clear but lacks depth.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that conveys core purpose. No extraneous information. Could be slightly more detailed without being verbose, but as is, it earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is relatively simple with three parameters and no output schema. The description provides minimal context. Given the presence of many sibling tools, additional context about assuming an active connection or return behavior would improve completeness. Score 3 as adequate but not rich.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all three parameters. The description does not add any additional meaning beyond what the schema provides, such as how connection_name is resolved or what constitutes a valid command. Baseline 3 is correct.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (execute) and resource (command on remote SSH connection), providing a specific verb+resource pair. It distinguishes from siblings like ssh_connect (connection setup) and ssh_download_file (file transfer), but could be more explicit about the exact scope (single command execution vs. scripting).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use after establishing a connection via ssh_connect or similar, but does not explicitly state prerequisites or when to use alternatives like ssh_download_file. No guidance on when not to use this tool is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_health_checkB

Check the health of SSH connections

ParametersJSON Schema
NameRequiredDescriptionDefault
connection_nameNoName of the SSH connection to check (optional, checks all if not provided)

TDQS

B3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavioral traits. It fails to mention what 'health' means, potential side effects (read-only?), required permissions, or whether it impacts SSH connections. The description is vague about its behavior beyond a simple health check.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one short sentence. It is concise but too brief, lacking adequate context. It does not earn its place with sufficient detail, so it is not an optimal use of space.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and no annotations, the description fails to explain what the tool returns or how health is assessed. For a tool with a simple parameter schema, the description should provide more context on the health check process, but it does not.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the description adds only general context. The input schema already describes the optional parameter and its behavior (checks all if not provided). The description adds no extra semantics, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool checks health of SSH connections. It specifies the verb 'check' and resource 'health of SSH connections'. However, it lacks differentiation from sibling tools; 'ssh_connect' and 'ssh_execute' might also imply health checks, so purpose is clear but not distinct.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage by stating 'check the health', but it provides no explicit guidance on when to use this tool versus alternatives like ssh_connect or ssh_list_connections. It does not mention when not to use it or any prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_list_connectionsA

List all active SSH connections

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description implies a read-only operation, but no annotations are provided to confirm safety. It doesn't disclose if the connections are to local or remote hosts, or if authentication is needed. With no annotations, the description should be more transparent. However, it is straightforward.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Very concise at 5 words, but it lacks any additional context or structure. Could benefit from a sentence about the return format. Still, it is not verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no parameters and no output schema, the description is minimally adequate. However, it could mention what information is returned (e.g., host, port, user). The tool is simple, so a 3 is reasonable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema has no parameters, and schema description coverage is 100%. The description correctly indicates no parameters needed, so no additional semantics are necessary.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it lists active SSH connections, distinguishing it from sibling tools like ssh_connect, ssh_disconnect, or ssh_list_saved_credentials. It could be more specific about the format or contents of the list, but it is clear enough for an agent.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. For example, it doesn't mention when to use ssh_list_saved_credentials instead. The agent must infer from names alone, which may be ambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_list_saved_credentialsA

List saved local SSH credential entries

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It correctly indicates a read-only, non-destructive operation by saying 'list,' which is consistent with the tool name.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one efficient sentence that clearly states the action and resource without any redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given zero parameters and a simple list operation, the description is complete enough. It doesn't mention return format, but with no output schema, that's acceptable for a list tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage (no properties), so the schema conveys everything. The description doesn't add parameter details because there are none.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'list' and clearly identifies the resource as 'saved local SSH credential entries,' which is distinct from other sibling tools like ssh_connect, ssh_save_credentials, or ssh_delete_saved_credentials.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It's clear when to use this tool: when you need to see saved SSH credentials. However, it doesn't explicitly exclude any contexts or mention alternatives like ssh_list_connections.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_save_credentialsA

Save SSH credentials locally under a reusable name. If a password is provided, the server is contacted once to bootstrap a key and only the generated key credential is saved.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesSaved credential name
hostnameYesRemote server hostname or IP address
usernameYesSSH username
passwordNoSSH password for first-time bootstrap when no private key is available
private_key_pathNoPath to private key file (optional)
portNoSSH port (default: 22)
known_hosts_pathNoOptional path to an extra known_hosts file
trust_unknown_hostNoAllow connecting to hosts not present in known_hosts. Defaults to false.
jump_hostNoOptional SSH jump host (bastion) used to reach the target via native SSH tunneling

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It discloses critical behavior: when a password is provided, the server is contacted to bootstrap a key and only the key is saved. This adds important context beyond the schema about the side effect and stored credential format.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, perfectly sized. First sentence states the core purpose. Second sentence adds a crucial behavioral detail. No filler words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (9 parameters, nested object, no output schema), the description is complete enough. It explains the key behavioral nuance. However, it could mention that the saved credential can later be used with ssh_connect_saved, enhancing integration awareness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description adds a high-level behavioral note but does not add semantic detail for individual parameters beyond what the schema's descriptions already provide.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (save SSH credentials locally), the result (under a reusable name), and the key behavioral nuance (if password provided, bootstrap a key and save only the key credential). This distinguishes it from siblings like ssh_connect_saved or ssh_setup_key_auth.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage: when you want to store credentials for later reuse. However, it does not explicitly state when NOT to use it (e.g., if you only need a one-time connection, use ssh_connect) or mention alternatives like ssh_setup_key_auth for key-only setup.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_setup_key_authA

