mcp-server-ssh
Enables deep integration with Linux/Unix systems over SSH, providing tools for remote command execution, persistent interactive sessions, and POSIX file management (read/write, upload/download, directory operations, permissions).
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@mcp-server-sshconnect to prod-server and run df -h"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
@atengk/mcp-server-ssh
基于标准 OpenSSH 协议 深度连接与操控 Linux/Unix 系统的 Model Context Protocol (MCP) 服务。为大语言模型(LLM)和 AI 智能体(Claude Desktop、Cursor、Antigravity、Cline 等)提供安全、可控、零侵入的远程终端执行与 POSIX 文件系统管理基础设施。
💡 版本更新日志 (Release Notes):每一个正式版本的详细变动明细、修复记录与贡献者致谢均由系统自动维护,可直接前往 GitHub Releases 查看最新记录。
🌟 核心特性 (Features)
🌐 零侵入标准协议直连:目标 Linux 主机仅需原生 OpenSSH 服务,绝不安装任何专有 Agent 或 HTTP 守护进程(ADR-0001)。
⚡ 双模命令执行引擎(ADR-0002):
无状态执行 (
ssh_exec):单命令独立通道,默认包装为登录 Shell(bash -l -c)以完整继承用户环境变量与PATH,精确捕获退出码、耗时与标准输出/错误。交互式会话 (
ssh_session_*):基于 PTY 伪终端维持常驻会话流,支持流式增量回显与\x03(Ctrl+C) 中断控制信号。
📁 全功能 POSIX SFTP 管理:文本安全读写(内置 512KB 防撑爆阈值)、双向文件极速上传与下载、目录树浏览、POSIX 元数据获取、目录递归建删与软链接防环保护(
maxDepth: 10)。🔑 工业级凭证链与企业网络:完整支持本地公私钥(
id_ed25519/id_rsa)、SSH-Agent 探测、密码认证、~/.ssh/config配置继承以及企业级ProxyJump堡垒机/跳板机隧道。🛡️ 严格安全防护双保险(ADR-0003):
前置安全守卫 (
SafetyGuard):实时拦截全盘强删(rm -rf /)、磁盘覆写(dd/mkfs)、关机重启(reboot/shutdown)及 Fork 炸弹等致命破坏,支持dryRun演练。智能防爆截断 (
OutputTruncator):单次输出实施 64KB 双端智能截断(保留前 8KB 标头与后 56KB 最新日志),自动清洗 ANSI 终端转义符,保护 LLM 上下文不崩溃。
📦 免安装一键即用:打包为独立单文件 Bundle,全球用户通过
npx零依赖即开即用(ADR-0004)。
Related MCP server: SSH MCP Server
🚀 快速上手 (Quick Start)
无需 git clone 或本地编译,在任何支持 MCP 的宿主客户端配置文件(如 Claude Desktop 的 claude_desktop_config.json、Cursor 的 mcp.json 或 Antigravity / Cline 对应配置)中添加如下配置即可直接启动:
通用 MCP 客户端基础配置模板
{
"mcpServers": {
"ssh": {
"command": "npx",
"args": ["-y", "@atengk/mcp-server-ssh"],
"env": {
"MCP_SSH_HOST": "192.168.1.100",
"MCP_SSH_PORT": "22",
"MCP_SSH_USER": "root",
"MCP_SSH_KEY_PATH": "/Users/yourname/.ssh/id_ed25519"
}
}
}
}💡 向后兼容提示:服务已全面升级为规范的
MCP_SSH_*专属命名空间,同时 100% 透明向下兼容遗留的SSH_*环境变量,老用户无需修改已有配置即可平滑升级。
⚙️ 5 大连接场景配置矩阵 (Scenarios)
针对不同网络拓扑与鉴权需求,提供开箱即用的配置范例:
场景 1:密码账密直连 (最简临时测试)
{
"mcpServers": {
"ssh": {
"command": "npx",
"args": ["-y", "@atengk/mcp-server-ssh"],
"env": {
"MCP_SSH_HOST": "192.168.1.100",
"MCP_SSH_PORT": "22",
"MCP_SSH_USER": "root",
"MCP_SSH_PASSWORD": "your_secure_password"
}
}
}
}场景 2:公私钥免密直连 (生产环境规范推荐)
支持物理文件路径、原始 PEM 文本与 Base64 编码三种形态:
{
"mcpServers": {
"ssh": {
"command": "npx",
"args": ["-y", "@atengk/mcp-server-ssh"],
"env": {
"MCP_SSH_HOST": "192.168.1.100",
"MCP_SSH_PORT": "22",
"MCP_SSH_USER": "root",
"MCP_SSH_KEY_PATH": "D:/files/server/id_ed25519",
"MCP_SSH_KEY_PASSPHRASE": "optional_passphrase"
}
}
}
}💡 免文件挂载小妙招:在容器或无文件系统环境中,可直接将私钥 Base64 字符串赋值给
MCP_SSH_PRIVATE_KEY_BASE64(或 PEM 文本赋值给MCP_SSH_PRIVATE_KEY),服务将自动解码,无需挂载任何本地私钥文件!
