SSH MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| key | No | Path to private SSH key | |
| host | Yes | Hostname or IP of the Linux or Windows server | |
| port | No | SSH port (default: 22) | 22 |
| user | Yes | SSH username | |
| timeout | No | Command execution timeout in milliseconds (default: 60000ms = 1 minute) | 60000 |
| maxChars | No | Maximum allowed characters for the command input (default: 1000). Use none or 0 to disable the limit. | 1000 |
| password | No | SSH password (or use key for key-based auth) | |
| suPassword | No | Password for su elevation (when you need a persistent root shell) | |
| disableSudo | No | Flag to disable the sudo-exec tool completely. Useful when sudo access is not needed or not available. | |
| sudoPassword | No | Password for sudo elevation (when executing commands with sudo) |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| resources | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| list-connectionsA | List all configured SSH profiles and their connection status. Use this to discover available hosts before running commands. |
| list-sessionsB | List active sessions for a given SSH profile. |
| open-sessionA | Open a named session on a remote host. Use type="interactive" for stateful shell (CWD/env persists between commands) or type="background" for long-running processes. |
| close-sessionA | Close a named session. A background session's command is signalled on the host (INT, then TERM, then KILL) before its channel is dropped; an interactive session's shell is ended. The response says so if the command could not be signalled or had not stopped in time. |
| read-session-outputA | Read recent output from a background session (e.g., tail -f logs). |
| read-commandA | Execute a READ-ONLY command from an allowlist (ls, cat, grep, find, stat, df, etc.). This tool does NOT modify the system. Prefer this tool for all read operations. |
| run-commandA | Execute an arbitrary shell command on the remote server. May modify the system. Commands classified destructive or privileged go through the approval gate; approvalPolicy on the profile decides whether that is a prompt, an automatic allow, or a refusal. |
| privileged-commandA | Execute a command with sudo elevation. Goes through the approval gate; approvalPolicy on the profile decides whether that is a prompt, an automatic allow, or a refusal. The sudo password is piped via stdin (never visible in process list). |
| signal-processA | Send a signal (INT, TERM, KILL) to a remote process by PID. |
| sftp-uploadA | Upload a file to the remote server via SFTP (secure file transfer, not shell-based). |
| sftp-downloadA | Download a file from the remote server via SFTP. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| connections | List all SSH profiles and their connection status |
TDQS
Scored across 11 tools
Most tools are clearly distinct: read-command vs run-command vs privileged-command have clear boundaries (read-only vs arbitrary vs sudo). However, list-connections and list-sessions could be confused; both are about listing, but one lists profiles, the other sessions within a profile. The descriptions help, but the tool names are close.
Tool names mix hyphenated (list-connections) and underscore conventions (open_session? Actually all are hyphenated). The naming pattern is verb-noun, e.g., list-connections, open-session, read-session-output, which is consistent. However, sftp-upload and sftp-download use a noun-verb pattern (sftp as noun, upload as verb) which is a minor deviation. Also, 'open-session' vs 'close-session' is symmetric, but 'read-session-output' is longer than others. Overall, mostly consistent but with a few deviations.
11 tools is within the ideal range for an SSH MCP server. Each tool covers a distinct aspect: connection/session management, execution (read/run/privileged), signal, and file transfer. The count feels appropriate, neither sparse nor bloated.
The tool surface covers the main lifecycle: connection discovery, session management, command execution with safety tiers, signaling, and file transfer. Minor gaps exist: no explicit tool for listing files (though read-command can do it), no session cleanup aside from close-session, and no sftp directory operations. But agents can work around these with run-command/read-command.