Generate a local SSH keypair, install the public key on the remote server, and save a key-based credential for future connections

ParametersJSON Schema
NameRequiredDescriptionDefault
connection_nameYesExisting active SSH connection that authenticated with a password
credential_nameNoSaved credential name for future key-based logins
key_nameNoLocal key filename stem. Defaults to credential_name or connection_name.
key_commentNoComment appended to the generated public key
overwrite_saved_credentialNoOverwrite an existing saved credential with the same credential_name

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It explains the tool's actions (keypair generation, public key installation, credential saving), which are inherently destructive (overwriting keys/credentials) and involve network changes. However, it does not mention error conditions, idempotency, or what happens if the key already exists or the connection fails.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that efficiently conveys the three-step process. Every part is essential, and no words are wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of the tool (multiple steps, side effects) and the absence of an output schema or annotations, the description provides a clear overview of what the tool does. However, it could be more complete by noting that the tool modifies the remote server's authorized_keys and saves a local credential, which are irreversible actions.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although the input schema already has 100% coverage with descriptions, the tool description adds context by explaining that 'key_name' defaults to credential_name or connection_name, and 'overwrite_saved_credential' controls overwriting existing credentials. This adds meaning beyond the schema's raw descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a three-step process: generating a keypair, installing the public key on a remote server, and saving a credential for future use. It uses specific verbs (generate, install, save) and identifies the resources (local SSH keypair, remote server, credential), distinguishing it from siblings like ssh_connect or ssh_save_credentials.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies that this tool is used for setting up key-based authentication after password authentication, as the required 'connection_name' parameter refers to an 'Existing active SSH connection that authenticated with a password'. However, it does not explicitly state when not to use it or mention alternatives among siblings for similar tasks.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_upload_fileB

Upload a local file from an allowed local root to the remote server via SFTP

ParametersJSON Schema
NameRequiredDescriptionDefault
connection_nameYesName of the SSH connection to use
local_pathYesLocal file path to upload
remote_pathYesRemote destination path

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must convey behavioral traits. It indicates the upload is via SFTP and requires an 'allowed local root', hinting at a security constraint. However, it doesn't disclose whether the file is overwritten, whether permissions are set, or what happens on failure. The behavior is partially transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that efficiently conveys the core purpose. It is front-loaded with the action and key concepts. No unnecessary words, but it could be slightly more informative within the same space.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 3 parameters, 100% schema coverage, no output schema, and no annotations, the description could provide more context about behavior (e.g., overwrite policy, permission settings). It is adequate but not rich for a file transfer operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema covers all 3 parameters with descriptions. The tool description adds the context of 'allowed local root' for local_path, which provides additional meaning beyond the schema. However, for connection_name and remote_path, the description doesn't add extra value beyond the schema's own descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (upload), the resource (local file), and the transport method (SFTP via an SSH connection). It distinguishes itself from sibling tools like ssh_download_file (which does the opposite) and ssh_execute (which runs commands). However, it doesn't explicitly mention that the upload is to a remote server, which is already implied by SFTP.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions 'allowed local root', giving a hint about prerequisites, but it doesn't clearly state when to use this tool vs alternatives like setting up key auth first or ensuring the connection is established. No explicit when-not or alternatives are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 12 tool updatesv1.0.1
    • First observedssh_connect
    • First observedssh_connect_saved
    • First observedssh_delete_saved_credentials
    • First observedssh_disconnect
    • First observedssh_download_file
    • First observedssh_execute
    • First observedssh_health_check
    • First observedssh_list_connections
    • First observedssh_list_saved_credentials
    • First observedssh_save_credentials
    • First observedssh_setup_key_auth
    • First observedssh_upload_file

TDQS

A3.7/5.0
Disambiguation5/5

Each tool targets a distinct action on SSH connections or credentials. For example, ssh_connect and ssh_connect_saved differ by credential source, ssh_execute and ssh_download_file/ssh_upload_file are clearly different operations. No overlapping purposes detected.

Naming Consistency4/5

All tools use a consistent 'ssh_' prefix and verb_noun pattern (e.g., ssh_connect, ssh_execute, ssh_download_file). Minor deviation: ssh_setup_key_auth and ssh_delete_saved_credentials use slightly longer verbs but still follow the pattern.

Tool Count4/5

12 tools is reasonable for an SSH management server covering connection lifecycles, file transfer, and credential management. Slightly on the higher end but each tool is justified.

Completeness4/5

Covers core SSH operations: connect/disconnect, execute, file transfer, credential management, and health check. Minor gap: no explicit tool for listing remote files/directories, but file transfer tools imply that capability.

Maintenance

ActivityStale
ResponsivenessSyncing

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    Not graded
    maintenance
    Connects Claude to remote servers via SSH to execute commands, manage files, and browse directories. It allows users to add, edit, and switch between multiple server configurations through natural language conversations.
    -
  • -
    license
    Not graded
    quality
    Not graded
    maintenance
    Enables Claude Code to control remote servers via SSH for automated deployment, testing, and operations, including command execution and file transfer.
    4
    -

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/nqmn/adremote-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server