💡 Windows 提示:本地路径强烈推荐统一使用正斜杠(如"D:/files/server/id_ed25519"),Node.js 原生完美支持,且能彻底避免 JSON 反斜杠转义(\\)遗漏导致的解析崩溃。
场景 3:直接复用本地 ~/.ssh/config 别名 (最推荐,省心免配)
直接继承本机既有的公私钥路径、跳板机、自定义端口与 Host 别名:
{
"mcpServers": {
"ssh": {
"command": "npx",
"args": ["-y", "@atengk/mcp-server-ssh"],
"env": {
"MCP_SSH_CONFIG_ALIAS": "my-cloud-vps"
}
}
}
}场景 4:企业级 ProxyJump 堡垒机/跳板机隧道
通过公网跳板机(Bastion)安全穿透至隔离内网中的私有目标服务器:
{
"mcpServers": {
"ssh": {
"command": "npx",
"args": ["-y", "@atengk/mcp-server-ssh"],
"env": {
"MCP_SSH_HOST": "10.0.1.50",
"MCP_SSH_PORT": "22",
"MCP_SSH_USER": "deploy",
"MCP_SSH_PROXY_HOST": "bastion.company.com",
"MCP_SSH_PROXY_PORT": "2222",
"MCP_SSH_PROXY_USER": "bastion_user"
}
}
}
}场景 5:纯空载启动 (在会话中动态管理多主机)
启动时不配置任何环境变量,后续在对话中直接通过自然语言指示 AI 连接或切换不同的主机:
{
"mcpServers": {
"ssh": {
"command": "npx",
"args": ["-y", "@atengk/mcp-server-ssh"]
}
}
}🌐 环境变量完整速查矩阵 (12-Factor App)
全面遵循现代化 12-Factor App 规范,服务提供官方主前缀 MCP_SSH_* 规范变量与向下兼容变量双重支持:
分类 | 推荐主环境变量 | 宽容兼容变量 | 默认值 / 行为说明 |
传输协议 |
|
|
|
服务监听地址 |
|
| SSE 模式监听地址,默认 |
服务监听端口 |
|
| SSE 模式监听端口,默认 |
目标主机地址 |
|
| 目标 Linux 服务器 IP 或域名(提供时触发自动建连) |
目标主机端口 |
|
| 目标 SSH 端口号,默认 |
认证用户名 |
|
| 登录用户名(缺省自动探测系统用户) |
认证密码 |
|
| 明文密码(日志与输出中强制掩码 |
私钥文件路径 |
|
| 本地私钥绝对或 |
私钥文本内容 |
|
| 原始 PEM 格式私钥文本(自动还原 |
Base64 私钥 |
|
| Base64 编码私钥(彻底避免换行丢失,免文件挂载!) |
私钥解密口令 |
|
| 若私钥受密码保护,提供解密口令 |
配置别名 |
|
| 继承本地 |
跳板机主机 |
|
| ProxyJump 堡垒机/跳板机 IP 或域名 |
跳板机端口 |
|
| 跳板机端口,默认 |
跳板机用户 |
|
| 跳板机登录用户名 |
跳板机密码 |
|
| 跳板机认证密码(可选) |
跳板机私钥 |
|
| 跳板机专用私钥文本或 Base64 编码(可选) |
跳板机私钥口令 |
|
| 跳板机私钥解密口令(可选) |
建连超时时间 |
|
| 目标建连超时时间(毫秒),默认 |
心跳保活间隔 |
|
| KeepAlive 心跳间隔(毫秒),默认 |
致命命令逃生门 |
|
| 宽容布尔值( |
📌 解析优先级规则:
MCP_SSH_* (官方标准前缀,最高)>SSH_* (向下兼容前缀)>系统内置默认推导。本地执行时会自动探测读取同级目录下的.env文件。
🔌 远程服务调用 (SSE 协议客户端接入)
若服务已部署在局域网服务器、NAS(群晖/威联通)或云容器中,MCP 客户端可直接通过标准 HTTP SSE 端点网络接入,无需在客户端本地安装 Node.js 或运行子进程:
{
"mcpServers": {
"ssh-remote": {
"url": "http://192.168.1.100:8000/sse"
}
}
}服务端点矩阵与健康检查探针
在 SSE 模式下,轻量 HTTP 服务对外暴露以下规范端点:
端点路由 | HTTP 方法 | 功能说明 | 响应格式 / 状态 |
|
| 建立长轮询 Server-Sent Events 事件流,协商客户端 Session |
|
|
| 客户端发送 JSON-RPC 消息请求(需携带 |
|
|
| 服务就绪与存活探针(支持 Docker/K8s 容器健康检查) |
|
探针请求回显范例:
{
"status": "ok",
"service": "mcp-server-ssh",
"version": "1.2.4",
"timestamp": "2026-10-04T02:00:00.000Z"
}🐳 生产环境容器化常驻部署 (Docker & Docker Compose)
项目已由 GitHub Actions CI/CD 自动构建并发布官方多架构镜像(全平台支持 linux/amd64 与 linux/arm64,适配 Intel/AMD x86 服务器、Mac M系列及树莓派/ARM 云主机)。无需克隆源码仓库,只需单文件配置即可一键秒级拉起常驻守护服务。
1. 使用 Docker Compose 一键拉起(推荐 ⭐⭐⭐⭐⭐)
无需下载整个代码库,仅需下载或新建 docker-compose.yaml 即可常驻运行:
# 方式 A:单行命令直接从 GitHub 拉取配置并启动服务
curl -fsSL https://raw.githubusercontent.com/atengk/mcp-server-ssh/main/docker-compose.yaml -o docker-compose.yaml && docker compose up -d
# 常用运维命令
docker compose logs -f # 查看服务实时日志
docker compose pull # 一键更新至官方最新镜像
docker compose down # 优雅停止服务docker-compose.yaml 核心配置参考:
services:
mcp-server-ssh:
# 官方预构建多架构镜像 (默认最新版,亦可指定具体版本如 :1.2.3)
image: ghcr.io/atengk/mcp-server-ssh:${MCP_SSH_IMAGE_TAG:-latest}
container_name: mcp-server-ssh
restart: unless-stopped
ports:
- "8000:8000"
environment:
