SSH MCP Server
MCP server that makes SSH work for AI agents — it fixes and inspects the local SSH environment, then runs remote commands and file operations over SSH/SFTP.
Remote command execution — run a shell command on one host (
ssh_exec, with per-call timeouts andenvvars) or fan out across many hosts in parallel (ssh_multi_exec).SFTP file management — read (whole file or paged), write, upload, download, list, stat, mkdir (incl. recursive), and delete files/empty directories.
SSH environment management — ensure
ssh-agentis running, list keys with fingerprints/agent status, load a key, resolve effective config, refresh staleknown_hostsentries, and test connectivity or Git-over-SSH auth.Diagnostics —
ssh_diagnosechecks agent, keys, config, known_hosts, and connectivity, returning exact fix commands; failures elsewhere auto-include diagnostics.Higher-level remote helpers — structured
find,tail(optional grep filter), and systemd service status instead of hand-built commands.Operational niceties — connection pooling/reuse,
~/.ssh/configand ProxyJump support, host-key verification with optional strict mode, key/password/agent auth, and optional command whitelist/blacklist (applies tossh_exec/ssh_multi_execonly).
Facilitates Ansible deployments by managing SSH keys, agent, and connectivity, resolving host key issues and ensuring reliable SSH access to target hosts.
Ensures Git-over-SSH authentication to Bitbucket by managing SSH keys, diagnosing permission errors, and fixing known host key issues so that git pull/push/clone works.
Enables Composer to install packages from private repositories over SSH by loading the correct SSH keys into the agent and diagnosing authentication failures.
Supports SSH access to DigitalOcean droplets by managing SSH keys, host keys, and providing diagnostics to resolve connection issues.
Resolves Git-over-SSH authentication failures for clone, pull, push, and other operations by managing the SSH agent, keys, and known hosts.
Ensures Git-over-SSH authentication to GitHub by managing SSH keys, diagnosing permission errors, and fixing known host key issues.
Ensures Git-over-SSH authentication to GitLab by managing SSH keys, diagnosing permission errors, and fixing known host key issues.
Enables npm to install packages from private registries over SSH by managing SSH agent, keys, and resolving authentication failures.
Facilitates Terraform operations on remote hosts by managing SSH keys, agent, and connectivity diagnostics to ensure secure and reliable access.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@SSH MCP Serverrun df -h on my production server"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
@yawlabs/ssh-mcp
One click adds this to your local Yaw MCP config so it's available in every Yaw Terminal session. Or install manually below.
Make SSH work for AI tools. MCP server that manages your SSH environment, diagnoses what's broken, fixes it, and gives your agent remote access to anything.
Built and maintained by Yaw Labs.
The problem
AI CLI tools run in subprocesses where SSH is constantly broken. The agent tries to git pull and gets Permission denied (publickey). It tries to SSH into a server and the agent socket is stale. It tries to deploy and the host key changed because the instance was recreated. Every time, the AI has no idea what's wrong and spirals.
This happens across every situation that needs SSH keys:
Git — clone, pull, push, fetch, submodules, LFS
Package managers —
npm install,pip install,go get,cargo,composerfrom private reposServer access — SSH, SCP, SFTP, rsync
Tunneling — port forwarding to databases, SOCKS proxies
Deployment — Ansible, Terraform, Capistrano, deploy scripts
Cloud — AWS EC2, GCP, Azure, DigitalOcean, any VPS
ssh-mcp fixes this. It manages the SSH agent, loads keys, diagnoses failures with actionable fix commands, and provides remote operations — all as MCP tools your AI agent can call.
Related MCP server: Scout MCP
Quick start
Add to your MCP client config:
{
"mcpServers": {
"ssh": {
"command": "npx",
"args": ["-y", "@yawlabs/ssh-mcp@latest"]
}
}
}On Windows wrap with cmd /c since Node 20+ can't spawn .cmd files directly:
{
"mcpServers": {
"ssh": {
"command": "cmd",
"args": ["/c", "npx", "-y", "@yawlabs/ssh-mcp@latest"]
}
}
}The @latest tag makes npx re-resolve against the registry on every spawn, so each MCP session uses the newest published version. Or install globally if you'd rather pin (no auto-update):
npm install -g @yawlabs/ssh-mcp
# then in client config: "command": "ssh-mcp"Tools
SSH environment management
Tools that fix your local SSH setup so everything else — git, deploys, tunnels — stops breaking.
Tool | Description |
| Ensure ssh-agent is running. Starts one if needed and sets env vars for the session. |
| List all SSH keys in ~/.ssh/ with type, fingerprint, and agent status. |
| Load a key into the running agent. Ensures the agent is started first. |
| Resolve the effective SSH config for a host (hostname, user, port, proxy, identity files). |
| Remove a stale host key and re-scan. Fixes "host key verification failed" errors. |
| Test Git-over-SSH auth to GitHub, GitLab, Bitbucket, etc. |
| Quick connectivity test with timing and actionable error details. |
Diagnostics
Tool | Description |
| Full SSH environment diagnostic. Checks agent, keys, config, known_hosts, and connectivity. Returns exact fix commands for every failure. |
Remote operations
Tool | Description |
| Execute a command on a remote host. Returns up to three content blocks, status first: |
| Read a file from a remote host via SFTP (whole file up to 10 MB). Optional |
| Write content to a file on a remote host via SFTP. |
| Upload a local file to a remote host via SFTP. |
| Download a file from a remote host to local filesystem. |
| List files in a directory on a remote host. |
| Get metadata for a file or directory (size, mode in octal, uid/gid, mtime/atime, isFile/isDirectory/isSymbolicLink). Use instead of parsing |
| Create a directory via SFTP. Set |
| Delete a file or empty directory via SFTP. Auto-dispatches unlink vs rmdir based on the path's own type ( |
Higher-level operations
Tools that wrap common patterns agents build with ssh_exec — faster and less error-prone.
Tool | Description |
| Run a command on multiple hosts in parallel. Returns results per host. Optional |
| Search for files remotely with structured parameters ( |
| Read the last N lines of a file, optionally filtered by a grep pattern. |
| Check systemd service status (active, PID, uptime, description). Flags |
Auto-diagnostics
When any remote operation fails, ssh-mcp automatically runs diagnostics and includes the results in the error response. Your agent doesn't need to call ssh_diagnose separately — it gets told what's wrong and how to fix it right in the error message.
Connection pooling
Remote operations reuse SSH connections automatically. When your agent makes multiple calls to the same host, the first call opens a connection and subsequent calls reuse it. Connections are kept alive for 60 seconds after the last use, then closed automatically.
The pool caps at 100 connections by default, and a connection still being dialed counts against the cap. When the cap is reached the pool closes an idle connection to make room. If every slot is in use or dialing, a tool call waits for one instead of failing:
A single-host remote tool (
ssh_exec, the SFTP tools,ssh_find,ssh_tail,ssh_service_status) waits up to itstimeout(30s for the SFTP tools, which have notimeoutparameter) and is next in line for the first slot that frees, so anssh_execarriving in the middle of a widessh_multi_execruns between two of its hosts rather than being refused for the whole run. It reportsConnection pool is fullonly if it never won a slot in that time.ssh_multi_execruns at mostSSH_MCP_MAX_POOL_SIZEhosts at once (default 100) and works through a longer list as slots free up, so raising the cap raises its parallelism;timeoutis per host, not a bound on the whole call. When the pool is full it waits, and gives up only when none of its own hosts holds a slot and a fulltimeouthas passed with none of them starting or finishing. The hosts waiting at that point (up to one per parallel slot) and every host still queued then reportConnection pool is full; the queued ones are never attempted.
A call reaches Connection pool is full only when other calls — a long ssh_exec, a concurrent ssh_multi_exec — kept every slot from it for a full timeout; a fan-out wider than the cap that has the pool to itself never does, however long it runs. If you see it, rerun once those calls finish (for ssh_multi_exec, the hosts that reported it), or raise the cap with SSH_MCP_MAX_POOL_SIZE=<n> in the server's environment. The error names the variable.
The library's acquire() / withConnection() do not wait by default: they reject at once with a PoolFullError (code: "ERR_SSH_MCP_POOL_FULL", isPoolFullError()) unless you pass { waitForCapacityMs } — see Programmatic usage.
SSH config support
All connections respect your ~/.ssh/config. Host aliases, custom ports, usernames, identity files, and ProxyJump settings are used automatically. If you have Host myserver configured in your SSH config, just pass host: "myserver" — ssh-mcp resolves everything.
ProxyJump / bastion hosts are supported automatically. If your SSH config has ProxyJump bastion for a host, ssh-mcp connects through the bastion transparently. Chained proxies work too.
Host key verification
All remote operations verify the server's host key against ~/.ssh/known_hosts:
Known host, key matches — accept.
Known host, key changed — reject (MITM protection). The rejection message distinguishes a genuine key mismatch from "the server offered a key type your
known_hostsentry doesn't cover", so a missing ed25519 line doesn't read as an attack.Unknown host — accept, unless strict mode is on (
SSH_MCP_STRICT_HOSTKEYS=1).
That last branch is trust-always, not TOFU. Real trust-on-first-use pins the key it saw the first time and rejects a change afterwards. The connection path never writes to known_hosts — no tool adds an entry as a side effect of connecting — so connecting pins nothing: every connection to a host absent from known_hosts is a "first" use and is accepted, including one where an attacker swapped the key since your last call. Only hosts put into known_hosts out of band get mismatch protection — by you, by ssh-keyscan, or by ssh_known_hosts_fix, the one tool here that does write the file. Call it explicitly to add an entry so future changes are caught.
For stricter environments, set SSH_MCP_STRICT_HOSTKEYS=1 (or true, case-insensitive) to reject unknown hosts. Add them explicitly with ssh_known_hosts_fix first. The older name SSH_MCP_STRICT_HOST_KEY still works and accepts the same values, but prefer the new one: credential scanners such as Yaw MCP's doctor treat any name with a _KEY segment as a secret, and flag the old name as a plaintext credential.
The diagnostic tools (ssh_test, ssh_diagnose) use StrictHostKeyChecking=no for their probe commands. Those probes only run echo SSH_OK — no credentials or data pass through — so the relaxed setting is safe for connectivity testing. Real operations always go through the hostVerifier.
