What can you do with this server?

The MCP SSH Orchestrator provides secure, policy-governed SSH access for AI assistants to manage infrastructure with zero-trust architecture and comprehensive audit logging. Core Capabilities: * Discovery & Inventory: List configured hosts (ssh_list_hosts), get detailed host information with tags, aliases, and credentials (ssh_describe_host), and verify orchestrator health (ssh_ping) * Command Planning: Test commands against security policies before execution using dry-run mode (ssh_plan) * Command Execution: Run commands on individual servers (ssh_run) or across server groups by tags (ssh_run_on_tag) with policy enforcement and timeout protection * Asynchronous Task Management: Start long-running background tasks (ssh_run_async), monitor status and progress with real-time output streaming (ssh_get_task_status, ssh_get_task_output), retrieve final results (ssh_get_task_result), and cancel running operations (ssh_cancel, ssh_cancel_async_task) * Configuration Management: Hot reload servers, credentials, and policies without service restart (ssh_reload_config) Security Features: * Deny-by-default policy enforcement with command whitelisting * IP allowlist validation and network isolation * Command pattern matching to block dangerous operations (rm -rf, dd, privilege escalation, lateral movement) * Host key verification to prevent MITM attacks * Comprehensive JSON audit logs with timestamps, command hashes, and execution metadata * Resource limits with built-in timeouts and cancellation support Use Cases: Automate server maintenance, manage homelab infrastructure (Proxmox, Docker, NAS), conduct auditable incident response, enable AI-powered DevOps workflows, and provide controlled infrastructure access for platform engineering teams.

Which integrations are available for this server?

Supports containerized deployment with security isolation, resource limits, and non-root execution for safe SSH orchestration operations. Enables log inspection and monitoring of nginx servers, including error log analysis and service management across web server fleets. Allows safe management and monitoring of Proxmox virtualization hosts, including disk usage checks and routine maintenance tasks with policy-controlled access. Enables secure management and monitoring of TrueNAS storage systems through SSH with policy-based access controls.

How do I use MCP SSH Orchestrator?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@MCP SSH Orchestrator check the disk usage on web-server-01" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

de en es ja ko ru zh

MCP SSH Orchestrator

by samerfarida

Overview Schema Related Servers Score Discussions

Python

Remote

License MCP Python Docker OpenSSF Scorecard GitHub release GitHub stars GitHub forks GitHub issues GitHub pull-requests GitHub contributors GitHub last commit GitHub Actions CodeQL Analysis

What Problem Does This Solve?

Imagine this: Your AI assistant (Claude, ChatGPT, etc.) can access your servers, but you're terrified of what it might do. rm -rf /? Delete your databases? Change firewall rules?

Now imagine this: Your AI has governed, auditable access to your infrastructure. It can check logs, restart services, and manage your fleet, but only if your security policies allow it.

That's exactly what MCP SSH Orchestrator provides: the power of AI-driven server management with deny-by-default access control, IP allowlists, host key verification, and comprehensive audit logging backed by declarative YAML policy-as-code (config/servers.yml, config/credentials.yml, config/policy.yml).

Related MCP server: OpenAccess MCP

Why This Matters

Zero-Trust Security Model

Deny-by-default: Nothing runs unless explicitly allowed
Network controls: IP allowlists prevent lateral movement
Command whitelisting: Only approved commands can execute
Declarative policy-as-code: Versioned YAML files define hosts, credentials, and allowed commands
Comprehensive audit trails: Every action is logged in JSON

Prevents Common Attack Vectors

Dangerous commands blocked: rm -rf, dd, file deletions
Network isolation: Servers can't access external internet
No privilege escalation: Runs as non-root in containers
Resource limits: CPU and memory caps prevent DOS

Production-Ready Audit & Security

OWASP LLM Top 10 protected: Mitigates LLM07 (Insecure Plugin Design), LLM08 (Excessive Agency), LLM01 (Prompt Injection)
MITRE ATT&CK aligned: Prevents T1071 (Application Layer Protocol), T1659 (Content Injection)
Structured JSON audit logs: Complete audit trail with timestamps, hashes, and IPs
Forensics ready: Command hashing, IP tracking, detailed metadata
Real-time monitoring: Progress logs for long-running tasks

Who Is This For?

Homelab Enthusiasts

Automate routine server maintenance with AI
Safely manage Proxmox, TrueNAS, Docker hosts
Get help troubleshooting without losing SSH security

Security Engineers

Audit and control AI access to infrastructure
Implement zero-trust principles with declarative policy-as-code configs
Meet compliance requirements with structured logging

DevOps Teams

Let AI handle routine tasks: log checks, service restarts, updates
Manage fleets of servers through conversational interface
Reduce manual toil while maintaining security standards

Platform Engineers

Enable AI-powered infrastructure management
Provide secure self-service access to developers
Bridge the gap between AI and infrastructure securely

Real-World Use Cases

Scenario 1: Homelab Automation (Homelab Enthusiasts)

You say: "Claude, my Proxmox host is running slow. Can you check disk usage and memory on all my VMs?"

