What can you do with this server?

SSH MCP JumpServer enables AI agents to manage remote servers via SSH, with dynamic host discovery through JumpServer, security features, and connection pooling. Core Operations: * List hosts (ssh_list_hosts): View all available SSH hosts from merged configuration (local project/user config + JumpServer). * Execute commands (ssh_exec): Run commands on any host (static or discovered via JumpServer) with optional timeout. * Get host config (ssh_get_config): Retrieve full merged SSH configuration for a specific host. * Test connectivity (ssh_test_connection): Verify SSH connection to a host. * Disconnect sessions (ssh_disconnect): Close one or all active SSH sessions. * Initialize config (ssh_init_config): Create or scaffold SSH config files at project or user level. Smart Features: * JumpServer API dynamic discovery eliminates manual host configuration. * Automatic username fallback: tries root → ec2-user → game_server for JumpServer hosts. * Connection pooling reuses sessions across agent steps for performance. * Security: per-host allow/deny lists, dangerous command blocking, output truncation, secret redaction. * HMAC-SHA256 authentication to JumpServer. * Priority: command-line args > project config > user config > JumpServer.

How do I use ssh-mcp-jumpserver?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@ssh-mcp-jumpserver Connect to 10.0.0.5 and run uptime" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

SSH MCP JumpServer

English | 中文

An MCP server that bridges AI agents (Claude Desktop, VS Code Copilot, etc.) to remote servers via SSH — with dynamic host discovery through JumpServer. No need to manually configure every host; if JumpServer knows it, you can connect to it.

Why this project

JumpServer dynamic discovery: connect to any host JumpServer manages — no manual SSH config needed
Auto username fallback: tries root → ec2-user → game_server until one works
Standard SSH config support: still works with your existing OpenSSH config files for static hosts
Secure by default: dangerous command blocking, per-host allowlists/denylists, output caps, and secret redaction
Connection pooling: reuse SSH connections across agent steps for faster multi-turn sessions

Related MCP server: remote-admin-mcp

Quick start

Install

npm install -g ssh-mcp-jumpserver
# or: npm install && npm run build && npm link

Add to your MCP client

{
  "mcpServers": {
    "ssh": {
      "command": "ssh-mcp-jumpserver",
      "args": [
        "--ssh",
        "name=prod,host=10.0.0.5,port=22,user=root,privateKey=~/.ssh/id_rsa"
      ],
      "env": {
        "JUMPSERVER_URL": "https://your-jumpserver.example.com",
        "JUMPSERVER_KEY_ID": "your-access-key-id",
        "JUMPSERVER_SECRET_ID": "your-access-secret-id"
      }
    }
  }
}

Static hosts passed with --ssh are searched first. If no static or config-file host matches, the server falls back to JumpServer discovery.

Try it

Ask your AI agent:

"Connect to 10.0.0.5 and run uptime."
"List all my SSH hosts."
"Test the connection to prod-db-01."

The server resolves unknown hosts through JumpServer automatically.

Features

Feature	Description
🔍 JumpServer dynamic discovery	Search assets by IP or hostname, fetch SSH keys via API
🔄 Username fallback	Auto-tries `root` → `ec2-user` → `game_server` for JumpServer hosts
📋 Static SSH config	Standard OpenSSH config (`ssh.config`) for predefined hosts
🔒 Security policies	Per-host allowlist/denylist, output truncation, secret redaction
🔌 Connection pool	Reuse SSH connections with idle cleanup
🌐 HMAC-SHA256 auth	HTTP Signature signed requests to JumpServer API

CLI Options

ssh-mcp-jumpserver [options]

--jumpserver-url <url>       JumpServer base URL (enables dynamic host discovery)
--jumpserver-key-id <id>     JumpServer Access Key ID
--jumpserver-secret-id <id>  JumpServer Access Secret ID
--project-root <path>        Project root (for project-level ssh.config)
--ssh <config>               Static SSH host, repeatable:
                             name=prod,host=10.0.0.5,port=22,user=root,password=...
--timeout <ms>               Default command timeout (default: 60000)
--max-output <chars>         Max output characters (default: 10000)
--max-connections <n>        Max concurrent SSH connections (default: 5)
--idle-timeout <ms>          Connection idle timeout (default: 600000)

Environment variable equivalents: JUMPSERVER_URL, JUMPSERVER_KEY_ID, JUMPSERVER_SECRET_ID.

Host lookup priority: --ssh args → project ssh.config → user config → JumpServer fallback.