Command policy
ssh_exec and ssh_multi_exec accept free-form shell commands from the agent. For security-conscious deployments, you can restrict which commands run via two env vars, each accepting a comma-separated list of regex patterns:
SSH_MCP_COMMAND_WHITELIST— if set, the command must match at least one pattern, else it's blocked.SSH_MCP_COMMAND_BLACKLIST— if set, the command must not match any pattern, else it's blocked.
When both are set, the command must pass both checks (whitelist first, then blacklist). When neither is set (the default), all commands are allowed.
Patterns are JavaScript regexes. Use ^ and $ for anchored matches; otherwise patterns are treated as substring matches. Commas are the delimiter, so a literal comma in a pattern needs to be expressed as \x2c or via a character class.
# Read-only allowlist: only ls / df / cat / find / tail
SSH_MCP_COMMAND_WHITELIST="^ls( .*)?,^df( .*)?,^cat ,^find ,^tail "
# Block destructive ops even if your agent goes off-script
SSH_MCP_COMMAND_BLACKLIST="^rm ,^shutdown,^reboot,^mkfs,^dd if=,>\s*/dev/"Blocked commands surface as a clear error mentioning which pattern (or which env var) rejected the call, so the agent can adapt rather than guess. Policy is enforced before the SSH connection opens — no remote process is started for a blocked command.
Scope: policy covers ssh_exec and ssh_multi_exec only
Every other tool runs unchecked. That splits into two very different cases.
The structured read tools are all exempt, but for two different reasons — they don't reach the remote the same way.
ssh_find, ssh_tail and ssh_service_status do build a shell command (find, tail, systemctl), but from typed parameters with every interpolated value shell-quoted, never from free-form agent input. They're exempt for ergonomics: a tight ^ls whitelist would otherwise force you to allow ^find , ^tail , ^systemctl just to keep those tools working — defeating the point of a tight whitelist.
ssh_ls, ssh_stat, ssh_read_file and ssh_download build no command at all. They're pure SFTP (readdir, stat, readFile, fastGet), so — exactly like the mutating SFTP tools below — there is no command string for a regex to match, and these env vars could not gate them even if you wanted them to. They're grouped with the reads rather than flagged as a gap because they don't mutate remote state. One caveat: ssh_download is non-mutating on the remote only — it writes to whatever local path it's handed, and these env vars don't constrain that either.
The SFTP tools that mutate remote state are also unchecked, and that is a genuine gap — not an ergonomics call. ssh_write_file, ssh_upload, ssh_mkdir, and ssh_delete never build a shell command string, so a command-shaped regex has nothing to match. Concretely: SSH_MCP_COMMAND_BLACKLIST="^rm " does not stop ssh_delete, and SSH_MCP_COMMAND_WHITELIST="^ls " does not stop ssh_write_file. Closing this would need a separate path-policy mechanism, which this server deliberately does not have. If you must prevent remote mutation, drop those four tools from your MCP client's tool allowlist (or run a client that gates them) — these two env vars cannot do it.
Policy interaction with the env parameter (ssh_exec, ssh_multi_exec)
When ssh_exec or ssh_multi_exec is called with env: { KEY: "value" }, the values are injected as a KEY='value' ... shell prefix before the command (see the tool descriptions). Policy is checked against the full prefixed command, not the bare command argument — once, before fan-out, in the ssh_multi_exec case. That's the safer ordering at the protocol layer — but it means whitelist patterns need to anticipate the prefix and must be anchored, not substring matches:
# WRONG -- blocks any ssh_exec call that uses `env`, because the final command
# starts with `KEY='value' ` and never matches `^ls`.
SSH_MCP_COMMAND_WHITELIST="^ls "
# RIGHT -- allow zero or more `KEY='value' ` prefixes before the real command.
SSH_MCP_COMMAND_WHITELIST="^([A-Za-z_][A-Za-z0-9_]*='[^']*' )*ls( |$)"You don't have to diagnose this from a bare rejection: when a whitelist blocks a call that used env, the error appends a note explaining that the prefix is why the ^ anchor stopped matching, and suggests the tolerant pattern above.
Avoid substring-match patterns like ls if you're worried about a hostile agent. An agent could pass env: { ATTACK: " ls " } to make the final command ATTACK=' ls ' rm -rf /, which matches a substring ls and bypasses the whitelist. Anchored patterns of the form above don't have this weakness because they require the real command name to follow the env-prefix block, not appear inside a quoted env value.
Blacklists need the same care. ^rm blocks a bare rm call, but doesn't block FOO='bar' rm. Use the same env-prefix-tolerant anchor:
SSH_MCP_COMMAND_BLACKLIST="^([A-Za-z_][A-Za-z0-9_]*='[^']*' )*rm( |$)"If you don't trust the agent's env values at all, the simplest mitigation is to leave env unused in your client config and pass everything through the command string yourself.
Windows support
On Windows, ssh-mcp uses the OpenSSH Authentication Agent's \\.\pipe\openssh-ssh-agent named pipe automatically when SSH_AUTH_SOCK is not set. No SSH_AUTH_SOCK needed — just make sure the OpenSSH agent service is running.
On the oam runtime, the launcher serves only on oam 0.19.1 or newer. Agent auth needs a net that can dial a named pipe or a Unix socket (that is how ssh2 reaches the agent), which older oam releases could not do. On oam 0.19.1 (Windows) the MCP handshake, ssh_config_lookup, ssh_key_list and ssh_agent_ensure were verified through the launcher, and ssh2's own agent client was verified dialing a named pipe and listing identities. An agent-only ssh_exec end to end has so far been verified on Node only. If agent auth fails on oam, set SSH_MCP_RUNTIME=node to rule the runtime out.
ssh_agent_ensure and ssh_diagnose probe that pipe and tell you if the service is down. Remote operations do not: they assume the pipe and let the connection fail on its own if the agent isn't there. That is why a stopped agent service shows up as an auth failure rather than an "agent not running" error until you run the diagnostic tools.
Authentication
All remote operations accept connection parameters:
Parameter | Description | Default |
| SSH hostname or IP (required) | — |
| SSH port | From SSH config or |
| SSH username | From SSH config or current user |
| Path to SSH private key | Auto-detect |
| SSH password (prefer keys) | — |
Auth resolution. An explicit credential wins outright and nothing else is offered. With neither given, ssh-mcp offers the ssh-agent and one on-disk key together — the way the OpenSSH client does — and lets the server pick during the auth exchange. It is not a strict first-match chain past step 2.
Explicit
privateKeyPath— used alone. The agent is not offered and no other key is read.Explicit
password— used alone, same as above.Neither given — both of the following are configured on the same connection:
ssh-agent —
SSH_AUTH_SOCK, or on Windows the\\.\pipe\openssh-ssh-agentnamed pipe. The Windows pipe is assumed unconditionally; ssh-mcp does not check that the OpenSSH Authentication Agent service is actually running.One on-disk key — the first readable path in
ssh -G <host>'sidentityfilelist. OpenSSH emits that list for every host, including one with noIdentityFileline (it defaults to~/.ssh/id_rsa,id_ecdsa,id_ecdsa_sk,id_ed25519,id_ed25519_sk), so this is the normal path — not a path reserved for hosts you configured an identity for. ssh-mcp's own built-in list (~/.ssh/id_ed25519,id_rsa,id_ecdsa) is a fallback used only whenssh -Gcannot run at all, e.g. no SSH client installed.
Two things worth knowing about step 3:
Only one on-disk key is ever offered — the first candidate that exists. ssh-mcp does not walk the whole identity list the way
sshdoes, so if the first readable key is the wrong one, authentication rests on the agent's keys. PassprivateKeyPathto force a specific key.When an agent is configured, an encrypted on-disk key is skipped and the scan moves to the next candidate. The underlying ssh2 library parses
privateKeyeagerly and errors with "no passphrase given" on an encrypted key, which would break the common setup of an encrypted key on disk with its decrypted copy loaded in the agent. With no agent configured, the first existing key is loaded regardless of encryption and ssh2 surfaces the passphrase error itself. Because the Windows pipe above is assumed unconditionally, the skip is always in force on Windows.
Example workflows
Agent can't git pull
Agent calls ssh_git_check → "Permission denied. Your SSH key is not registered with github.com."
Agent calls ssh_key_list → finds id_ed25519 exists but is not loaded
Agent calls ssh_key_load("~/.ssh/id_ed25519") → "Key loaded"
Agent calls ssh_git_check → "Git SSH authentication to github.com succeeded as username"
Agent runs git pull → worksHost key changed after instance recreation
Agent calls ssh_exec on server → error: "Host key verification failed"
(auto-diagnostics included in error: "Fix with ssh_known_hosts_fix")
Agent calls ssh_known_hosts_fix("my-server") → "Host key refreshed"
Agent calls ssh_exec → worksFirst-time connection to a new server
Agent calls ssh_test("new-server") → "Connection refused at new-server:22"
Agent calls ssh_diagnose("new-server") → full report showing agent running, keys loaded, but host unreachable
Agent reports: "SSH server isn't running on new-server or port 22 is blocked"Programmatic usage
import { connect, exec, diagnose, ensureAgent, listSshKeys, checkGitSsh, ConnectionPool, isPoolFullError } from '@yawlabs/ssh-mcp';
// Fix SSH environment
const agent = ensureAgent();
console.log(agent.message);
// Check git access
const git = checkGitSsh('github.com');
console.log(git.message);
// List available keys
const keys = listSshKeys();
for (const key of keys) {
console.log(`${key.name} (${key.type}) - ${key.loadedInAgent ? 'loaded' : 'not loaded'}`);
}
// Run a remote command (one-off)
const client = await connect({ host: 'my-server', username: 'deploy' });
const result = await exec(client, 'uptime');
console.log(result.stdout);
client.end();
// Run multiple commands with connection pooling
const pool = new ConnectionPool();
await pool.withConnection({ host: 'my-server' }, async (client) => {
const r1 = await exec(client, 'uptime');
console.log(r1.stdout);
});
// Connection stays open for 60s — next call reuses it
await pool.withConnection({ host: 'my-server' }, async (client) => {
const r2 = await exec(client, 'df -h');
console.log(r2.stdout);
});
// A full pool rejects at once with a PoolFullError; pass a budget to wait for a slot
// instead, the way the tools do, and match the rejection on its code, not its text
try {
await pool.withConnection(
{ host: 'other-server' },
async (client) => {
const r3 = await exec(client, 'uptime');
console.log(r3.stdout);
},
{ waitForCapacityMs: 30_000 },
);
} catch (err) {
if (!isPoolFullError(err)) throw err;
console.log('no slot within 30s:', err.message);
}
pool.drain(); // close all connections when done
// Diagnose issues
const report = diagnose('my-server');
console.log(report.overall); // "ok" | "warning" | "error"
for (const check of report.checks) {
console.log(`[${check.status}] ${check.name}: ${check.message}`);
}Runtime selection
The ssh-mcp command — what npx @yawlabs/ssh-mcp runs — is a small launcher. It prefers the oam runtime and otherwise runs the server on Node, so oam is optional. Its minimum is the latest oam release, currently 0.19.1, and it never serves on an older oam.