What happens

Policy allows df -h and free -m on Proxmox hosts
Network check: Private IP allowlist permits access
Tag-based execution checks all hosts tagged proxmox
Commands execute safely with no destructive operations
Complete audit trail stored in JSON logs

Scenario 2: Incident Response (DevOps Teams)

You say: "We're seeing 500 errors. Check nginx logs across all production web servers and show me the last 100 error lines."

What happens

Tag-based execution: tail -n 100 /var/log/nginx/error.log runs on all web-prod servers
Network isolation enforced: No external API calls or egress allowed
Real-time progress logs stream via MCP context events
Structured output aggregates results for quick triage
Full audit trail with timestamps for post-incident review

Scenario 3: Fleet-Wide Maintenance (Platform Engineers)

You say: "Update system packages on all staging servers, but show me what would change first before running the upgrade."

What happens

Use ssh_plan to preview apt list --upgradable across staging tagged hosts
Review dry-run output to see pending updates
Policy validates apt update && apt upgrade -y is allowed on staging
Tag-based execution runs upgrade on all staging servers in parallel
Audit logs track which servers were updated and when

Quick Start

1. Prepare local configuration (one-time)

# Optional: bootstrap everything with the compose helper script
# (runs from the repo root or from your target config directory)
./compose/setup.sh enduser

# Or download it separately
curl -fsSLO https://raw.githubusercontent.com/samerfarida/mcp-ssh-orchestrator/main/compose/setup.sh
chmod +x setup.sh
./setup.sh enduser

If you prefer to lay things out manually, follow the steps below.

# Pull the latest release
docker pull ghcr.io/samerfarida/mcp-ssh-orchestrator:latest

# Create directories for config, keys, and secrets
mkdir -p ~/mcp-ssh/{config,keys,secrets}

# Copy example configs to get started quickly
cp examples/example-servers.yml ~/mcp-ssh/config/servers.yml
cp examples/example-credentials.yml ~/mcp-ssh/config/credentials.yml
cp examples/example-policy.yml ~/mcp-ssh/config/policy.yml

# Add your SSH key (replace with your private key file)
cp ~/.ssh/id_ed25519 ~/mcp-ssh/keys/
chmod 0400 ~/mcp-ssh/keys/id_ed25519

# (Optional) Pin trusted hosts and prepare secret files
cp ~/.ssh/known_hosts ~/mcp-ssh/keys/known_hosts

# Option 1: Individual secret files (Docker secrets compatible)
cat > ~/mcp-ssh/secrets/prod_db_password.txt <<'EOF'
CHANGE-ME
EOF
chmod 600 ~/mcp-ssh/secrets/prod_db_password.txt

# Option 2: Consolidated .env file (recommended for easier management)
cat > ~/mcp-ssh/secrets/.env <<'EOF'
# SSH Passwords
prod_db_password=CHANGE-ME
lab_password=CHANGE-ME-TOO

# SSH Key Passphrases
prod_key_passphrase=CHANGE-ME-PASSPHRASE
EOF
chmod 600 ~/mcp-ssh/secrets/.env
# Note: .env file supports KEY=value format, comments, and quoted values
# See docs/wiki/06.2-credentials.yml.md for details

2. Launch the orchestrator container

docker run -d --name mcp-ssh-orchestrator \
  -v ~/mcp-ssh/config:/app/config:ro \
  -v ~/mcp-ssh/keys:/app/keys:ro \
  -v ~/mcp-ssh/secrets:/app/secrets:ro \
  ghcr.io/samerfarida/mcp-ssh-orchestrator:latest

Restart later with docker start mcp-ssh-orchestrator. Prefer disposable containers? Use docker run -i --rm ... instead.

3. Connect your MCP client

Cursor: Add to ~/.cursor/mcp.json

{
  "mcpServers": {
    "mcp-ssh-orchestrator": {
      "command": "docker",
      "args": ["start", "-a", "mcp-ssh-orchestrator"],
      "env": {"PYTHONUNBUFFERED": "1"}
    }
  }
}

Claude Desktop (macOS): Update ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "ssh-orchestrator": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-v", "/Users/YOUR_USERNAME/mcp-ssh/config:/app/config:ro",
        "-v", "/Users/YOUR_USERNAME/mcp-ssh/keys:/app/keys:ro",
        "-v", "/Users/YOUR_USERNAME/mcp-ssh/secrets:/app/secrets:ro",
        "ghcr.io/samerfarida/mcp-ssh-orchestrator:latest"
      ]
    }
  }
}

(Windows path: %APPDATA%\\Claude\\claude_desktop_config.json.)