# 启用 SSE 协议常驻服务
- MCP_SSH_TRANSPORT=sse
- MCP_SSH_SERVER_HOST=0.0.0.0
- MCP_SSH_SERVER_PORT=8000
# 默认目标服务器凭据 (纯环境变量注入,免文件挂载)
- MCP_SSH_HOST=192.168.1.100
- MCP_SSH_PORT=22
- MCP_SSH_USER=root
- MCP_SSH_PASSWORD=your_secure_password
# 亦支持私钥文本/Base64 纯环境变量注入:
# - MCP_SSH_PRIVATE_KEY_BASE64=LS0tLS1CRUdJTi...
volumes:
# 可选: 若需要复用宿主机 ~/.ssh/ 凭据 (只读挂载)
# - ~/.ssh:/home/node/.ssh:ro2. 使用 Docker CLI 独立运行
亦可直接使用标准 docker run 命令启动(支持 linux/amd64 与 linux/arm64 双架构):
# 方式 A:SSE 远程常驻模式 (后台守护 + 端口映射 + 纯环境变量)
docker run -d \
--name mcp-server-ssh \
-p 8000:8000 \
-e MCP_SSH_TRANSPORT=sse \
-e MCP_SSH_HOST=192.168.1.100 \
-e MCP_SSH_USER=root \
-e MCP_SSH_PASSWORD=your_password \
ghcr.io/atengk/mcp-server-ssh:1.2.3
# 方式 B:本地 stdio 单次管道模式 (宿主机无需安装 Node.js)
# 客户端直接将 docker run 作为 command 执行,stdio 直接管道透传
docker run -i --rm \
-e MCP_SSH_TRANSPORT=stdio \
-e MCP_SSH_HOST=192.168.1.100 \
-e MCP_SSH_USER=root \
-e MCP_SSH_PASSWORD=your_password \
ghcr.io/atengk/mcp-server-ssh:1.2.3🌐 多服务器连接与集群管理 (Multi-Host Architecture)
@atengk/mcp-server-ssh 内置企业级连接池管理器(ConnectionPool),原生支持在单个服务内同时维持与调度多台 Linux 主机。根据您的使用习惯,提供三种灵活的架构模式:
模式一:单 MCP 实例内的【动态连接池路由】(最灵活、推荐)
只需启动一个通用的 MCP 服务(如上述“场景 5”的空载配置),AI 即可在自然语言对话中随时建立、切换并并发调度多台主机:
跨主机协同调度机制
所有命令与文件工具(ssh_exec、sftp_* 等)均包含可选参数 connectionId:
建立连接:调用
ssh_connect时指定connectionId: "prod"或connectionId: "test";定向下发:传入
connectionId时,请求将精准路由至对应主机的物理通道;未传入时自动路由至当前的默认连接(Default Connection);跨机数据同步:AI 可在一个任务链中从主机 A 下载文件(
sftp_download(..., connectionId: "test")),紧接着直接上传至主机 B(sftp_upload(..., connectionId: "prod"))!
跨机实战对话范例:
用户:“帮我连上生产机
192.168.1.100:22(命名为prod),再连上测试机192.168.1.50:22(命名为test)。然后对比两台机器的可用内存。”🤖 AI 行为:
调用
ssh_connect({ host: "192.168.1.100", port: 22, username: "root", connectionId: "prod", setAsDefault: true });调用
ssh_connect({ host: "192.168.1.50", port: 22, username: "dev", connectionId: "test" });分别调用
ssh_exec({ command: "free -m", connectionId: "prod" })与ssh_exec({ command: "free -m", connectionId: "test" });对比两台服务器的内存指标并为您生成直观的可视化对比表格。
模式二:客户端级别的【静态多实例隔离】(物理隔离、互不干扰)
如果您希望在客户端一打开时就有几个完全独立、固定常驻的主机通道,直接在客户端配置文件中声明多个独立的 Server 实例:
{
"mcpServers": {
"ssh-prod": {
"command": "npx",
"args": ["-y", "@atengk/mcp-server-ssh"],
"env": {
"SSH_HOST": "192.168.1.100",
"SSH_PORT": "22",
"SSH_USER": "root",
"SSH_KEY_PATH": "D:/files/server/id_ed25519"
}
},
"ssh-test": {
"command": "npx",
"args": ["-y", "@atengk/mcp-server-ssh"],
"env": {
"SSH_HOST": "192.168.1.50",
"SSH_PORT": "22",
"SSH_USER": "dev",
"SSH_PASSWORD": "test_password"
}
}
}
}效果:客户端会同时启动两个独立的 Node.js 子进程,AI 的工具箱中会自动隔离出
ssh-prod:ssh_exec和ssh-test:ssh_exec两个独立工具集。
模式三:继承本地 ~/.ssh/config 集群别名(零凭证泄露)
在宿主机的 ~/.ssh/config 中配置多主机拓扑(含各自私钥、自定义端口与跳板机),启动服务后,无需在聊天中告知 AI 任何敏感 IP 或密码:
用户:“帮我连上本地配置里的
ali-prod和tencent-test主机。”
🤖 AI:自动通过sshConfigAlias建立连接并映射路由,安全优雅!
