ssh_forward
Start an SSH tunnel that forwards local ports to remote services or remote ports to local services, enabling secure access across machines.
Instructions
Start a dedicated SSH port forward (local or remote). This is a separate tool from ssh_exec/ssh_start_session so MCP clients can permission-gate port forwarding independently. Use direction 'local' to make a remote service reachable on a local port, or 'remote' to expose a local service on the remote host.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| port | No | ||
| target | Yes | OpenSSH target such as host, alias, or user@host. | |
| direction | Yes | Forward direction. 'local' binds a local port that tunnels to a remote host:port. 'remote' binds a remote port that tunnels back to a local host:port. | |
| local_port | Yes | Port on the local side. | |
| remote_host | Yes | Destination host from the SSH server's perspective. | |
| remote_port | Yes | Destination port. | |
| bind_address | No | Address to bind on. Default: 127.0.0.1. Set to 0.0.0.0 to expose on all interfaces (use with caution). | |
| identity_file | No | ||
| extra_ssh_args | No | Additional ssh(1) flags passed verbatim, e.g. ["-J", "jumphost"]. Prefer the dedicated port, identity_file, and strict_host_key_checking parameters. | |
| known_hosts_file | No | ||
| strict_host_key_checking | No | Boolean or one of yes, no, ask, accept-new, off. |