More examples (Docker Desktop, multi-environment, SDK usage) live in the Integrations guide.

4. Test the connection

# List configured hosts through the MCP server
echo '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"ssh_list_hosts","arguments":{}},"id":1}' | \
  docker run -i --rm \
    -v ~/mcp-ssh/config:/app/config:ro \
    -v ~/mcp-ssh/keys:/app/keys:ro \
    -v ~/mcp-ssh/secrets:/app/secrets:ro \
    ghcr.io/samerfarida/mcp-ssh-orchestrator:latest

Cursor/Claude should now show the orchestrator as connected. Jump to the Usage Cookbook for guided scenarios.

How Security Works (The Technical Details)

Policy-as-code workflow: config/servers.yml, config/credentials.yml, and config/policy.yml are parsed on startup, enforced during every ssh_* tool invocation, and mirrored in the structured audit logs so the same declarative files you review in Git gate what your AI can execute.

Defense-in-Depth Architecture

graph TB
    subgraph "Layer 1: Transport Security"
        L1A[stdio Communication]
        L1B[Container Isolation]
    end
    subgraph "Layer 2: Network Security"
        L2A[IP Allowlists]
        L2B[Host Key Verification]
    end
    subgraph "Layer 3: Policy Security"
        L3A[Deny-by-Default]
        L3B[Pattern Matching]
    end
    subgraph "Layer 4: Application Security"
        L4A[Non-Root Execution]
        L4B[Resource Limits]
    end

    L1A --> L2A
    L1B --> L2B
    L2A --> L3A
    L2B --> L3B
    L3A --> L4A
    L3B --> L4B

    style L1A fill:#e1f5ff
    style L1B fill:#e1f5ff
    style L2A fill:#d4edda
    style L2B fill:#d4edda
    style L3A fill:#fff3cd
    style L3B fill:#fff3cd
    style L4A fill:#f8d7da
    style L4B fill:#f8d7da

What Gets Blocked

# Dangerous commands automatically denied
deny_substrings:
# Destructive operations
  - "rm -rf /"
  - ":(){ :|:& };:"
  - "mkfs "
  - "dd if=/dev/zero"
  - "shutdown -h"
  - "reboot"
  - "userdel "
  - "passwd "
# Lateral movement / egress tools
  - "ssh "
  - "scp "
  - "rsync -e ssh"
  - "curl "
  - "wget "
  - "nc "
  - "nmap "
  - "telnet "
  - "kubectl "
  - "aws "
  - "gcloud "
  - "az "

# Network isolation enforced
network:
  allow_cidrs:
    - "10.0.0.0/8"      # Only private IPs
    - "192.168.0.0/16"
  block_ips: []         # Explicit IP blocks (if needed)

What Gets Allowed (Examples)

# Safe, read-only commands (using simple_binaries)
rules:
  - action: "allow"
    aliases:
      - "*"
    tags:
      - "observability"
    simple_binaries:
      - uptime
      - whoami
      - hostname
    simple_max_args: 6

# Disk and memory inspection (using structured rules)
  - action: "allow"
    aliases:
      - "*"
    tags:
      - "observability"
    binary: "df"
    arg_prefix: ["-h"]
    allow_extra_args: false

  - action: "allow"
    aliases:
      - "*"
    tags:
      - "observability"
    binary: "free"
    arg_prefix: ["-m"]
    allow_extra_args: false

# Log inspection (using structured rules with path restrictions)
  - action: "allow"
    aliases:
      - "*"
    tags:
      - "observability"
    binary: "tail"
    arg_prefix: ["-n", "200"]
    allow_extra_args: false
    path_args:
      indices: [3]
      patterns:
        - "/var/log/*"

# Service management (controlled)
  - action: "allow"
    aliases:
      - "web-*"
      - "db-*"
    tags:
      - "production"
      - "critical-service"
    binary: "systemctl"
    arg_prefix: ["restart", "nginx"]
    allow_extra_args: false

  - action: "allow"
    aliases:
      - "web-*"
      - "db-*"
    tags:
      - "production"
      - "critical-service"
    binary: "systemctl"
    arg_prefix: ["status"]
    allow_extra_args: true

Protection Against Real Threats

MCP SSH Orchestrator directly addresses documented vulnerabilities in the MCP ecosystem:

CVE-2025-49596: Localhost-exposed MCP services → Mitigated with stdio-only transport
CVE-2025-6514: Command injection in MCP servers → Mitigated with policy-based validation
43% of MCP servers have command injection flaws → Zero-trust security model