💬 AI 对话实战范例 (Showcase & Prompts)
配置完成后,您可以直接在 AI 聊天窗口中像与专业资深运维工程师对话一样发出自然指令:
🎯 场景 A:日常系统巡检与资源监控
用户:“帮我巡检一下当前服务器的健康状态:检查内核版本、CPU 负载、可用内存以及根目录磁盘空间。”
🤖 AI 行为:自动调用
ssh_exec执行uname -r、uptime、free -m、df -h /,格式化提取核心指标并为您生成美观的巡检摘要。
🎯 场景 B:服务配置热更新与平滑重载
用户:“把
/etc/nginx/nginx.conf中的worker_processes修改为4,确认语法无误后平滑重载 Nginx。”🤖 AI 行为:
调用
sftp_read_file查阅原配置文件;将修改后的内容通过
sftp_write_file安全覆盖回写;调用
ssh_exec运行nginx -t测试配置语法;语法正确后执行
nginx -s reload并向您汇报执行状态。
🎯 场景 C:异常日志排查与智能截断保护
用户:“分析
/var/log/syslog中最近发生的错误日志,找出异常原因。”🤖 AI 行为:自动调用
ssh_exec或sftp_read_file查阅日志。即使远端日志文件达到数十兆,OutputTruncator也会自动智能截断,保留头部标头与最新的 56KB 报错堆栈,彻底避免上下文撑爆。
🎯 场景 D:长阻塞进程实时跟踪与 Ctrl+C 中断
用户:“在终端中实时跟踪
tail -f /var/log/app.log,观察 5 秒后帮我发送 Ctrl+C 中断它。”🤖 AI 行为:自动调用
ssh_session_start开启 PTY 终端并启动 tail 进程;通过ssh_session_send获取流式增量回显,随后下发\x03(Ctrl+C) 安全终止进程,最后调用ssh_session_close回收伪终端资源。
🎯 场景 E:文件双向极速上传与备份
用户:“把本地当前目录下的
config.prod.yaml上传到服务器的/data/app/config.yaml,并在上传前把远程旧文件备份为.bak。”🤖 AI 行为:自动调用
ssh_exec执行备份命令,随后调用sftp_upload高效完成文件传输并校验文件大小。
🛠️ 全量 17 个原子工具矩阵参考 (Tools)
分类 | 工具名称 | 功能描述 | 核心参数 |
基础运维 |
| 检测 MCP 服务存活、版本及协议延迟 |
|
连接管理 |
| 建立新 SSH 连接或依据配置别名载入 |
|
| 安全关闭并移除指定的物理 SSH 连接 |
| |
| 列出当前连接池中所有活跃连接及默认路由 | 无 | |
| 读取并列出本机 | 无 | |
命令执行 |
| 无状态执行远程命令(继承 PATH,支持 dryRun 与安全逃生门) |
|
持久终端 |
| 启动常驻交互式 PTY 伪终端会话流 |
|
| 向 PTY 终端注入输入或控制信号(如 |
| |
| 优雅关闭指定的交互式终端会话并回收系统资源 |
| |
文件系统 |
| 读取远程文本文件(单次限制 512KB 防撑爆) |
|
| 写入并覆盖远程文本文件(支持自动递归建父目录) |
| |
| 浏览远程目录,返回 POSIX 元数据列表 |
| |
| 获取指定远程文件或目录的详细 POSIX 状态 |
| |
| 在远程主机上创建目录(默认递归 |
| |
| 删除远程文件或目录(支持级联删除与防环保护) |
| |
| 将宿主机本地文件极速上传至远程目标路径 |
| |
| 将远程主机文件极速下载至宿主机本地目标路径 |
|
🛡️ 安全防御矩阵与演练模式 (SafetyGuard)
为了防范 AI 模型幻觉引发毁灭性系统灾难,服务内置了强力前置守卫:
实时拦截黑名单:自动阻断系统全盘强删(
rm -rf /、rm -rf /*)、块设备覆写(mkfs、dd if=... of=/dev/...)、系统停机关机(reboot、shutdown、init 0)、清空根权限(chmod -R 000 /)及 Fork 炸弹等。运维受控逃生门:针对系统管理员确需执行重启等特殊运维任务的场景,服务提供双重授权逃生门机制——必须在服务端配置环境变量
SSH_ALLOW_DANGEROUS_COMMANDS=true,且在ssh_exec调用时显式传入dangerouslySkipSafetyCheck: true方可放行,单方面调用将被严格拒绝。实机绝对安全:拦截发生在客户端下发前,危险字节流绝对不会走出本地网络,远端物理通道零受影响。
安全演练模式 (
dryRun):在调用ssh_exec时传入dryRun: true,可在不下发执行的前提下验证命令是否符合安全规则。
❓ 常见问题与排坑指南 (FAQ & Troubleshooting)
🏗️ 架构拓扑 (Architecture)
flowchart TD
subgraph ClientSide ["AI 客户端生态 (MCP Client)"]
LocalClient["本地客户端 (Claude Desktop / Cursor / Antigravity)"]
RemoteClient["远程/局域网客户端 (Dify / Web / 移动端)"]
end
subgraph MCP_Server["@atengk/mcp-server-ssh (Node.js Bundle / Docker)"]
Transport{"双模传输分发路由\n(MCP_SSH_TRANSPORT)"}
Stdio["Stdio 传输通道"]
SSE["HTTP SSE 传输服务 (8000 端口)"]
subgraph Config_Module["12-Factor 配置中枢"]
Env["环境解析器 (src/config/env.ts)\n强类型校验 + Base64 私钥自动解码"]
end
subgraph Safety_Module["前置安全守卫 & 输出流控"]
Guard["SafetyGuard (致命破坏模式阻断)"]
Truncator["OutputTruncator (64KB 双端智能截断)"]
end
subgraph Core_Services["核心能力服务"]
ConnPool["ConnectionPool (多主机连接池与心跳保活)"]
Exec["ExecService (无状态登录 Shell 执行)"]
Session["SessionService (常驻 PTY 终端会话流)"]
SFTP["SFTPService (POSIX 文件系统与防环)"]
end
end
subgraph Remote_Network["远程目标网络"]
Bastion["ProxyJump 堡垒机 / 跳板机"]
LinuxHost["目标 Linux 服务器 (OpenSSH Server)"]
end
LocalClient <==>|JSON-RPC via stdio| Stdio
RemoteClient <==>|HTTP GET / POST via sse| SSE
Stdio --> Transport
SSE --> Transport
Env --> ConnPool
Transport --> Safety_Module
Safety_Module --> Core_Services
ConnPool -.->|SSH 隧道转发| Bastion
Bastion -.->|Direct TCP/IP| LinuxHost
ConnPool ===>|SSH2 / SFTP 子通道| LinuxHost🏛️ 架构决策记录 (Architecture Decision Records)
本项目遵循严格的 ADR 演进机制:
🌐 官方生态与目录收录 (Community Catalogs)
本项目支持通过标准 PR / Issue 形式收录至全球 MCP 目录:
Model Context Protocol 官方社区:modelcontextprotocol/servers
Glama MCP Directory:glama.co/mcp/servers
PulseMCP Registry:pulsemcp.com
Awesome MCP Servers:punkpeye/awesome-mcp-servers
🤝 参与贡献 (Contributing)
欢迎任何形式的贡献、优化建议与缺陷反馈!在提交 Pull Request 前请阅读我们的 贡献指南 (CONTRIBUTING.md)。
📄 开源许可证 (License)
本项目基于 MIT License 协议完全开源。
Available Tools
17 toolssftp_downloadC
将远程主机上的文件快速下载到宿主机本地指定路径
| Name | Required | Description | Default |
|---|---|---|---|
| localPath | Yes | 保存到宿主机本地的绝对路径 | |
| remotePath | Yes | 待下载的远程主机文件绝对路径 | |
| connectionId | No | 目标连接标识符,缺省时使用当前默认连接 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It says nothing about whether an existing local file is overwritten, whether parent directories are created, whether the transfer is atomic/streamed, what happens on a missing remote file, or what the tool returns — all material for a tool that writes to the local filesystem.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with the operation and direction stated first and no filler. It is efficient, though the terseness is also what leaves the behavioral gaps unaddressed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema and no annotations mean the description must cover behavior, yet it omits overwrite semantics, directory creation, error cases and connection prerequisites. For a tool in a 16-sibling SSH/SFTP suite, that is insufficient to call it safely.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so remotePath, localPath and connectionId are already documented (including the default-connection fallback for connectionId). The description adds no format, path-syntax or connection-selection detail beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (下载/download) and resource (文件/file) with an explicit direction (远程主机 → 宿主机本地路径), which cleanly separates it from the sibling sftp_upload. It does not name any sibling, but the directional wording makes the distinction obvious without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no prerequisites (e.g. an active connection or ssh_connect having been called), and no mention of alternatives such as sftp_read_file for reading contents versus downloading a whole file. The agent is left to infer context entirely.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sftp_list_dirC
列出远程目录下的文件与子目录元数据列表
| Name | Required | Description | Default |
|---|---|---|---|
| remotePath | Yes | 待浏览的远程目录绝对路径 | |
| connectionId | No | 目标连接标识符,缺省时使用当前默认连接 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full behavioral burden. While '列出' implies a read-only operation, it omits key details such as authentication requirements, pagination, symlink handling, and whether the operation has any side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted words. However, its extreme brevity leaves gaps that could be addressed without sacrificing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, but the absence of an output schema means the description should ideally explain the return structure or metadata fields. It only states that a metadata list is returned, without specifying fields like name, size, or type, and no annotations cover safety or behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the schema fully documents both parameters. The description adds no additional meaning beyond what the schema already provides for remotePath and connectionId, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description specifies the verb ('列出') and resource ('远程目录下的文件与子目录'), clearly identifying a directory-listing operation. It does not explicitly differentiate from siblings like sftp_stat or sftp_read_file, but the purpose is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus alternatives such as sftp_stat (for single file metadata) or sftp_read_file (for file contents). The description only states what it does, leaving the agent to infer appropriate usage contexts.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sftp_mkdirC