Two environment variables control the choice; set them in your MCP client's env block:
SSH_MCP_RUNTIME— which runtime to use. Case-insensitive; any value other thanoamornodebehaves asauto.auto(default) — use the newest oam it can find at 0.19.1 or newer, otherwise run on Node.oam— require oam. Fails loudly: if no usable oam is found, the launcher prints what it found and why each one was passed over to stderr, and exits with status 1 instead of starting the server.node— always Node. The launcher does not look for oam, andOAM_BINis ignored.
OAM_BIN— path to an oam binary to use in preference to discovery, when it is 0.19.1 or newer. If it does not exist, is older, will not run, or does not answer--versionwith oam's ownoam x.y.zbanner (another program's version, such as Node'sv22.x.y, does not count), the launcher says so on stderr and carries on with discovery.
Discovery looks in $OAM_INSTALL_DIR (when set — the oam installer's install target), then %LOCALAPPDATA%\oam\bin (Windows only), then ~/.oam/bin, then every directory on PATH; asks every oam binary it finds for its version, counting only an answer that carries oam's own oam x.y.z banner; and uses the newest one at 0.19.1 or newer. On a tie the one found first wins, so an installed copy beats one on PATH. On Windows only oam.exe counts: an oam.cmd/oam.bat shim on PATH is never run, and is named on stderr when no usable oam is found.
By default an unusable oam is not an error. When Node starts the launcher (npx or a global install, run directly by your MCP client), auto mode falls back to Node — silently when there was nothing to find, or with a note on stderr naming each oam (and OAM_BIN) it passed over and why: older than 0.19.1, not runnable, or a shim. A chosen oam that then fails to start is named on stderr too. When an older oam starts the launcher, the handoff to Node is always noted on stderr (see below). With SSH_MCP_RUNTIME=oam, each of these cases exits with status 1 instead.
When the launcher is itself started by oam (oam run <path>/bin/ssh-mcp.mjs, which is how Yaw MCP starts an npx @yawlabs/ssh-mcp entry when a recent oam is installed):
On oam 0.19.1 or newer it runs the server on that oam, in the same process. Nothing is discovered or spawned,
OAM_BINis not read, andSSH_MCP_RUNTIME=oamcounts it as the oam it requires.On an older oam it never runs the server there. It hands the server off to the newest usable oam it can find, or to Node on
PATH, or exits with status 1 when there is neither (SSH_MCP_RUNTIME=oamexits with status 1 rather than handing off to Node).With
SSH_MCP_RUNTIME=nodeit hands the server off to Node onPATH, whatever the oam version.
Whenever an oam host starts a child (the handoffs above), the launcher removes --permission and --allow-* flags from the child's inherited NODE_OPTIONS. oam (since 0.18.0) adds its own permission flags to every child's NODE_OPTIONS, and Node refuses some of them there (--allow-net is not allowed in NODE_OPTIONS, exit 9); this server is not sandboxed, so there is nothing to pass on. An oam that was itself started with --permission re-adds the flags inside spawn(), which the launcher cannot undo, so do not start it that way.
For example, to always run on Node:
{
"mcpServers": {
"ssh": {
"command": "npx",
"args": ["-y", "@yawlabs/ssh-mcp@latest"],
"env": { "SSH_MCP_RUNTIME": "node" }
}
}
}On Windows, add the same env block to the cmd /c form from Quick start.
Requirements
Node.js 18+
SSH client installed (for diagnostics and environment management)
Optional: oam 0.19.1+ — see Runtime selection
License
MIT
Available Tools
21 toolsssh_agent_ensureA
Ensure ssh-agent is running and reachable. Starts a new agent if needed and sets environment variables so subsequent SSH operations work. Use this FIRST when SSH operations fail with agent-related errors.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the full burden of behavioral disclosure. It reveals that it starts a new agent if needed and sets environment variables, which is the core behavior. However, it does not elaborate on potential side effects (e.g., environment persistence, failure handling, or whether it modifies the current shell or system-wide settings). This is adequate but not fully transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the primary purpose ('Ensure ssh-agent is running and reachable'), followed by a concise explanation and usage trigger. No wasted words; every sentence adds necessary information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no parameters and no output schema, the description fully covers what it does and when to use it. It explains the action (starting agent, setting env vars) and the trigger condition. There are no missing details that an agent would need to correctly select and call this tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. The description adds no parameter-specific detail (none needed), and the schema already has full coverage with an empty properties object. No additional semantic clarification is required.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: ensuring ssh-agent is running and reachable, starting a new agent if needed, and setting environment variables. The verb 'ensure' and resource 'ssh-agent' are specific, and it distinguishes from sibling tools that focus on file operations, execution, or diagnostics.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides an explicit trigger condition: 'Use this FIRST when SSH operations fail with agent-related errors.' This gives clear context for when to invoke the tool, though it does not explicitly mention when not to use it or suggest alternatives (e.g., other diagnostics).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_config_lookupARead-only
Resolve the effective SSH configuration for a host. Shows hostname, user, port, identity files, proxy settings, and all other options from ~/.ssh/config. Use this to understand how SSH will connect to a host.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | SSH hostname or IP address |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so safety is covered. The description adds real information beyond them: the data source (~/.ssh/config) and the fact that it reports the *effective* merged configuration, which tells the agent it is a local, non-mutating resolution rather than a live connection test.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the action and the returned fields. The trailing 'and all other options from ~/.ssh/config' is slightly redundant after the enumeration, but nothing is bloat.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
A single-parameter, read-only, no-output-schema tool; the description plus annotations plus fully documented schema cover what an agent needs to call it correctly. Only the alias-vs-hostname resolution semantics are unstated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single required `host` parameter, so baseline is 3. The description does not clarify whether `host` must be a literal Host alias from config or can be an arbitrary hostname/IP subject to wildcard matching — the one semantic point that would add value here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Resolve the effective SSH configuration for a host') and enumerates the returned fields (hostname, user, port, identity files, proxy settings), which separates it from the exec/file-oriented siblings. It does not, however, explicitly distinguish itself from the closest conceptual neighbor, ssh_diagnose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Use this to understand how SSH will connect to a host' gives an implied context but largely restates the purpose sentence. There is no when-not guidance and no mention of ssh_diagnose or ssh_test as alternatives for connection problems.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_deleteADestructive
Delete a file or empty directory on a remote host via SFTP. Auto-detects the path type and calls the right SFTP op (unlink for files/symlinks, rmdir for empty dirs). Recursive directory delete is intentionally NOT supported -- for that, use ssh_exec with rm -rf explicitly so the destructive intent is visible in the tool trace. If the connection pool is full (SSH_MCP_MAX_POOL_SIZE, default 100), waits up to 30s for a free slot before starting. NOT gated by SSH_MCP_COMMAND_WHITELIST / SSH_MCP_COMMAND_BLACKLIST: command policy applies only to ssh_exec and ssh_multi_exec, so a blacklist such as ^rm does NOT block this tool.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | SSH hostname or IP address | |
| path | Yes | Absolute path of the file or empty directory to delete. Must start with /. | |
| port | No | SSH port (default: 22) | |
| password | No | SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process. | |
| username | No | SSH username (default: current user) | |
| privateKeyPath | No | Path to SSH private key |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and openWorldHint=true, and the description adds context annotations cannot express: path-type auto-detection, the deliberate refusal to recurse, and the 30s pool-wait behavior when SSH_MCP_MAX_POOL_SIZE is exhausted. The only gap is that it does not say what happens on failure (e.g., whether a non-empty directory is rejected with a specific error), so a 4 rather than 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action, then the failure-mode caveat, then the routing alternative, then the operational footnote. Every sentence carries non-redundant information an agent needs: none is filler, and length is justified by the number of distinct behavioral traits disclosed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description must carry the full behavioral picture for a destructive SFTP operation, and it does: what is deleted, what is refused, where to go for recursion, pool-wait behavior, and policy exemption. Nothing an agent needs to call it safely and correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% -- host, path, port, username, password, and privateKeyPath are all documented with defaults and security warnings in the schema itself. The description adds only that the path type is auto-detected, which mildly supplements the `path` param but does not restate or extend the others. Baseline 3 applies when the schema carries this much detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Delete') and resource ('a file or empty directory on a remote host via SFTP') and immediately distinguishes itself from siblings by naming ssh_exec as the recursive-delete path and enumerating the exact SFTP ops used (unlink vs rmdir). An agent can separate this from ssh_mkdir, ssh_write_file, and ssh_exec without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit when/when-not pair: use this for files and empty dirs, do NOT use it for recursive deletes -- use ssh_exec with `rm -rf` instead. It also clarifies the scope of command policy (whitelist/blacklist apply only to ssh_exec and ssh_multi_exec), which prevents the agent from wrongly assuming a blacklist guards this call.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_diagnoseARead-only
Diagnose SSH connectivity issues. Checks ssh-agent status, loaded keys, known_hosts, SSH config, and attempts a test connection. Use this BEFORE attempting SSH operations if you suspect connectivity issues, or AFTER a failed SSH operation to understand why it failed.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | SSH hostname or IP address | |
| port | No | SSH port (default: 22) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true and openWorldHint=true; the description is consistent with that, disclosing that it opens a live connection ("attempts a test connection") and enumerates every probe it runs, which is real value beyond the annotations. It does not say whether the tool always returns diagnostics rather than erroring on a failed connection, nor whether it has notable latency from the network probe.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences: the first names the purpose, the second enumerates what is checked, the third gives the when-to-use conditions. The intent is front-loaded and no sentence is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With only two parameters, one required, and a clear enumeration of probes, the description is sufficient to call it correctly. The one gap is that no output schema exists, so the agent is not told the shape of the diagnostics (per-check pass/fail vs. free-form) nor what is returned when the test connection fails.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and both parameters (host, port) are documented with defaults in the schema, so the schema carries the burden. The description adds no host/port semantics such as whether to pass a hostname from config or whether the port affects all checks, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Diagnose SSH connectivity issues") and enumerates the concrete checks performed (agent status, keys, known_hosts, config, test connection), so an agent knows exactly what it does. It does not, however, distinguish itself from overlapping siblings such as ssh_test, ssh_agent_ensure, ssh_config_lookup, or ssh_known_hosts_fix, which cover a subset of the same ground.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly gives both timing conditions: use BEFORE SSH operations when connectivity is suspect, or AFTER a failure to diagnose. That is a clear, actionable trigger. It stops short of naming alternatives (e.g. "use ssh_test for a single quick reachability check; use ssh_agent_ensure if you only need the agent running").