Full Security Model Documentation | Security Risks Analysis

Documentation

Complete Documentation Wiki

Section	What You'll Learn
Quick Start & Examples	Practical examples and common workflows
Architecture	How it works under the hood
Security Model	Zero-trust design and controls
Configuration	Setting up hosts, credentials, policies
Observability & Audit	Logging, monitoring, compliance
Deployment	Production setup guide

Supply Chain Integrity

Signed release artifacts: Every tarball/zip in GitHub Releases ships with a detached GPG signature produced by the maintainer key (openpgp4fpr:6775BF3F439A2A8A198DE10D4FC5342A979BD358). Import the key and verify before unpacking:

gpg --receive-keys 4FC5342A979BD358
gpg --verify mcp-ssh-orchestrator-v1.3.2.tar.gz.asc mcp-ssh-orchestrator-v1.3.2.tar.gz

Cosign-signed container images: The images under ghcr.io/samerfarida/mcp-ssh-orchestrator are signed via Sigstore keyless signing in the release workflow. Verify the signature (and optional attestations) before deploying:

COSIGN_EXPERIMENTAL=1 cosign verify \
  --certificate-identity-regexp "https://github.com/samerfarida/mcp-ssh-orchestrator/.github/workflows/release.yml@.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/samerfarida/mcp-ssh-orchestrator:latest

Image digests and signatures are published with every tag in GitHub Packages so you can pin exact references when promoting builds between environments (package feed).

OpenSSF Scorecard: The repository maintains an automated Scorecard run to track security posture across dependencies, build settings, branch protections, and more (scorecard summary).

What Can AI Do With This? (MCP Tools)

Your AI assistant gets 13 powerful tools with built-in security:

Discovery & Planning

ssh_list_hosts - See all available servers
ssh_describe_host - Get host details and tags
ssh_plan - Test commands before running (dry-run mode)

Execution

ssh_run - Execute single command on one server
ssh_run_on_tag - Run command on multiple servers (e.g., all "web" servers)
ssh_run_async - Start long-running tasks in background

Monitoring & Control

ssh_get_task_status - Check progress of async tasks
ssh_get_task_output - Stream output in real-time
ssh_get_task_result - Get final result when done
ssh_cancel - Stop a running synchronous task safely
ssh_cancel_async_task - Stop a running async task safely

Management

ssh_reload_config - Update hosts/credentials without restart
ssh_ping - Verify connectivity to a host

MCP Resources + Context

ssh://hosts – discover sanitized host inventory (alias, tags, description, credential presence)
ssh://host/{alias} – inspect a single host without exposing credentials
ssh://host/{alias}/tags – fetch tag-only view for planning tag executions
ssh://host/{alias}/capabilities – derived policy summary, limits, and sample command allowances per host

Context-aware logging: Streams lightweight ctx.debug / ctx.info events (task start, completion, cancellations) in supported clients for ssh_run, ssh_run_on_tag, config reloads, and async task polling—all without exposing raw commands or secrets.

LLM-friendly hints: Policy/network denials (and ssh_plan previews) include helpful hints so assistants automatically retry with ssh_plan, consult the orchestrator prompts, or ask whether a policy/network update is appropriate instead of looping on blocked commands.

Complete Tools Reference with Examples

Learn More

Key Differentiators

Production-Ready Security: OpenSSF Scorecard 7.5+ score
Zero-Trust Architecture: Deny-by-default, allow-by-exception
OWASP LLM Top 10 Protected: Mitigates insecure plugin design, excessive agency, prompt injection
MITRE ATT&CK Aligned: Prevents content injection and unauthorized protocol usage
Security-Focused: Built on security-first principles against real CVEs (CVE-2025-49596, CVE-2025-6514)
Easy Integration: Works with Claude, ChatGPT, and any MCP client
Open Source: Apache 2.0 licensed, community-driven

What Users Are Saying

"Finally, I can let Claude manage my Proxmox cluster without fear!" - Homelab Admin
"This is what infrastructure-as-code should have been. Declarative security for AI access." - Platform Engineer
"The structured audit logs make incident response so much easier." - Security Engineer

Contributing

We welcome contributions! See our Contributing Guide for:

Development setup
Code of conduct
How to submit PRs
Architecture decisions

License

Apache 2.0 - See LICENSE for details.

Available Tools

13 tools

ssh_cancelC

Request cancellation for a running task.

ParametersJSON Schema

Name	Required	Description	Default
`task_id`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
`result`	Yes

TDQS

C2.4/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose behavioral traits. It implies a cancellation request is sent but does not explain if the task is immediately cancelled, if it's asynchronous, or what the return value indicates. Important side effects or permissions are omitted.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, which is concise but lacks any structure. It is not verbose, but the brevity comes at the cost of missing crucial details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity (1 parameter, output schema exists), the description is incomplete. It does not explain cancellation behavior, expected output, or prerequisites. More context is needed for effective tool usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter 'task_id' has no schema description (0% coverage). The tool description does not explain what a task ID is, how to obtain it, or its required format. The description fails to add meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Request cancellation for a running task' clearly states the verb and resource. However, it does not differentiate from the sibling tool 'ssh_cancel_async_task', which may have similar functionality.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives like 'ssh_cancel_async_task' or other ssh tools. The description gives no context for appropriate usage scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_cancel_async_taskC

Cancel a running async task.