在远程主机上创建目录(默认类似 mkdir -p 递归创建上级目录)
| Name | Required | Description | Default |
|---|---|---|---|
| recursive | No | 是否类似 'mkdir -p' 递归创建上级目录,默认 true | |
| remotePath | Yes | 待创建的远程目录绝对路径 | |
| connectionId | No | 目标连接标识符,缺省时使用当前默认连接 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It hints at idempotent-style behavior via the 'mkdir -p' analogy, but says nothing about error handling when the directory already exists, permission requirements, or what happens on partial failure – and the mkdir -p note merely repeats the schema's own recursive parameter text.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short sentence with the core operation front-loaded and a brief parenthetical qualifier; nothing is padded. The parenthetical is mildly redundant with the schema, keeping it just under a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple mutation tool with full schema coverage and no output schema, the description is minimally adequate. It leaves out existence/overwrite behavior and connection prerequisites, which an agent would want before invoking a remote write.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all three parameters are already documented in the schema; baseline 3 applies. The description's parenthetical about recursive parent creation duplicates the schema text for the recursive parameter rather than adding new meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource: creating a directory on a remote host, which is inherently distinguishable from siblings like sftp_write_file, sftp_upload, or sftp_list_dir. It does not explicitly name or contrast with a sibling, so it stays at 4 rather than 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description offers no when-to-use guidance, no prerequisites (e.g. that a connection must exist or that connectionId/current default is used), and no mention of alternatives. Usage is only implied by the verb itself.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sftp_read_fileA
读取远程主机文本文件内容(单次读取限制 512KB 防爆,超出建议下载)
| Name | Required | Description | Default |
|---|---|---|---|
| encoding | No | 文件文本解码字符集,默认 utf-8 | utf-8 |
| maxBytes | No | 最大读取字节数限制,默认 512KB (524288 字节),超出则拦截并建议下载 | |
| remotePath | Yes | 远程文件绝对路径(必须以 '/' 开头) | |
| connectionId | No | 目标连接标识符,缺省时使用当前默认连接 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It usefully discloses the hard 512KB read cap and that exceeding it triggers interception plus a download suggestion, which is real behavior beyond the schema. However, it says nothing about error behavior, binary/encoding failure handling, permission requirements, or what the call returns.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact sentence with the core action front-loaded and the limit/fallback parenthesized after it. Every clause earns its place; nothing is redundant filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 4-parameter read tool with no annotations and no output schema, the description covers the critical size constraint but omits what the caller receives (text content string?), how binary or oversized content behaves in practice, and default-connection behavior. Adequate but with clear gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all four parameters (encoding, maxBytes, remotePath, connectionId) are already documented in the schema; this is the baseline case where the schema does the heavy lifting. The description's 512KB mention merely restates the maxBytes default/limit rather than adding new semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('读取远程主机文本文件内容'), so an agent immediately knows this reads a remote text file rather than writing, listing, or stat-ing one. It implicitly routes oversized reads toward the download sibling ('超出建议下载') but never names sftp_download explicitly, so it stops short of full sibling differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a clear use condition (reading remote text file content) and an implicit when-not: files exceeding the 512KB single-read limit should go to a download instead. There is no explicit prerequisite or connection guidance, but the boundary condition for choosing an alternative is present.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sftp_removeB
删除远程文件或目录(支持非空目录递归级联删除,内置防环保护)
| Name | Required | Description | Default |
|---|---|---|---|
| recursive | No | 若为目录且非空,是否级联递归删除,默认 false(防止误删) | |
| remotePath | Yes | 待删除的远程文件或目录绝对路径 | |
| connectionId | No | 目标连接标识符,缺省时使用当前默认连接 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does reasonably well: it discloses recursive cascade behavior and built-in loop protection. However, it does not state whether deletion is permanent/irreversible or whether permissions are required, which matters for a destructive operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single compact sentence in a parenthetical structure; front-loaded with the core action and supplementary behaviors. Slightly dense but no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive tool with no annotations and no output schema, the description covers recursive behavior and loop protection but omits irreversibility, permission requirements, and error/return behavior. Adequate but leaves meaningful gaps for a delete operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all three parameters (recursive, remotePath, connectionId) are fully documented in the schema. The description mentions recursive deletion at a high level but adds no syntax or format detail beyond the schema. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('删除远程文件或目录' = delete remote file/directory) and adds distinguishing details (non-empty directory recursive cascade deletion, built-in loop protection). Clear enough to separate from siblings like sftp_upload or sftp_write_file, though it doesn't explicitly name an alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this vs alternatives or when to avoid it. The recursive default of false implies a safety posture, but there is no explicit when/when-not instruction or prerequisite (e.g., connection state) mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sftp_statC