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_downloadA
Download a file from a remote host to local filesystem via SFTP. If the connection pool is full (SSH_MCP_MAX_POOL_SIZE, default 100), waits up to 30s for a free slot before starting.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | SSH hostname or IP address | |
| port | No | SSH port (default: 22) | |
| password | No | SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process. | |
| username | No | SSH username (default: current user) | |
| localPath | Yes | Local path to save the downloaded file | |
| remotePath | Yes | Absolute path to the remote file. Must start with /. | |
| privateKeyPath | No | Path to SSH private key |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It usefully discloses connection pool behavior: waiting up to 30s when the pool is full and honoring SSH_MCP_MAX_POOL_SIZE. However, it does not disclose other important behavioral traits such as whether an existing local file is overwritten, authentication requirements beyond the schema, or failure/error behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no filler. The core purpose is front-loaded, and the operational detail about pool wait behavior is separated cleanly. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no annotations, the description should cover key operational behavior. It covers purpose and pool waiting, and the schema handles parameter semantics, but it omits what happens on local file conflicts, return values, and explicit guidance for choosing between download and read/upload alternatives. This leaves moderate gaps for an agent deciding how to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 7 parameters including defaults, required fields, the absolute path constraint for remotePath, and the password plaintext warning. The description adds no parameter-level detail beyond indicating the source and destination, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a precise action: 'Download a file from a remote host to local filesystem via SFTP.' It specifies both direction (remote to local) and transport (SFTP), which clearly distinguishes it from siblings like ssh_upload, ssh_read_file, and ssh_write_file.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool—whenever a file needs to be downloaded from a remote host—but provides no explicit guidance about alternatives or when not to use it. It does not mention that ssh_read_file or ssh_exec might be better for reading file contents without copying to local disk.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_execA
Execute a command on a remote host via SSH. The command is interpreted by the remote login shell — pipes, redirects, globs, and other shell metacharacters work as expected. Returns up to three content blocks in this order: the status ([exit code: N], plus the signal and any truncation), then [stderr], then [stdout]. Status comes first so a proxy that cuts long results (Yaw MCP keeps about 100 KB) never drops the exit code; for big output, filter or page on the remote (head, tail, grep). Use env to set environment variables for this call without modifying the command string. Subject to SSH_MCP_COMMAND_WHITELIST / SSH_MCP_COMMAND_BLACKLIST if configured (policy is checked against the env-prefixed command).
| Name | Required | Description | Default |
|---|---|---|---|
| env | No | Environment variables to set for this command. Injected as a `KEY='value' ...` prefix; works on any sshd regardless of AcceptEnv config. VALUES are POSIX-single-quoted, so any byte is safe in a value. KEYS cannot be quoted (a shell assignment prefix requires a bare name), so each key must match /^[A-Za-z_][A-Za-z0-9_]*$/ (the POSIX name grammar) — a key outside that grammar is rejected and the call fails before anything is sent to a host. Command policy is checked against the PREFIXED command, so a `^`-anchored whitelist pattern stops matching once this is set. | |
| host | Yes | SSH hostname or IP address | |
| port | No | SSH port (default: 22) | |
| command | Yes | Shell command to execute on the remote host (interpreted by the remote login shell) | |
| timeout | No | Command timeout in milliseconds (default: 30000). Also the longest the call waits for a free connection-pool slot (SSH_MCP_MAX_POOL_SIZE, default 100) before the command starts; the wait and the command are bounded separately. | |
| password | No | SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process. | |
| username | No | SSH username (default: current user) | |
| privateKeyPath | No | Path to SSH private key |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so well: it discloses the exact three-block return ordering, the rationale for status-first (proxy truncation near 100 KB), and that SSH_MCP_COMMAND_WHITELIST/BLACKLIST may reject the call. These are non-obvious behaviors an agent cannot get from schema or annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action, then layered with return format, truncation rationale, and policy notes — each sentence adds information. Slightly dense with implementation-specific detail (the ~100 KB Yaw MCP figure) that could be trimmed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 8-parameter, nested-object tool with no output schema and no annotations, the description covers what an agent needs: execution semantics, return block layout, truncation behavior, output-size mitigation, env injection, and policy enforcement. Nothing critical to a correct call is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents host, port, timeout, password, and the env quoting/grammar rules in detail. The description only adds the note that policy is checked against the env-prefixed command, which is largely duplicative of the env property's own text.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Execute a command on a remote host via SSH") and clarifies that the remote login shell interprets metacharacters. It never names a sibling, so an agent must infer that ssh_read_file/ssh_write_file/ssh_ls are the narrower alternatives for those operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage guidance is implied rather than explicit: it recommends remote-side filtering (head, tail, grep) for large output and explains `env` for per-call variables, but never says when to prefer ssh_exec over ssh_multi_exec, ssh_read_file, or ssh_tail. The agent gets operational hints but no routing rules.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_findBRead-only
Search for files on a remote host. Wraps the find command with structured parameters so you don't have to construct find syntax manually.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | SSH hostname or IP address | |
| name | No | Filename pattern with wildcards (e.g. '*.log', 'config.*') | |
| path | Yes | Directory to search in (e.g. /var/log, /home/user) | |
| port | No | SSH port (default: 22) | |
| type | No | File type: f=file, d=directory, l=symlink | |
| newer | No | Reference file path -- find matches files modified more recently than this file | |
| maxsize | No | Maximum file size (e.g. '10M', '500k') | |
| minsize | No | Minimum file size (e.g. '1M', '100k') | |
| timeout | No | Command timeout in milliseconds (default: 30000). Also the longest the call waits for a free connection-pool slot (SSH_MCP_MAX_POOL_SIZE, default 100) before the command starts; the wait and the command are bounded separately. | |
| maxdepth | No | Maximum directory depth to search (0 = the path itself only) | |
| password | No | SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process. | |
| username | No | SSH username (default: current user) | |
| privateKeyPath | No | Path to SSH private key |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true, so the safety and network profile is known. The description adds that the operation runs remotely via a wrapped find, but says nothing about result shape, permission failures, partial output, or how the timeout/pool behavior (documented only in the schema) affects the call.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two front-loaded sentences with no filler; the purpose arrives first and the rationale second. It is efficient, though it leaves the description thin relative to a 13-parameter tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With full schema coverage and read-only annotations, the description is minimally sufficient to invoke the tool correctly. However, for a search tool with no output schema, it omits the return format (matched paths? metadata?) and gives no guidance relative to the many sibling listing/inspection tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every one of the 13 parameters is already documented in structured data, including wildcard syntax, size units, and the timeout/pool note. The description adds no parameter-level meaning beyond that, which is the expected baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Search for files on a remote host') plus the underlying mechanism ('wraps the find command'), which separates it from siblings like ssh_ls or ssh_stat. It never names a sibling explicitly, so the differentiation is inferred rather than stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'so you don't have to construct find syntax manually' implies when this tool is preferable to raw ssh_exec, but there are no explicit when-to-use/when-not rules, no mention of ssh_ls as the lighter alternative for simple listing, and no prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_git_checkA
Test Git-over-SSH authentication to a hosting provider (GitHub, GitLab, Bitbucket, etc). Verifies your SSH key is registered and working. Use this when git clone/pull/push fails with SSH errors.