ParametersJSON Schema

Name	Required	Description	Default
`task_id`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
`result`	Yes

TDQS

C2.6/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full responsibility for behavioral disclosure. It only states the action (cancel) without explaining side effects, whether cancellation is guaranteed, or what happens to the task (e.g., cleanup, error states). The agent lacks insight into the tool's behavior beyond the surface.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, highly concise and front-loaded. It efficiently conveys the core action. However, it may be too terse given the lack of parameter and behavioral details, but conciseness is a strength here even if completeness suffers.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has one parameter and an output schema (not shown), the description should at least mention the return value or how to obtain the task_id. It does not, leaving the agent without essential context for proper usage. The minimal nature makes it incomplete for effective selection and invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has one parameter (task_id) with no description in the schema (0% coverage). The description does not mention the parameter at all, so it adds no meaning beyond the parameter name. The agent must guess the format or origin of the task ID, which is insufficient for reliable invocation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool cancels a running async task. It identifies the verb (cancel) and resource (async task), making the purpose unambiguous. However, it does not distinguish from the sibling tool 'ssh_cancel', which might have a different scope, but the specificity to async tasks provides clarity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like ssh_cancel or when cancellation is appropriate. There is no mention of prerequisites, such as the task needing to be in a running state, or any fail conditions. The description leaves the agent to infer use cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_describe_hostA

Return host definition in JSON.

ParametersJSON Schema

Name	Required	Description	Default
`alias`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
`result`	Yes

TDQS

A3.5/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description does not disclose behavioral traits like safety (read-only vs mutation), authentication needs, or error handling. As no annotations are provided, the description carries the burden; it mentions the return format but omits critical context about side effects or constraints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no unnecessary words. It is efficient but could include more context without becoming verbose, such as parameter explanation or usage hints.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one optional parameter) and the presence of an output schema, the description is adequate but incomplete. It does not explain the role of the alias parameter or what happens when omitted, which an agent might need for proper invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter 'alias' is not explained in the description; its purpose (identifying the host) must be inferred. With 0% schema description coverage, the description should compensate but fails to add meaning beyond the parameter name and default value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Return host definition in JSON.' clearly states the verb (return), resource (host definition), and output format (JSON). It distinguishes from sibling tools like ssh_list_hosts which lists hosts, and ssh_run which executes commands.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives such as ssh_list_hosts. It implies usage for retrieving a specific host's details but does not specify prerequisites or context preferences.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_get_task_outputB

Get recent output lines from running or completed task.

Enhanced beyond SEP-1686: enables streaming output visibility.

ParametersJSON Schema

Name	Required	Description	Default
`task_id`	No
`max_lines`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
`result`	Yes

TDQS

B3.2/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must fully disclose behavior. It only states the tool gets output lines, but does not explain what 'recent' means, whether it blocks, how it handles large outputs, or any side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise (two sentences) and front-loaded, providing the core purpose immediately without unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having an output schema, the description does not clarify what the output contains (e.g., format, line numbers). It is incomplete for a tool that retrieves streaming output, lacking critical context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, yet the description adds no information about parameters. It does not explain task_id or max_lines beyond the schema's defaults and titles, leaving the agent without meaningful guidance.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Get recent output lines from running or completed task.' This distinguishes it from sibling tools like ssh_get_task_result and ssh_get_task_status.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description hints at usage for streaming output ('enables streaming output visibility') but provides no explicit guidance on when to use this tool versus alternatives, nor does it mention prerequisites or limitations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_get_task_resultA

Get final result of completed task (SEP-1686 compliant).

Returns complete output, exit code, and execution metadata.

ParametersJSON Schema

Name	Required	Description	Default
`task_id`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
`result`	Yes

TDQS

A3.8/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavior. It states the return includes output, exit code, and metadata, which covers the main behavioral traits of a getter. However, it does not mention side effects, prerequisites, or potential errors (e.g., if task is not completed).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loading the purpose and key return details. Every sentence adds value with no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that the tool is a simple getter with an output schema (signaled), the description covers purpose and return values. However, it lacks parameter details (task_id) and usage guidelines, leaving gaps for an agent to use it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, and the description does not mention the task_id parameter at all. It provides no context about what task_id represents or how to obtain it, leaving the parameter's semantics entirely to the schema (which has no description).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool gets the final result of a completed task, specifies SEP-1686 compliance, and lists return contents (output, exit code, metadata). This distinguishes it from siblings like ssh_get_task_output and ssh_get_task_status.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool should be used only for completed tasks, but no explicit guidance on when to use versus siblings (e.g., ssh_get_task_output, ssh_get_task_status) or when not to call it. The word 'completed' provides some context but lacks alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_get_task_statusA

Get current status of an async task (SEP-1686 compliant).