获取远程文件或目录的 POSIX 详细元数据信息
| Name | Required | Description | Default |
|---|---|---|---|
| remotePath | Yes | 待检查状态的远程路径 | |
| connectionId | No | 目标连接标识符,缺省时使用当前默认连接 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. '获取…信息' implies a read-only, non-destructive operation, which is useful, but it says nothing about error behavior for missing paths, symlink handling, or whether a connection must already be open.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler. It is efficient, though it is arguably too terse to carry the missing usage and behavioral context the tool needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter read tool with full schema coverage, the description is minimally sufficient to invoke correctly. With no output schema and no annotations, it could have disclosed what metadata is returned and how failures surface, but it stops short.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both remotePath and connectionId (including its default-connection fallback) are already documented in the schema. The description adds no format, path-style, or defaulting detail beyond that, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (获取/get) and resource (remote file or directory POSIX metadata), so an agent knows this retrieves metadata for a single path rather than listing contents. It does not, however, name or distinguish itself from the closest sibling, sftp_list_dir.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this instead of sftp_list_dir or sftp_read_file, nor any mention of prerequisites (e.g., an active connection). The agent must infer usage entirely from the name and the 'file or directory' phrasing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sftp_uploadC
将宿主机本地文件快速上传至远程目标主机
| Name | Required | Description | Default |
|---|---|---|---|
| localPath | Yes | 宿主机本地文件的绝对路径 | |
| remotePath | Yes | 上传到远程主机的绝对目标路径 | |
| connectionId | No | 目标连接标识符,缺省时使用当前默认连接 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It claims a 'fast' upload but says nothing about overwrite behavior on an existing remote file, required permissions, connection requirements (connectionId defaults to the current connection), or how failures are reported — all material for a mutation tool with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short sentence with no filler, and the source-to-destination framing is front-loaded. It is efficient but so terse that it forgoes any useful elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 3-parameter tool with a fully documented schema and no output schema, the description is just barely sufficient. It omits overwrite semantics, error behavior, and any statement of what distinguishes it from sftp_write_file, which a mutation tool with no annotations should cover.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so localPath, remotePath and connectionId are already documented in the schema, including the default-connection behavior. The description adds no syntax, path format, or override details beyond that, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (上传/upload), the source (宿主机本地文件) and the destination (远程目标主机), so the agent knows the direction of transfer. It does not distinguish itself from the sibling sftp_write_file, which also writes to a remote path, leaving ambiguity about which to pick.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no when-to-use or when-not-to-use guidance and never names an alternative such as sftp_write_file or sftp_download. An agent must infer selection purely from the tool name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sftp_write_fileB
写入并覆盖远程主机文本文件(支持自动递归创建父级目录)
| Name | Required | Description | Default |
|---|---|---|---|
| content | Yes | 待写入的文本内容 | |
| remotePath | Yes | 远程文件绝对路径 | |
| connectionId | No | 目标连接标识符,缺省时使用当前默认连接 | |
| createDirectories | No | 当远程父级目录不存在时是否自动递归创建,默认 true |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the full burden. It does disclose two meaningful traits beyond the schema: the write overwrites existing content, and parent directories are auto-created recursively. But it omits encoding, error behavior on failure, permission requirements, and whether the overwrite is atomic or truncating.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single tight sentence with the core action front-loaded and secondary behavior in parentheses. No filler, though it is on the sparse side for a mutation tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 4-parameter write tool with no annotations and no output schema, the description covers the essential overwrite-and-create behavior but leaves unanswered what happens on failure, how existing file contents are affected mid-write, and whether special handling applies to non-text content.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all four parameters are already documented, setting the baseline at 3. The description reinforces the createDirectories default behavior but adds no syntax, path-format, or content-type details beyond what the schema states.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('写入并覆盖远程主机文本文件') and adds the qualifier 'text file', which implicitly separates it from the binary-oriented sftp_upload sibling. However, it never names or contrasts with any sibling explicitly, so differentiation is left to inference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use or when-not-to-use guidance. The phrase '文本文件' hints that binary transfers belong to sftp_upload, but the agent is not told this, nor are prerequisites (connection setup, permissions) or the relationship to sftp_mkdir described.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_connectB
建立新的 SSH 主机连接,或依据本地 ~/.ssh/config 别名载入配置
| Name | Required | Description | Default |
|---|---|---|---|
| host | No | 目标 Linux 服务器的主机名或 IP 地址 | |
| port | No | SSH 端口号,默认 22 | |
| password | No | 登录密码(可选,优先推荐使用密钥认证) | |
| username | No | 登录远程主机的用户名 | |
| proxyJump | No | 跳板机别名、连接字符串 (user@bastion:22) 或结构化认证凭据配置 | |
| passphrase | No | 若私钥受密码保护,提供解密口令 | |
| privateKey | No | PEM/OpenSSH 格式的私钥内容,或私钥文件的本地绝对路径 | |
| connectionId | No | 自定义连接标识符,未指定则自动分配唯一 ID | |
| readyTimeout | No | 建立连接就绪握手超时时间(毫秒),默认 30000 | |
| setAsDefault | No | 是否将该连接设为后续操作的默认活跃连接,默认 true | |
| sshConfigAlias | No | 本地 ~/.ssh/config 中配置的 Host 别名(如 prod-server) | |