| Name | Required | Description | Default |
|---|---|---|---|
| host | No | Git hosting hostname (default: "github.com"). Omit for the default; an empty string is rejected. | |
| user | No | SSH user for the git host (default: "git"). Omit for the default; an empty string is rejected. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the behavioral disclosure burden. It accurately conveys that the tool performs a test/verification of SSH authentication, implying a non-destructive diagnostic. However, it does not explicitly state the absence of side effects, potential prerequisites (e.g., key loaded via ssh_agent_ensure), or failure modes. This is adequate but not comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, both information-dense without redundancy. The primary action and purpose are front-loaded, followed by a concrete usage condition. No filler words; every phrase contributes to the agent's understanding. This is a model of conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with two optional parameters and no output schema, the description covers the purpose, when to use it, and what it verifies. The only gap is the lack of explicit return-value specification, but given the diagnostic nature, the outcome (success/failure) is implied. The description is complete enough for an agent to select and invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides full descriptions for both parameters (host and user), including defaults and constraints. With 100% schema description coverage, the description adds no additional parameter detail, which is acceptable. The baseline of 3 applies because the schema sufficiently documents the parameters without needing extra elaboration.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Test Git-over-SSH authentication') and clearly identifies the resource (hosting providers like GitHub, GitLab, Bitbucket). It is unambiguous and distinct from generic SSH tools by focusing on Git-over-SSH. The mention of verifying the SSH key registration and working status adds actionable clarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives an explicit trigger: 'Use this when git clone/pull/push fails with SSH errors.' This clearly indicates the intended scenario. It does not explicitly state when not to use it or name alternatives, but the specific use case distinguishes it from siblings like ssh_test without requiring further detail. A stronger exclusion clause would elevate this to 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_key_listARead-only
List all SSH private keys in ~/.ssh/ with their type, fingerprint, and whether they are loaded in the agent. Use this to find which keys are available and which ones need to be loaded. Reports isError only when ~/.ssh exists but could not be read -- an absent or empty ~/.ssh is a successful answer with a ssh-keygen hint.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds genuinely non-obvious behavior beyond the readOnlyHint/openWorldHint annotations: isError is raised only when ~/.ssh exists but is unreadable, while a missing or empty directory is a successful result with a ssh-keygen hint. That error semantics is valuable, though file permissions, symlink handling, and public-key visibility are unstated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences: what it returns first, then when to use it, then error semantics. Every sentence carries information and nothing is repeated from structured fields.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
A zero-parameter read tool with no output schema, and the description covers the returned fields plus the success/failure boundary. Nothing an agent needs in order to call it and interpret the result is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes no parameters, so there is nothing for the description to document and the baseline of 4 applies. The description does not need to compensate for any schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb (list) plus resource (SSH private keys) plus scope (~/.ssh/), and it names the returned fields: type, fingerprint, agent-loaded status. This is clearly distinguishable from ssh_key_load, which it implicitly signals as the follow-up action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
States an explicit usage context: find which keys are available and which need loading, which routes the agent toward ssh_key_load for the second step. It doesn't state any when-not conditions or name the sibling tool outright, so it stops short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_key_loadA
Load an SSH private key into the running agent. Ensures the agent is running first. Use this after ssh_key_list shows a key that is not loaded.
| Name | Required | Description | Default |
|---|---|---|---|
| keyPath | Yes | Path to the SSH private key to load (e.g. ~/.ssh/id_ed25519) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the behavioral burden. It adds useful context by noting 'Ensures the agent is running first', but it does not disclose error handling, idempotency, or permission needs. Minimum viable for a simple load operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, both earning their place. The main action is front-loaded, the prerequisite and usage condition are stated succinctly, with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool with no output schema, this description provides enough to invoke correctly: what it does, a key prerequisite, and the condition for use. It is slightly incomplete in not mentioning return values or error scenarios, but these are minor for this operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single parameter keyPath, and the description does not add meaning beyond what the schema already provides. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Load an SSH private key'), the target ('into the running agent'), and differentiates from siblings by referencing ssh_key_list. It is specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly provides a condition for use ('after ssh_key_list shows a key that is not loaded'), but does not mention when not to use it or compare with sibling ssh_agent_ensure, which also handles agent startup. Lacks explicit alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_known_hosts_fixA
Remove a stale host key from known_hosts and re-scan the host to add the current key. Use this when you see 'Host key verification failed' errors, typically after a server has been recreated or reprovisioned.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | SSH hostname or IP address | |
| port | No | SSH port (default: 22) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and clearly discloses the mutating behavior: removal of a stale key followed by a re-scan to add the current key. It goes beyond the tool name by specifying the action sequence and trigger, although it doesn't mention the affected known_hosts path or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two brief sentences: the first describes the action, the second the trigger. No waste and front-loaded with the primary behavior.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Adequate for a two-parameter tool with no output schema: an agent knows what it does and when to invoke it. It could note that this modifies the local user's known_hosts file, but the action is clear from the phrase 'remove a stale host key from known_hosts'.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, with host and port each described. The description adds no extra parameter detail beyond the schema, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific sequence (remove stale key, re-scan host) on a specific resource (known_hosts), and explicitly names the error condition it addresses. This differentiates it from sibling ssh tools that execute, read, or list remote files.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells when to use: upon 'Host key verification failed' errors after server recreate/reprovision. Does not name alternatives or exclude cases such as using ssh_diagnose for broader connectivity checks, so one point off.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_lsARead-only
List files in a directory on a remote host via SFTP. If the connection pool is full (SSH_MCP_MAX_POOL_SIZE, default 100), waits up to 30s for a free slot before starting.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | SSH hostname or IP address | |
| path | Yes | Absolute path to the remote directory. Must start with /. | |
| port | No | SSH port (default: 22) | |
| password | No | SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process. | |
| username | No | SSH username (default: current user) | |
| privateKeyPath | No | Path to SSH private key |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and openWorldHint, so the safety profile is covered; the description adds genuinely new behavioral context by disclosing the connection-pool limit (SSH_MCP_MAX_POOL_SIZE, default 100) and a 30s wait before starting, which tells the agent this call can block. It stops short of stating result shape, whether listing is recursive, or whether hidden files are included.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero filler, and the core operation is front-loaded ahead of the secondary pool-exhaustion caveat. Every clause carries information an agent can act on.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description is the only place to learn what a listing returns (entry names only? metadata? symlink handling?), and it says nothing about that. The blocking/pool behavior is covered well, but for a read/list tool the return semantics gap is a real omission.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so all six parameters (including the plaintext-password warning and default port/user) are already documented in the schema. The description adds no parameter-level meaning beyond what the schema provides, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List files in a directory on a remote host') plus the transport ('via SFTP'), so the agent knows exactly what operation this performs. It does not, however, distinguish itself from close siblings like ssh_find or ssh_stat, which also touch remote paths.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The second sentence describes pool-exhaustion behavior, not when to choose this tool over alternatives. There is no guidance on when to use ssh_ls versus ssh_find (search), ssh_stat (metadata), or ssh_read_file (contents), and no stated prerequisites beyond the implied SSH connection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_mkdirA
Create a directory on a remote host via SFTP. Set recursive: true to create parent directories as needed (like mkdir -p). Existing intermediate dirs are tolerated; an existing leaf path is still an error. Unlike the other SFTP tools, the path may be relative. If the connection pool is full (SSH_MCP_MAX_POOL_SIZE, default 100), waits up to 30s for a free slot before starting. NOT gated by SSH_MCP_COMMAND_WHITELIST / SSH_MCP_COMMAND_BLACKLIST: command policy applies only to ssh_exec and ssh_multi_exec, so a blacklist such as ^rm does NOT block this tool.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | SSH hostname or IP address | |
| path | Yes | Path of the directory to create. Absolute (starting with /) is recommended and unambiguous. A relative path is also accepted and resolves against the SFTP working directory, which is normally the remote user's home. ~ is NOT expanded — SFTP has no shell to expand it. | |
| port | No | SSH port (default: 22) | |
| password | No | SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process. | |
| username | No | SSH username (default: current user) | |
| recursive | No | Create parent directories as needed (default: false). Like `mkdir -p`. | |
| privateKeyPath | No | Path to SSH private key |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure and does so richly. It documents error semantics ('existing leaf path is still an error'), waiting behavior ('waits up to 30s for a free slot'), and a major security/policy exception ('NOT gated by SSH_MCP_COMMAND_WHITELIST / BLACKLIST'). These exceed basic expectations and give the agent concrete expectations beyond just 'creates a directory.'
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and front-loaded: it opens with the core purpose, then immediately covers recursive behavior, then path relativity, then connection pool, then command policy. Every sentence earns its place; there is no fluff or redundancy. It packs a lot of important detail into a compact paragraph without being verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (mkdir) and a fully documented schema, the description covers the key contextual gaps: error behavior, wait timeout, and command policy interplay. It does not explicitly state what happens after the 30s wait exceeds or what the success return value is, but these are minor for this operation. The description is largely complete for an agent to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds meaningful semantics beyond the schema, particularly for `recursive`: it explains the behavior of existing intermediate dirs vs. an existing leaf path, and the `~` expansion caveat for `path` (though that is also in the schema). This adds value beyond the raw property definitions, justifying a 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb+resource: 'Create a directory on a remote host via SFTP.' This clearly states the tool's action and domain, and it distinguishes itself from siblings by noting 'Unlike the other SFTP tools, the path may be relative,' which helps an agent tell it apart from other SFTP operations like ssh_write_file or ssh_ls.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context about when to use the tool, such as supporting relative paths and the recursive flag behavior, but it stops short of explicitly naming alternatives or saying 'use this instead of ssh_exec for mkdir.' It includes a relevant exclusion about command policy (not gated by whitelist/blacklist), which is an implicit usage condition, but no direct when-not statements.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_multi_execA
Execute a command on multiple remote hosts in parallel. Runs at most SSH_MCP_MAX_POOL_SIZE hosts at once (default 100) and works through a longer list as slots free up. timeout is per host: it bounds each host's command, not the whole call. Each parallel slot works through its share of the list one host at a time, so with the pool to itself a call can take up to about ceil(hosts / SSH_MCP_MAX_POOL_SIZE) x (timeout + connect time). The connection pool is shared with every other tool; when it is full this call waits for slots instead of failing, and gives up only when none of its own hosts holds a slot and a full timeout has passed with none of them starting or finishing. The hosts waiting at that point (up to one per parallel slot) and every host still queued then report Connection pool is full; the queued ones are never attempted. Rerun those hosts once the other calls finish, or raise SSH_MCP_MAX_POOL_SIZE. Returns results per host. Use this instead of calling ssh_exec multiple times — it's faster and shows results side by side. Use env to set environment variables for this call without modifying the command string. Subject to SSH_MCP_COMMAND_WHITELIST / SSH_MCP_COMMAND_BLACKLIST if configured (policy is checked once, against the env-prefixed command, before fan-out).