MCP Tools

Tool	Description
`ssh_list_hosts`	List all configured SSH hosts
`ssh_exec`	Execute a command on a host (local config or JumpServer)
`ssh_get_config`	Show merged config for a host
`ssh_test_connection`	Test SSH connectivity
`ssh_disconnect`	Close SSH session(s)
`ssh_init_config`	Scaffold a new SSH config file

How JumpServer resolution works

User request: ssh_exec host="10.0.0.5"
  → Is "10.0.0.5" in local ssh.config?
    ├── Yes → connect directly
    └── No → query JumpServer API
        ├── GET /api/v1/assets/assets/?ip=10.0.0.5
        ├── GET /api/v1/assets/system-users/?asset=<id>
        ├── GET /api/v1/assets/system-users/<id>/auth-info/
        → Build SSHHostConfig with discovered key
        → Try root → ec2-user → game_server
        → Execute command

Contributing

See CONTRIBUTING.md.

License

MIT — see LICENSE.

Available Tools

6 tools

ssh_disconnectA

Disconnect SSH session(s). Specify a host to disconnect one, or omit to disconnect all.

Inputs: host.

ssh_execB

Execute a command on a remote SSH host. The host must be defined in the SSH configuration or resolvable via JumpServer.

Inputs: host (required), command (required), timeout_ms.

ssh_get_configA

Get the full SSH configuration for a specific host (merged from project + user level, or JumpServer)

Inputs: host (required).

ssh_init_configB

Initialize an SSH configuration file (project-level or user-level)

Inputs: scope (required), hosts, project_root.

ssh_list_hostsA

List all available SSH hosts from merged configuration (project + user level)

Inputs: no named parameters.

ssh_test_connectionB

Test SSH connectivity to a configured host (or a JumpServer-resolved host)

Inputs: host (required).

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A3.9/5.0

Scored 2026-06-27 14:20 across 6 tools

Disambiguation5/5

Each tool has a distinct purpose: disconnect, execute commands, get config, initialize config, list hosts, and test connectivity. No overlapping functionality.

Naming Consistency5/5

All tools follow a consistent 'ssh_verb_noun' pattern using snake_case, making it easy to predict tool names and their actions.

Tool Count5/5

6 tools cover the core SSH management operations without being excessive or insufficient, fitting the server's scope well.

Completeness4/5

Covers key operations (exec, disconnect, config, list hosts, test), but lacks an explicit 'ssh_connect' tool; however, exec and test effectively handle connection initiation.

Maintenance

ActivityInactive

ResponsivenessNo recent community issues

Resources

Related MCP Connectors

emisar
dev.emisar
Let AI operate servers without SSH. Choose actions, approve risky changes, and audit every step.
Cloud Platforms Security Networking & Infrastructure
2375
https://emisar.dev/api/mcp/rpc
SentinelX MCP
app.sentinelx
Operate Linux, macOS and Windows from your LLM. Every action runs through an auditable allowlist.
Shell Access OS Automation
216
https://mcp.sentinelx.app/mcp/mcp
Remote Desktop CommanderA
app.desktopcommander
Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.
Shell Access OS Automation
322223
https://mcp.desktopcommander.app/mcp
browser-ssh
com.browserssh
Scoped, audited SSH exec, sessions, and SFTP on your saved servers without exposing credentials
Shell Access File Systems
2
https://api.browserssh.com/mcp

Related MCP Servers

SSH MCP Server
Shell Access File Systems
uarlouski
A
license
Not graded
quality
D
maintenance
Enables AI assistants to securely execute commands, transfer files, and manage port forwarding on remote servers via SSH.
Updated 5 months ago (2026-06-10 10:12 UTC)
158 npm
38
Apache 2.0
remote-admin-mcp
Shell Access Command Line
intershopper
A
license
A
quality
B
maintenance
Enables AI assistants to manage remote servers via SSH with agentless command execution, file operations, and service management.
Updated a month ago (2026-10-03 11:34 UTC)
9
MIT
SSH MCP Server
Shell Access Command Line
plmi
F
license
Not graded
quality
D
maintenance
Enables AI to execute commands on remote hosts via SSH, supporting password and key authentication.
Updated 8 months ago (2026-03-29 23:11 UTC)
-
jumpserver-ssh-mcp
Shell Access Command Line
Shadow-linux
A
license
Not graded
quality
D
maintenance
Enables AI agents to securely execute remote commands via SSH or JumpServer, with flexible gateway configuration and plugin-based matchers for JumpServer login interfaces.
Updated 3 months ago (2026-08-03 08:06 UTC)
2
Apache 2.0