| keepaliveInterval | No | 心跳保活检测发送间隔(毫秒),默认 10000 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It only states that it establishes or loads a connection; it omits authentication flow, connection persistence, error handling, and whether the connection becomes the default active connection (setAsDefault is only in schema).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler. It efficiently conveys the core purpose and the alias-based alternative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 12-parameter connection tool with no annotations and no output schema, the description is too thin. It does not explain that this creates a persistent connection usable by ssh_exec/ssh_session_* tools, nor does it cover authentication expectations or lifecycle management.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 12 parameters. The description adds a small hint about ~/.ssh/config alias usage but does not explain parameter syntax or interactions beyond that.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource (建立 SSH 主机连接) and an alternative mode (载入 ~/.ssh/config 别名). It clearly distinguishes from siblings like ssh_exec or sftp_* which operate on an existing connection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Describes two connection modes but gives no guidance on when to use this tool versus ssh_session_start, ssh_ping, or other siblings. No prerequisites or when-not conditions are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_disconnectB
断开并关闭指定的 SSH 物理网络连接
| Name | Required | Description | Default |
|---|---|---|---|
| connectionId | Yes | 待关闭的 SSH 连接标识符 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It states that a connection is closed but omits whether the connection must be active, what happens on failure, whether the operation is reversible, or any side effects on sessions tied to the connection.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with no wasted words that names the action and its target directly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool with no output schema this is minimally adequate, but with no annotations and no differentiation from ssh_session_close, an agent lacks enough context to choose confidently between the two.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the single connectionId parameter is fully documented in the schema. The description adds no meaning beyond what the schema already provides, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb pair (断开/关闭) and resource (指定的 SSH 物理网络连接), making the operation clear. It does not, however, differentiate itself from the sibling ssh_session_close, which an agent could easily confuse with closing a connection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit statement of when to use this tool versus alternatives such as ssh_session_close or when not to call it. Usage is only implied by the tool name and verb.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_execA
在远程 Linux 主机执行单次无状态 Bash/Shell 命令,精准返回退出码、标准输出与标准错误
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | 初始执行工作目录(自动包装为 cd <cwd> && <command>) | |
| env | No | 注入远程环境的环境变量键值对 | |
| dryRun | No | 是否仅通过安全拦截守卫检测合规性,而不真正下发执行,默认 false | |
| command | Yes | 待在远程 Linux 系统执行的 Bash/Shell 命令 | |
| rawExec | No | 是否绕过登录 Shell 包装(bash -l -c),直接以非登录 Shell 原生执行,默认 false | |
| timeoutMs | No | 执行超时时间(毫秒),默认 60000ms (1分钟) | |
| connectionId | No | 目标连接标识符,缺省时自动路由至当前默认活跃连接 | |
| dangerouslySkipSafetyCheck | No | 是否强制跳过前置高危安全拦截规则(危险操作逃生门,需同时配置环境变量 SSH_ALLOW_DANGEROUS_COMMANDS=true 授权) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations at all, the description carries the full behavioral burden. It does disclose two important traits: the call is stateless and it returns exit code, stdout and stderr. It says nothing about the safety-interception guard (which can refuse or block a command), authentication requirements, or connection routing behavior — a notable gap for an execution tool with no annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, tightly packed sentence with zero filler, front-loading the action, target and scope before the return contract. Nothing is redundant and nothing is buried.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, and the description compensates by stating the return contract (exit code, stdout, stderr), which is exactly what an agent needs. The safety-guard and connection-routing behavior is largely covered by the parameter descriptions in the schema, but the absence of any annotation means some operational context (auth, blocking semantics) remains unstated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all eight parameters (including cwd, env, dryRun, rawExec, timeoutMs, connectionId, dangerouslySkipSafetyCheck) are already documented in the schema. The description adds no parameter-level detail beyond what is structured, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb+resource (execute a Bash/Shell command on a remote Linux host) and adds the scope qualifier '单次无状态' (single, stateless), which cleanly separates it from the stateful ssh_session_send/session tools. An agent can distinguish it from every sftp_* and ssh_session_* sibling without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase '单次无状态' implies when this tool is appropriate (one-shot commands, no persistent shell state), which is useful context. However, it never names an alternative or an exclusion condition, so the agent must infer that ssh_session_start/send exists for multi-step stateful work.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_list_config_hostsA
读取并列出本地 ~/.ssh/config 中解析到的所有 Host 别名与基本配置
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the behavioral burden. It usefully discloses the data source (~/.ssh/config) and the read-only nature implied by 读取并列出, but says nothing about failure behavior when the file is missing or malformed, or whether values are masked. For a zero-parameter read tool this is acceptable but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; the action and the data source appear before any detail. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description does sketch the return contents (all Host aliases and their basic configuration), which is the key missing piece an agent would need. No annotations or params exist to be explained, so only the edge-case behavior is left unstated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, which is the baseline-4 case. The description also previews what is returned (Host aliases plus basic configuration), adding modest value, though there is no parameter surface to elaborate on.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb pair (读取并列出 / read and list) and a precise resource (Host aliases in the local ~/.ssh/config), which clearly separates it from ssh_list_connections (live connections) and the sftp_* tools. It does not explicitly name a sibling for contrast, but the resource is narrow enough that an agent can disambiguate without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies its usage context (inspecting the parsed local SSH config) but gives no explicit when-to-use guidance, no prerequisites (e.g., whether the file must exist), and no exclusions relative to ssh_list_connections or ssh_connect. Adequate but leaves the routing decision to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_list_connectionsA