| Name | Required | Description | Default |
|---|---|---|---|
| env | No | Environment variables to set for this command. Injected as a `KEY='value' ...` prefix; works on any sshd regardless of AcceptEnv config. VALUES are POSIX-single-quoted, so any byte is safe in a value. KEYS cannot be quoted (a shell assignment prefix requires a bare name), so each key must match /^[A-Za-z_][A-Za-z0-9_]*$/ (the POSIX name grammar) — a key outside that grammar is rejected and the call fails before anything is sent to a host. Command policy is checked against the PREFIXED command, so a `^`-anchored whitelist pattern stops matching once this is set. | |
| port | No | SSH port (default: 22) | |
| hosts | Yes | List of SSH hostnames or IPs | |
| command | Yes | Shell command to execute on all hosts | |
| timeout | No | Per-host command timeout in milliseconds (default: 30000): bounds each host's command, not the whole call. Also the call's no-progress budget on a full pool (see the tool description). | |
| password | No | SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process. | |
| username | No | SSH username (default: current user) | |
| privateKeyPath | No | Path to SSH private key |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With zero annotations, the description carries the full burden and does so thoroughly: it discloses the shared connection pool, queueing rather than failing, the exact no-progress give-up condition, which hosts get reported as 'Connection pool is full', and that whitelist/blacklist policy is evaluated once against the env-prefixed command before fan-out. These are non-obvious behaviors an agent could not infer from the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The operation and its primary use case are front-loaded, and the dense middle is warranted by genuinely complex pool semantics. It is longer than ideal — the pool-exhaustion paragraph is a single hard-to-parse sentence — but almost every clause carries operational information rather than filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Concurrency, timeout, policy, and failure behavior are all covered for an 8-parameter tool with no annotations. The one gap is the return value: 'Returns results per host' does not say whether each entry carries exit status, stdout/stderr separation, or how failed hosts are represented, and there is no output schema to fall back on.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description reinforces the important `timeout` scoping (per host, not whole call) and the env-prefix interaction with `^`-anchored whitelists, but those details are already present in the schema, so it adds little beyond structured data.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb, resource, and concurrency mode ('Execute a command on multiple remote hosts in parallel') and explicitly distinguishes itself from the sibling ssh_exec by naming the alternative pattern to avoid. An agent can select this over ssh_exec without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit routing rule ('Use this instead of calling ssh_exec multiple times — it's faster and shows results side by side'), plus remedial guidance for the failure path (rerun the reported hosts or raise SSH_MCP_MAX_POOL_SIZE) and a note on when to prefer `env` over command-string manipulation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_read_fileARead-only
Read a file from a remote host via SFTP. A whole-file read is limited to 10 MB. For a large file -- or behind a proxy that caps results, such as Yaw MCP at about 100 KB -- read it in pages with offset and length (bytes): a paged read returns a status block first ([bytes A-B of SIZE] and the next offset) and then the text. If the connection pool is full (SSH_MCP_MAX_POOL_SIZE, default 100), waits up to 30s for a free slot before starting.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | SSH hostname or IP address | |
| path | Yes | Absolute path to the remote file. Must start with /. | |
| port | No | SSH port (default: 22) | |
| length | No | Number of bytes to read (default: the rest of the file, up to 10 MB). Behind Yaw MCP keep it at or under about 90000 so the page is not cut. A page boundary can split a multi-byte UTF-8 character. | |
| offset | No | Byte offset to start reading at (default 0). Setting offset or length switches to a paged read. | |
| password | No | SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process. | |
| username | No | SSH username (default: current user) | |
| privateKeyPath | No | Path to SSH private key |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnly and openWorld annotations, the description discloses important behavioral traits: the 10 MB whole-file limit, proxy result caps, paged-read status output, UTF-8 boundary splitting, and a 30-second wait when the SSH connection pool is exhausted. These are exactly the operational constraints an agent needs before invoking the tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: the core action and size limit appear first, followed by paging guidance and pool-wait behavior. Every sentence carries useful operational information with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description compensates by explaining paged-read return behavior, size limits, proxy caps, and pool timeouts. Combined with the fully described input schema, an agent has enough context to call this tool correctly and understand its key constraints.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the schema already documents host, path, port, length, offset, auth fields, and pagination behavior in detail. The description adds useful paging context but largely repeats what the schema already conveys about offset and length, so it does not substantially add parameter-level meaning beyond the structured fields.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: reading a remote file via SFTP. It is clearly about file reading, but it does not explicitly differentiate itself from sibling tools such as ssh_download or ssh_tail, which also retrieve remote file content.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives concrete invocation guidance: whole-file reads are capped at 10 MB, and large files or proxy-capped environments should use paged reads with offset and length. It does not explicitly say when to choose this tool over alternatives like ssh_download or ssh_tail, so it stops short of full when/when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_service_statusARead-only
Check the status of a systemd service on a remote host. Returns whether it's active, its PID, uptime, and description. Use this instead of ssh_exec with systemctl.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | SSH hostname or IP address | |
| port | No | SSH port (default: 22) | |
| service | Yes | Systemd service name (e.g. nginx, sshd, docker) | |
| timeout | No | Command timeout in milliseconds (default: 30000). Also the longest the call waits for a free connection-pool slot (SSH_MCP_MAX_POOL_SIZE, default 100) before the command starts; the wait and the command are bounded separately. | |
| password | No | SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process. | |
| username | No | SSH username (default: current user) | |
| privateKeyPath | No | Path to SSH private key |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and openWorldHint, so the safety profile is covered. The description adds value by disclosing the return payload (active state, PID, uptime, description), which is meaningful since there is no output schema. It doesn't mention failure behavior for an unreachable host or unknown unit, keeping it at 4.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences with no filler: purpose first, return contents second, sibling routing third. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description usefully summarizes the returned fields, and the schema carries auth and timeout detail. Minor gaps on error/edge behavior (host unreachable, service not found) keep it just short of complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and every parameter — including the plaintext-password warning and timeout/pool-slot semantics — is documented in the schema itself. The description adds nothing about the 'service' or 'host' arguments, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Check the status of a systemd service on a remote host') and immediately distinguishes itself from the generic sibling by saying to use it instead of ssh_exec with systemctl. An agent can select it over the 20 siblings without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly names the alternative it replaces ('Use this instead of ssh_exec with systemctl'), which is the key routing decision. It stops short of covering edge cases — e.g. non-systemd hosts or when ssh_exec would still be appropriate — so it is clear but not exhaustive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_statARead-only
Get metadata for a file or directory on a remote host via SFTP. Returns size, permissions (octal), uid/gid, mtime/atime, and the path type. Symlinks are reported as symlink -> <target kind>: the type describes the link itself while size/mode/mtime describe its TARGET, and a dangling symlink is reported rather than erroring. Use this instead of parsing ls -la output. If the connection pool is full (SSH_MCP_MAX_POOL_SIZE, default 100), waits up to 30s for a free slot before starting.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | SSH hostname or IP address | |
| path | Yes | Absolute path to the remote file or directory. Must start with /. | |
| port | No | SSH port (default: 22) | |
| password | No | SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process. | |
| username | No | SSH username (default: current user) | |
| privateKeyPath | No | Path to SSH private key |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare readOnly and openWorld; the description goes further with concrete behavior: symlink type describes the link while size/mode/mtime describe the target, dangling symlinks are reported rather than erroring, and pool saturation causes up to a 30s wait (with the SSH_MCP_MAX_POOL_SIZE knob named). That is exactly the kind of context annotations cannot convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with purpose, then the non-obvious symlink semantics, then the pool-wait caveat. Every sentence carries information an agent would otherwise have to guess.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description supplies the return fields (size, octal permissions, uid/gid, mtime/atime, path type) and the symlink edge case, plus latency behavior under pool pressure. Nothing critical for correct invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so host, path, port, credentials and key path are all documented in the schema, including a strong warning about plaintext passwords. The description adds no parameter-level detail beyond the return-field discussion, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Get metadata for a file or directory on a remote host via SFTP') and names the mechanism, immediately distinguishing it from listing tools. The 'instead of parsing ls -la output' line further separates it from ssh_ls-style siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says to use this rather than parsing `ls -la` output, giving a clear usage condition. It does not, however, route against the actual sibling tools (ssh_ls, ssh_find, ssh_read_file) or state when-not-to-use beyond that one comparison.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_tailARead-only
Read the last N lines of a file on a remote host, optionally filtering by a grep pattern. Use this for reading log files instead of ssh_exec with manual tail/grep commands.