Returns task state, progress, elapsed time, and output summary.

ParametersJSON Schema

Name	Required	Description	Default
`task_id`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
`result`	Yes

TDQS

A3.7/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It lists what the tool returns (state, progress, elapsed time, output summary) but doesn't disclose side effects, required permissions, or error behavior. It is adequate but could be more explicit about being a read-only operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, no wasted words, and front-loaded with the core purpose. It meets conciseness and structure expectations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity, the description covers the key outputs. It does not mention prerequisites (e.g., task must exist) or edge cases, but the presence of an output schema reduces the need for return value details. It is nearly complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description does not mention the 'task_id' parameter at all. Although the parameter name is self-explanatory, the description adds no semantic value beyond the schema. With 0% schema description coverage, this is a significant gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool gets the status of an async task, with a specific verb 'Get' and resource 'status of an async task'. It also mentions SEP-1686 compliance, which adds specificity. This distinguishes it from siblings like ssh_get_task_output or ssh_get_task_result.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when an async task ID is available, but it doesn't explicitly state when to use this tool versus alternatives. No guidance on prerequisites or when not to use it is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_list_hostsB

List configured hosts.

ParametersJSON Schema

Name	Required	Description	Default
No parameters

Output Schema

ParametersJSON Schema

Name	Required	Description
`result`	Yes

TDQS

B3.2/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full burden of behavioral disclosure. It states only 'List configured hosts' with no mention of read-only nature, side effects, or any constraints. The agent has no information about the tool's behavior beyond the obvious.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise, consisting of a single sentence with no unnecessary words. It is front-loaded and clear. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no parameters and the presence of an output schema, the description is minimally adequate. However, it lacks context about the source of 'configured hosts' (e.g., from a configuration file) and doesn't clarify the scope. The agent might need more context for proper use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameters with 100% description coverage (empty schema, fully described by its absence). The description adds no parameter information because none is needed. Per rubric, 0 params defaults to baseline 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'List configured hosts' with a specific verb and resource. It distinguishes from sibling tool ssh_describe_host (which describes a single host). However, it does not explicitly define 'configured hosts' and could be more precise about the scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There are no usage guidelines provided. The description does not indicate when to use this tool versus alternatives like ssh_run or ssh_ping. The agent receives no guidance on context or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_pingC

Health check.

ParametersJSON Schema

Name	Required	Description	Default
No parameters

Output Schema

ParametersJSON Schema

Name	Required	Description
`result`	Yes

TDQS

C2.3/5.0

Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It only says 'Health check.' with no details on side effects, output, or safety (e.g., read-only vs destructive).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Extremely concise (two words), but under-specified. It does not earn its place as it provides insufficient information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no parameters, no output schema provided, and a vague description, the tool definition is incomplete. The agent cannot determine what the tool returns or how to interpret the health check.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters, so schema coverage is 100%. The description adds no value beyond the schema, but baseline for 0 params is 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Health check.' is vague but not a tautology of the tool name. It implies a connectivity test but lacks specificity about what resource is checked or how it differs from sibling tools like ssh_describe_host.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs alternatives. It does not mention prerequisites, context, or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_planC

Show what would be executed and if policy allows.

ParametersJSON Schema

Name	Required	Description	Default
`alias`	No
`command`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
`result`	Yes

TDQS

C2.8/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description implies a read-only preview ('show') that checks policy, but since no annotations are provided, it should more explicitly state that no command is executed and that the tool is safe and idempotent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very concise (1 sentence) but lacks structure. It front-loads the purpose but omits key details about parameters and output. It is not overly verbose, but could be more informative without sacrificing brevity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 2 optional parameters, no annotations, and an output schema present, the description is insufficient. It should explain the preview nature, the condition of policy check, and what the output contains. The current description leaves many gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, and the tool description does not explain the purpose of 'alias' or 'command'. The name and context hint at their roles, but explicit semantic help is missing. Baseline would be 4 if schema covered, but here it does not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool shows what would be executed and whether policy allows, distinguishing it from execution tools like ssh_run. However, it does not mention the input parameters (alias, command) that define what is being planned.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No usage guidance is provided. The description does not indicate when to use this tool over siblings like ssh_run, nor does it mention prerequisites or that it should be used before execution.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_reload_configC

Reload configuration files.