| Name | Required | Description | Default |
|---|---|---|---|
| grep | No | Case-insensitive pattern to filter lines | |
| host | Yes | SSH hostname or IP address | |
| path | Yes | Absolute path to the file to tail | |
| port | No | SSH port (default: 22) | |
| lines | No | Number of lines to read from the end (default: 100). Must be a positive integer. | |
| timeout | No | Command timeout in milliseconds (default: 30000). Also the longest the call waits for a free connection-pool slot (SSH_MCP_MAX_POOL_SIZE, default 100) before the command starts; the wait and the command are bounded separately. | |
| password | No | SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process. | |
| username | No | SSH username (default: current user) | |
| privateKeyPath | No | Path to SSH private key |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true, so the safety and environment profile is known. The description adds the intended use case context but says nothing about auth requirements, what happens on a missing file or unreachable host, or whether the connection pool/timeout behavior is shared with ssh_exec; the pool caveat lives only in the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences: the first defines the operation, the second gives the routing advice. Nothing redundant, and the purpose is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 9 parameters, full schema coverage, and annotations covering safety, the description is nearly sufficient for correct invocation. The remaining gap is that it never states what comes back (raw lines? exit status? error message on missing file), which matters slightly more because no output schema exists.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter (host, path, lines, grep, timeout, auth fields) is already documented in structured data. The description mentions line count and grep filtering only in passing and adds no syntax or format detail beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Read the last N lines of a file on a remote host') plus the optional filter, which is a precise and non-tautological statement of what the tool does. It is clearly distinguishable from generic execution siblings like ssh_exec or ssh_multi_exec.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly routes the agent away from the obvious alternative: 'Use this for reading log files instead of ssh_exec with manual tail/grep commands.' It doesn't mention ssh_read_file, which is arguably the closest sibling for plain file reads, so a small differentiation gap remains.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_testA
Quick connectivity test to an SSH host. Reports success/failure with timing and actionable error details. Lighter and faster than ssh_diagnose — use this for a quick check before running operations.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | SSH hostname or IP address | |
| port | No | SSH port (default: 22) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the tool reports success/failure with timing and actionable error details, which informs the agent about the return type and content. It does not mention authentication or potential side effects, but 'test' implies a non-destructive operation. The description adds meaningful context beyond the bare name, so a 4 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: two sentences that front-load the core purpose, then immediately state the differentiation and usage context. Every sentence earns its place, with no redundant phrasing or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple two-parameter schema and absence of an output schema, the description covers the essential aspects: what it does, what it returns (success/failure, timing, error details), and when to use it. It lacks precise output formatting details, but it provides enough for an agent to invoke it correctly and interpret the result. This is nearly complete for such a lightweight tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already covers 100% of parameter descriptions (host and port). The description adds no additional meaning about parameters—it does not explain expected formats, defaults, or how the port is used beyond the schema's basic default of 22. Therefore, the baseline of 3 is appropriate; the description adds no extra value here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: a quick connectivity test to an SSH host, reporting success/failure with timing and error details. It explicitly distinguishes itself from the sibling ssh_diagnose by being lighter and faster, so an agent can easily tell them apart without examining schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states when to use this tool ('use this for a quick check before running operations') and contrasts it with ssh_diagnose ('lighter and faster'). This gives clear context and implies when not to use it (when a deeper diagnostic is needed). The guidance is direct and actionable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_uploadA
Upload a local file to a remote host via SFTP. Reads an arbitrary local file at an agent-chosen localPath -- any file readable by this process leaves the machine toward the remote host (the mirror direction of ssh_download's local write). If the connection pool is full (SSH_MCP_MAX_POOL_SIZE, default 100), waits up to 30s for a free slot before starting. NOT gated by SSH_MCP_COMMAND_WHITELIST / SSH_MCP_COMMAND_BLACKLIST: command policy applies only to ssh_exec and ssh_multi_exec, so a blacklist such as ^rm does NOT block this tool.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | SSH hostname or IP address | |
| port | No | SSH port (default: 22) | |
| password | No | SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process. | |
| username | No | SSH username (default: current user) | |
| localPath | Yes | Path to the local file to upload | |
| remotePath | Yes | Absolute path on the remote host. Must start with /. | |
| privateKeyPath | No | Path to SSH private key |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does substantial work: it discloses that any process-readable file leaves the machine, the 30s pool-wait behavior under SSH_MCP_MAX_POOL_SIZE, and the important exemption from SSH_MCP_COMMAND_WHITELIST/BLACKLIST with a concrete `^rm` example. It does not say whether an existing remote file is overwritten or the call fails, nor what the tool returns, which is a meaningful gap for a write operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the action, then the security and concurrency constraints in descending priority, with no filler. The final policy-exemption sentence is long but earns its length by preventing a real mistaken assumption about blacklists.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 7-parameter mutation tool with no annotations and no output schema, the description covers the safety surface, concurrency behavior, and policy scope well. The remaining gap is overwrite/failure semantics and what a successful call reports, which an agent would want before re-uploading to an existing path.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3; the description rises above it by scoping `localPath` as "agent-chosen" and emphasizing that any readable file is exfiltrated, which is security-relevant meaning the schema's neutral one-liner does not convey. It adds no new detail on `remotePath`, `port`, or auth parameters, but those are already fully documented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening sentence gives a specific verb and resource ("Upload a local file to a remote host via SFTP") and explicitly positions it as the mirror direction of ssh_download. However, it never distinguishes itself from ssh_write_file, the closest sibling, so an agent must infer the boundary between uploading a local file and writing remote content.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied through the ssh_download comparison and by naming ssh_exec/ssh_multi_exec as the tools governed by command policy. There is no explicit "use ssh_upload when X, use ssh_write_file when Y" guidance, leaving the most ambiguous sibling relationship unresolved.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_write_fileADestructive
Write content to a file on a remote host via SFTP. Creates or overwrites the file. If the connection pool is full (SSH_MCP_MAX_POOL_SIZE, default 100), waits up to 30s for a free slot before starting. NOT gated by SSH_MCP_COMMAND_WHITELIST / SSH_MCP_COMMAND_BLACKLIST: command policy applies only to ssh_exec and ssh_multi_exec, so a blacklist such as ^rm does NOT block this tool.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | SSH hostname or IP address | |
| path | Yes | Absolute path to the remote file. Must start with /. | |
| port | No | SSH port (default: 22) | |
| content | Yes | File content to write | |
| password | No | SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process. | |
| username | No | SSH username (default: current user) | |
| privateKeyPath | No | Path to SSH private key |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and openWorldHint=true, and the description adds real value on top: it makes explicit that existing file contents are overwritten, discloses the pool-exhaustion wait (up to 30s, gated by SSH_MCP_MAX_POOL_SIZE, default 100), and clarifies that command blacklists do not protect against it. It omits failure behavior (permission denied, missing parent directory) and whether the write is atomic, which are the remaining gaps for a destructive mutation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose and overwrite semantics before the operational caveats, and every sentence carries information. The blacklist sentence is long and tool-specific but earns its place by preventing a false safety assumption.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive 7-parameter write with full schema coverage, no output schema, and safety hints already in annotations, the description covers purpose, overwrite risk, throughput limits, and a misleading policy assumption. Nothing essential to calling it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the schema already documents host, path, port, content, credentials, and key path with guidance (password plaintext warning, absolute-path requirement). The description adds no parameter-level detail beyond what the schema provides, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (write), resource (remote file), and transport (SFTP), plus the create-or-overwrite semantics. It does not explicitly distinguish itself from ssh_upload, the other obvious write-path sibling, so an agent must infer that ssh_upload takes a local source path while this takes inline content.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear operating context: the tool bypasses SSH_MCP_COMMAND_WHITELIST/BLACKLIST, which is exactly the kind of pre-call assumption an agent might get wrong, and names the sibling tools (ssh_exec, ssh_multi_exec) where policy does apply. It stops short of stating when to prefer ssh_upload or ssh_delete over this tool, so no direct alternative routing is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
3 tool updates
v0.18.1- Changed
ssh_find4 fields changed- changed
Input schema / properties / maxdepth / descriptionPrevious value: -"Maximum directory depth to search"New value: +"Maximum directory depth to search (0 = the path itself only)" - added
Input schema / properties / maxdepth / maximumAdded value: +9007199254740991 - added
Input schema / properties / maxdepth / minimumAdded value: +0 - changed
Input schema / properties / maxdepth / typePrevious value: -"number"New value: +"integer"
- Changed
ssh_multi_exec1 field changed- added
Input schema / properties / hosts / minItemsAdded value: +1
- Changed
ssh_read_file2 fields changed- added
Input schema / properties / lengthAdded value: +{ + "description": "Number of bytes to read (default: the rest of the file, up to 10 MB). Behind Yaw MCP keep it at or under about 90000 so the page is not cut. A page boundary can split a multi-byte UTF-8 character.", + "exclusiveMinimum": 0, + "maximum": 10485760, + "type": "integer" +} - added
Input schema / properties / offsetAdded value: +{ + "description": "Byte offset to start reading at (default 0). Setting offset or length switches to a paged read.", + "maximum": 9007199254740991, + "minimum": 0, + "type": "integer" +}
13 tool updates
v0.17.0- Changed
ssh_delete1 field changed- changed
Input schema / properties / path / descriptionPrevious value: -"Absolute path of the file or empty directory to delete"New value: +"Absolute path of the file or empty directory to delete. Must start with /."
- Changed
ssh_download1 field changed- changed
Input schema / properties / remotePath / descriptionPrevious value: -"Absolute path to the remote file"New value: +"Absolute path to the remote file. Must start with /."
- Changed
ssh_exec2 fields changed- changed
Input schema / properties / env / descriptionPrevious value: -"Environment variables to set for this command. Injected as a `KEY='value' ...` prefix; works on any sshd regardless of AcceptEnv config. Values are POSIX-single-quoted, so any byte is safe."New value: +"Environment variables to set for this command. Injected as a `KEY='value' ...` prefix; works on any sshd regardless of AcceptEnv config. VALUES are POSIX-single-quoted, so any byte is safe in a value. KEYS cannot be quoted (a shell assignment prefix requires a bare name), so each key must match /^[A-Za-z_][A-Za-z0-9_]*$/ (the POSIX name grammar) — a key outside that grammar is rejected and the call fails before anything is sent to a host. Command policy is checked against the PREFIXED command, so a `^`-anchored whitelist pattern stops matching once this is set." - changed
Input schema / properties / timeout / descriptionPrevious value: -"Command timeout in milliseconds (default: 30000)"New value: +"Command timeout in milliseconds (default: 30000). Also the longest the call waits for a free connection-pool slot (SSH_MCP_MAX_POOL_SIZE, default 100) before the command starts; the wait and the command are bounded separately."
- Changed
ssh_find1 field changed- changed
Input schema / properties / timeout / descriptionPrevious value: -"Command timeout in milliseconds (default: 30000)"New value: +"Command timeout in milliseconds (default: 30000). Also the longest the call waits for a free connection-pool slot (SSH_MCP_MAX_POOL_SIZE, default 100) before the command starts; the wait and the command are bounded separately."
- Changed
ssh_git_check4 fields changed- changed
Input schema / properties / host / descriptionPrevious value: -"Git hosting hostname (default: \"github.com\")"New value: +"Git hosting hostname (default: \"github.com\"). Omit for the default; an empty string is rejected." - added
Input schema / properties / host / minLengthAdded value: +1 - changed
Input schema / properties / user / descriptionPrevious value: -"SSH user for the git host (default: \"git\")"New value: +"SSH user for the git host (default: \"git\"). Omit for the default; an empty string is rejected." - added
Input schema / properties / user / minLengthAdded value: +1
- Changed
ssh_ls1 field changed- changed
Input schema / properties / path / descriptionPrevious value: -"Absolute path to the remote directory"New value: +"Absolute path to the remote directory. Must start with /."
- Changed
ssh_mkdir1 field changed- changed
Input schema / properties / path / descriptionPrevious value: -"Absolute path of the directory to create"New value: +"Path of the directory to create. Absolute (starting with /) is recommended and unambiguous. A relative path is also accepted and resolves against the SFTP working directory, which is normally the remote user's home. ~ is NOT expanded — SFTP has no shell to expand it."
- Changed
ssh_multi_exec2 fields changed- added
Input schema / properties / envAdded value: +{ + "additionalProperties": { + "type": "string" + }, + "description": "Environment variables to set for this command. Injected as a `KEY='value' ...` prefix; works on any sshd regardless of AcceptEnv config. VALUES are POSIX-single-quoted, so any byte is safe in a value. KEYS cannot be quoted (a shell assignment prefix requires a bare name), so each key must match /^[A-Za-z_][A-Za-z0-9_]*$/ (the POSIX name grammar) — a key outside that grammar is rejected and the call fails before anything is sent to a host. Command policy is checked against the PREFIXED command, so a `^`-anchored whitelist pattern stops matching once this is set.", + "propertyNames": { + "type": "string" + }, + "type": "object" +} - changed
Input schema / properties / timeout / descriptionPrevious value: -"Command timeout in milliseconds (default: 30000)"New value: +"Per-host command timeout in milliseconds (default: 30000): bounds each host's command, not the whole call. Also the call's no-progress budget on a full pool (see the tool description)."
- Changed
ssh_service_status1 field changed- changed
Input schema / properties / timeout / descriptionPrevious value: -"Command timeout in milliseconds (default: 30000)"New value: +"Command timeout in milliseconds (default: 30000). Also the longest the call waits for a free connection-pool slot (SSH_MCP_MAX_POOL_SIZE, default 100) before the command starts; the wait and the command are bounded separately."
- Changed
ssh_stat1 field changed- changed
Input schema / properties / path / descriptionPrevious value: -"Absolute path to the remote file or directory"New value: +"Absolute path to the remote file or directory. Must start with /."
- Changed
ssh_tail1 field changed- changed
Input schema / properties / timeout / descriptionPrevious value: -"Command timeout in milliseconds (default: 30000)"New value: +"Command timeout in milliseconds (default: 30000). Also the longest the call waits for a free connection-pool slot (SSH_MCP_MAX_POOL_SIZE, default 100) before the command starts; the wait and the command are bounded separately."
- Changed
ssh_upload1 field changed- changed
Input schema / properties / remotePath / descriptionPrevious value: -"Absolute path on the remote host"New value: +"Absolute path on the remote host. Must start with /."
- Changed
ssh_write_file1 field changed- changed
Input schema / properties / path / descriptionPrevious value: -"Absolute path to the remote file"New value: +"Absolute path to the remote file. Must start with /."
1 tool update
v0.11.7- Changed
ssh_read_file1 field changed- changed
Input schema / properties / path / descriptionPrevious value: -"Absolute path to the remote file"New value: +"Absolute path to the remote file. Must start with /."
6 tool updates
v0.11.0- Added
ssh_delete - Changed
ssh_exec1 field changed- added
Input schema / properties / envAdded value: +{ + "additionalProperties": { + "type": "string" + }, + "description": "Environment variables to set for this command. Injected as a `KEY='value' ...` prefix; works on any sshd regardless of AcceptEnv config. Values are POSIX-single-quoted, so any byte is safe.", + "propertyNames": { + "type": "string" + }, + "type": "object" +}
- Changed
ssh_find1 field changed- added
Input schema / properties / newerAdded value: +{ + "description": "Reference file path -- find matches files modified more recently than this file", + "type": "string" +}
- Added
ssh_mkdir - Added
ssh_stat - Changed
ssh_tail4 fields changed- changed
Input schema / properties / lines / descriptionPrevious value: -"Number of lines to read from the end (default: 100)"New value: +"Number of lines to read from the end (default: 100). Must be a positive integer." - added
Input schema / properties / lines / exclusiveMinimumAdded value: +0 - added
Input schema / properties / lines / maximumAdded value: +9007199254740991 - changed
Input schema / properties / lines / typePrevious value: -"number"New value: +"integer"
18 tool updates
v0.9.1- Added
ssh_agent_ensure - Added
ssh_config_lookup - Changed
ssh_diagnose4 fields changed- removed
Input schema / additionalPropertiesRemoved value: -false - added
Input schema / properties / port / maximumAdded value: +65535 - added
Input schema / properties / port / minimumAdded value: +1 - changed
Input schema / properties / port / typePrevious value: -"number"New value: +"integer"
- Changed
ssh_download5 fields changed- removed
Input schema / additionalPropertiesRemoved value: -false - changed
Input schema / properties / password / descriptionPrevious value: -"SSH password (prefer keys)"New value: +"SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process." - added
Input schema / properties / port / maximumAdded value: +65535 - added
Input schema / properties / port / minimumAdded value: +1 - changed
Input schema / properties / port / typePrevious value: -"number"New value: +"integer"
- Changed
ssh_exec9 fields changed- removed
Input schema / additionalPropertiesRemoved value: -false - changed
Input schema / properties / command / descriptionPrevious value: -"Shell command to execute on the remote host"New value: +"Shell command to execute on the remote host (interpreted by the remote login shell)" - changed
Input schema / properties / password / descriptionPrevious value: -"SSH password (prefer keys)"New value: +"SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process." - added
Input schema / properties / port / maximumAdded value: +65535 - added
Input schema / properties / port / minimumAdded value: +1 - changed
Input schema / properties / port / typePrevious value: -"number"New value: +"integer" - added
Input schema / properties / timeout / exclusiveMinimumAdded value: +0 - added
Input schema / properties / timeout / maximumAdded value: +9007199254740991 - changed
Input schema / properties / timeout / typePrevious value: -"number"New value: +"integer"
- Added
ssh_find - Added
ssh_git_check - Added
ssh_key_list - Added
ssh_key_load - Added
ssh_known_hosts_fix - Changed
ssh_ls5 fields changed- removed
Input schema / additionalPropertiesRemoved value: -false - changed
Input schema / properties / password / descriptionPrevious value: -"SSH password (prefer keys)"New value: +"SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process." - added
Input schema / properties / port / maximumAdded value: +65535 - added
Input schema / properties / port / minimumAdded value: +1 - changed
Input schema / properties / port / typePrevious value: -"number"New value: +"integer"
- Added
ssh_multi_exec - Changed
ssh_read_file5 fields changed- removed
Input schema / additionalPropertiesRemoved value: -false - changed
Input schema / properties / password / descriptionPrevious value: -"SSH password (prefer keys)"New value: +"SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process." - added
Input schema / properties / port / maximumAdded value: +65535 - added
Input schema / properties / port / minimumAdded value: +1 - changed
Input schema / properties / port / typePrevious value: -"number"New value: +"integer"
- Added
ssh_service_status - Added
ssh_tail - Added
ssh_test - Changed
ssh_upload5 fields changed- removed
Input schema / additionalPropertiesRemoved value: -false - changed
Input schema / properties / password / descriptionPrevious value: -"SSH password (prefer keys)"New value: +"SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process." - added
Input schema / properties / port / maximumAdded value: +65535 - added
Input schema / properties / port / minimumAdded value: +1 - changed
Input schema / properties / port / typePrevious value: -"number"New value: +"integer"
- Changed
ssh_write_file5 fields changed- removed
Input schema / additionalPropertiesRemoved value: -false - changed
Input schema / properties / password / descriptionPrevious value: -"SSH password (prefer keys)"New value: +"SSH password. STRONGLY prefer key-based auth (privateKeyPath or ssh-agent). Passwords pass through MCP protocol frames as plaintext and may be logged by the transport or host process." - added
Input schema / properties / port / maximumAdded value: +65535 - added
Input schema / properties / port / minimumAdded value: +1 - changed
Input schema / properties / port / typePrevious value: -"number"New value: +"integer"
7 tool updates
v0.2.0- First observed
ssh_diagnose - First observed
ssh_download - First observed
ssh_exec - First observed
ssh_ls - First observed
ssh_read_file - First observed
ssh_upload - First observed
ssh_write_file
TDQS
Scored across 21 tools
Every tool targets a clearly distinct operation (exec, file read/write, upload/download, ls/stat/delete/mkdir, key management, diagnostics), and the descriptions explicitly disambiguate close pairs like ssh_test vs ssh_diagnose and ssh_write_file vs ssh_upload. Minor overlap remains: ssh_tail and ssh_find are convenience wrappers around what ssh_exec could do, and ssh_agent_ensure vs ssh_diagnose overlap on agent troubleshooting.
All 21 tools share a predictable `ssh_` namespace and are readable at a glance. There is a near-even split between verb_noun (ssh_read_file, ssh_mkdir, ssh_multi_exec) and noun_verb ordering (ssh_key_list, ssh_config_lookup, ssh_git_check, ssh_known_hosts_fix), plus a special case ssh_ls, which is a small but real deviation.
21 tools is on the heavy side for this domain, with several thin convenience wrappers (ssh_tail, ssh_find, ssh_service_status, ssh_test) that could be expressed via ssh_exec. Each earns some place, but the surface feels broader than the core task strictly requires.
Strong lifecycle coverage: exec, multi-host exec, full SFTP file operations, directory creation, stat/metadata, key listing/loading, config lookup, known_hosts repair, and diagnostics. Gaps are moderate: no rename/move, chmod/chown, symlink creation, or key generation tool, forcing fallbacks to ssh_exec (or leaving no clean path for keygen).
Maintenance
Related MCP Connectors
Scoped, audited SSH exec, sessions, and SFTP on your saved servers without exposing credentials
Securely control computers you explicitly pair through files, terminals, processes, screenshots, desktop UI/input, clipboard, browser automation, diagnostics, and document tools.
Manage remote servers, SSH terminals, files, databases and proxies with scoped access and approvals.
Remote shell and detached long-running jobs on your own machines — no SSH, open ports or VPN.
Related MCP Servers
- AlicenseBqualityDmaintenanceEnables seamless SSH operations including secure connections, file transfers, interactive shell sessions, and Docker container management on remote servers. Supports both password and SSH key authentication with credential management and connection pooling.18MIT
- FlicenseNot gradedqualityDmaintenanceEnables remote file operations and command execution across multiple machines via SSH. Supports reading files, listing directories, and running commands on any host configured in your SSH config.-
- AlicenseAqualityDmaintenanceEnables secure SSH connections to multiple remote servers with support for command execution, file transfers (SFTP), directory listing, and both password and key-based authentication.7MIT
- AlicenseNot gradedqualityDmaintenanceEnables executing commands on remote SSH hosts, with full support for bastion/jump hosts and ~/.ssh/config, plus Slurm job management and rsync.4MIT