ParametersJSON Schema

Name	Required	Description	Default
No parameters

Output Schema

ParametersJSON Schema

Name	Required	Description
`result`	Yes

TDQS

C2.9/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description must disclose all behavioral traits. It only says 'reload configuration files' without describing side effects (e.g., service restart), permission requirements, or error handling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Extremely concise (one sentence). While no extraneous information, the description is too minimal and could incorporate more context without becoming verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with no parameters and an output schema present, the description fails to mention return values, error conditions, or what configuration files are reloaded. Leaves gaps for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema has zero parameters, so baseline is 4. Description adds no parameter meaning but that is acceptable since none exist.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states the tool reloads configuration files. While the verb+resource is clear, it does not specify which configuration files (likely SSH) nor differentiate from siblings like ssh_run or ssh_ping.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. No mention of prerequisites, context, or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_runC

Execute SSH command with policy, network checks, progress, timeout, and cancellation.

ParametersJSON Schema

Name	Required	Description	Default
`alias`	No
`command`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
`result`	Yes

TDQS

C2.9/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so description bears full burden. It discloses policies, network checks, progress tracking, timeout, and cancellability, which are useful behavioral traits. However, it omits safety aspects (destructive potential?), required permissions, and failure behavior. Adequate but incomplete.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence is very concise, but it packs a long list of features ('policy, network checks, progress, timeout, and cancellation') which reduces readability. Could be split for clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given existence of siblings like `ssh_run_async`, `ssh_plan`, and the presence of an output schema, the description provides moderate context. It does not clarify the relationship to these siblings or when to choose this tool over others.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 2 parameters (`alias`, `command`) with 0% description coverage. The description adds no explanation of these parameters; it does not clarify what `alias` refers to (host alias?) or how `command` is used. Schema already lists names, but description fails to add semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Execute SSH command') and lists notable features (policy, network checks, progress, timeout, cancellation). It distinguishes from sibling `ssh_run_async` by implication (synchronous with timeout/cancellation), but does not explicitly differentiate from `ssh_run_on_tag` or justify when to use each.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs alternatives like `ssh_run_async` or `ssh_plan`. No prerequisites, context, or exclusion cases are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_run_asyncB

Start SSH command asynchronously (SEP-1686 compliant).

Returns immediately with task_id for polling. Use ssh_get_task_status
and ssh_get_task_result to monitor and retrieve results.

ParametersJSON Schema

Name	Required	Description	Default
`alias`	No
`command`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
`result`	Yes

TDQS

B3.3/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavioral traits. It mentions the return of a task_id and polling, but fails to describe side effects, error handling, destructive potential, or resource cleanup. This leaves significant gaps for an async operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise at three sentences with front-loaded purpose. However, it could benefit from including parameter details without sacrificing brevity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the low complexity (2 params, no nested objects) and presence of an output schema, the description covers the basic workflow but omits parameter explanations and important behavioral context, making it adequate but incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, and the tool description does not explain the two parameters ('alias' and 'command'). An agent cannot infer their meaning or usage from the description alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Start SSH command asynchronously', with verb 'Start' and resource 'SSH command', and distinguishes from synchronous alternatives like ssh_run and monitoring tools like ssh_get_task_status.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear context: 'Returns immediately with task_id for polling' and directs to use downstream tools for monitoring. Does not explicitly say when not to use, but implies synchronous alternative exists.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_run_on_tagC

Execute SSH command on all hosts with a tag (with network checks).

ParametersJSON Schema

Name	Required	Description	Default
`tag`	No
`command`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
`result`	Yes

TDQS

C2.9/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full burden. It mentions 'with network checks' but does not explain what these checks entail, their impact on execution, or any failure modes. This is insufficient for understanding behavioral traits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, avoid fluff. However, it is too concise given the lack of parameter details and no annotations; it omits essential context that a longer description could provide.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 2 parameters with no descriptions, no annotations, and a hidden output schema. The description does not explain return values, error handling, or the network check process. It is incomplete for effective use by an AI agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 0% description coverage, and the description only hints at 'tag' selecting hosts and 'command' being the command. It does not explain the format, allowed values, or semantics (e.g., what kind of tag, how multiple hosts are handled). Minimal added value over the schema titles.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's action: 'Execute SSH command on all hosts with a tag', specifying the verb and resource. It distinguishes from sibling tools like ssh_run (targets a single host) and ssh_run_async (async variant).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no explicit guidance on when to use this tool versus alternatives (e.g., ssh_run for a single host). The phrase 'with a tag' implies grouping, but there is no when-not-to-use or mention of other tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

13 tool updatesv1.0.0Jan 3, 2026
- Addedssh_cancel
- Addedssh_cancel_async_task
- Addedssh_describe_host
- Addedssh_get_task_output
- Addedssh_get_task_result
- Addedssh_get_task_status
- Addedssh_list_hosts
- Addedssh_ping
- Addedssh_plan
- Addedssh_reload_config
- Addedssh_run
- Addedssh_run_async
- Addedssh_run_on_tag

Install Server

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

B3.2/5.0

Disambiguation4/5

Most tools have distinct purposes. ssh_cancel and ssh_cancel_async_task could cause confusion, but their names and descriptions distinguish them. The three task retrieval tools (output, result, status) are well-differentiated.

Naming Consistency5/5

All tools follow a consistent ssh_verb_noun pattern with underscores. Naming is predictable and uniform, making it easy for agents to infer tool purpose.

Tool Count4/5

13 tools cover the core SSH orchestration functionality without being excessive. A few additional operations (e.g., adding hosts) could be justified, but the current count is well-scoped.

Completeness4/5

The tool set covers key workflows: listing/configuring hosts, running commands (sync/async/tag-based), and monitoring tasks. Missing host CRUD operations, but the domain appears focused on execution rather than inventory management.

Maintenance

ActivityStale

ResponsivenessSyncing

Resources

GitHub Repository

Need Help?

Reddit Discussion

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

emisarOAuth
dev.emisar
Let AI operate servers without SSH. Choose actions, approve risky changes, and audit every step.
Cloud Platforms Security Networking & Infrastructure
2354
browser-ssh
com.browserssh
Scoped, audited SSH exec, sessions, and SFTP on your saved servers without exposing credentials
Shell Access File Systems
2
SentinelX MCPOAuth
app.sentinelx
Operate Linux, macOS and Windows from your LLM. Every action runs through an auditable allowlist.
Shell Access OS Automation
26
agentlock
io.github.Olum289
Security gateway for AI agents: policy, approval, and audited execution, no secrets shared.
Security Agent Orchestration
2

Related MCP Servers

SSH MCP Server
Shell Access Code Execution
vilasone455
F
license
A
quality
D
maintenance
A local Model Context Protocol server that allows LLMs to securely execute shell commands on remote Linux and Windows systems via SSH connections.
Updated a year ago (2025-05-27 06:59 UTC)
6
17
2
-
OpenAccess MCP
Shell Access OS Automation Security
keepithuman
A
license
Not graded
quality
D
maintenance
Enables secure remote access operations through SSH, SFTP, rsync, VPN, and tunneling with enterprise-grade policy enforcement and audit logging. Provides AI assistants with secure, policy-driven access to remote systems while maintaining comprehensive audit trails and zero-trust security.
Updated a year ago (2025-09-02 01:43 UTC)
1
Apache 2.0
Shuttle
Shell Access Command Line
enwaiax
A
license
Not graded
quality
A
maintenance
Enables AI assistants to securely execute SSH commands on remote servers with connection pooling, session isolation, and a web audit panel.
Updated 15 days ago (2026-08-22 08:19 UTC)
3
MIT
Emisar
Agent Orchestration Security
AndrewDryga
F
license
Not graded
quality
A
maintenance
Give AI agents Zero-Trust access to production infrastructure without the risks of granting them shell access. Actions are bounded by policy and an on-host runner.
Updated 15 hours ago (2026-09-05 14:19 UTC)
354
-

Appeared in Searches

SSH (Secure Shell) information and resources

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/samerfarida/mcp-ssh-orchestrator'

If you have feedback or need assistance with the MCP directory API, please join our Discord server

What Problem Does This Solve?

Why This Matters

Zero-Trust Security Model

Prevents Common Attack Vectors

Production-Ready Audit & Security

Who Is This For?

Homelab Enthusiasts

Security Engineers

DevOps Teams

Platform Engineers

Real-World Use Cases

Scenario 1: Homelab Automation (Homelab Enthusiasts)

What happens

Scenario 2: Incident Response (DevOps Teams)

What happens

Scenario 3: Fleet-Wide Maintenance (Platform Engineers)

What happens

Quick Start

1. Prepare local configuration (one-time)

2. Launch the orchestrator container

3. Connect your MCP client

4. Test the connection

How Security Works (The Technical Details)

Defense-in-Depth Architecture

What Gets Blocked

What Gets Allowed (Examples)

Protection Against Real Threats

Documentation

Supply Chain Integrity

What Can AI Do With This? (MCP Tools)

Discovery & Planning

Execution

Monitoring & Control

Management

MCP Resources + Context

Learn More

Key Differentiators

What Users Are Saying

Contributing

License

Links

Available Tools

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Tool Schema Changelog

Maintenance

Resources

Looking for Admin?

Related MCP Connectors

Related MCP Servers

Appeared in Searches

Latest Blog Posts

MCP directory API