列出当前所有已建立且存活的 SSH 连接与默认路由状态
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description must carry the behavioral burden. It discloses scope (only established/alive connections, includes default route state) and '列出' implies a read-only, non-mutating operation, but it says nothing about required permissions, whether it contacts remote hosts, or the shape of results.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single tight sentence, front-loaded with the primary resource and with no redundant or padded clauses. Every phrase (established/alive, default route) contributes scope.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, no-output-schema read tool, the description is nearly sufficient: it tells the agent what is enumerated and adds the default-route scope. Only minor gaps remain, such as whether results include per-connection status detail or routing table contents.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is no parameter semantics to document; the 4 baseline applies. The description correctly avoids inventing parameters and adds no misleading signature information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource: listing currently established and alive SSH connections, plus default route status. The 'established and alive' qualifier implicitly distinguishes it from the config-listing sibling ssh_list_config_hosts, but it never names that sibling or any other, so differentiation is left to inference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the resource ('list active connections' clearly signals a monitoring/inspection use), but there is no explicit when-to-use, when-not-to-use, or reference to alternatives such as ssh_list_config_hosts or ssh_session_start. Adequate but leaves routing to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_pingA
测试 SSH MCP 服务的存活状态、版本信息与通信延迟
| Name | Required | Description | Default |
|---|---|---|---|
| message | No | 回显自定义消息内容 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose the observable behavior (liveness, version, latency) which hints at the response. However it says nothing about whether it is read-only, whether it opens a network connection, or what side effects the echoed message has, leaving real behavioral gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded clause that states the resource and the three things it verifies, with zero filler. Nothing is redundant and nothing needs to be moved.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-optional-parameter diagnostic tool with no output schema and no annotations, the description's enumeration of liveness/version/latency effectively conveys what comes back and is sufficient to call it. Only the echo parameter's purpose is left entirely to the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the single optional 'message' parameter is documented as an echo payload in the schema. The description adds no semantics for it, so the baseline of 3 applies with the schema doing the work.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb (测试/test) and resource (SSH MCP 服务) and enumerates what it checks: liveness, version info, and latency. This clearly separates it from siblings like ssh_exec or sftp_* which act on remote hosts rather than the local service itself, though it never explicitly references an alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: a health/latency probe is naturally used for diagnostics or connectivity checks before connecting, but the description never states when to call it versus ssh_connect or ssh_list_connections. No prerequisites or exclusions are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_session_closeB
关闭指定的持久交互式 PTY 终端会话并回收系统资源
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | 待关闭的 PTY 终端会话 ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full behavioral disclosure. It states that the session is closed and resources reclaimed, but omits whether termination is graceful or abrupt, what happens to running processes, required permissions, error behavior, and whether the operation is irreversible.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with no redundant or filler content. It states the action and the resource immediately and ends cleanly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter close tool with a fully described parameter, the description conveys the essential purpose and cleanup effect. However, with no annotations and no output schema, it should disclose more about side effects and safety to be fully complete for a destructive-style operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the single sessionId parameter is fully documented in the schema. The description adds no additional meaning, format, or constraints beyond what the schema already provides, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (关闭) and a precise resource (指定的持久交互式 PTY 终端会话), including a cleanup outcome (回收系统资源). It does not explicitly distinguish itself from siblings such as ssh_disconnect or ssh_session_send, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance, prerequisites, or alternative tools are named. The usage is only implied by the action of closing a session; there is no explicit context for choosing this tool over ssh_disconnect or other session or connection operations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_session_sendA
向指定的持久 PTY 终端写入指令或控制信号(如 '\x03' 发送 Ctrl+C),并收集增量屏幕回显
| Name | Required | Description | Default |
|---|---|---|---|
| input | Yes | 待发送的数据内容或控制字符(如 '\x03' 发送 Ctrl+C) | |
| sessionId | Yes | 目标持久 PTY 终端会话 ID | |
| waitForMs | No | 等待收集终端响应输出的时间(毫秒),默认 1000ms |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It does add real behavioral value by disclosing that the call collects incremental screen echo and by showing that raw control bytes are accepted, but it is silent on error handling, whether a trailing newline is needed, what happens to a closed/expired session, and other side effects of writing to a live PTY.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with the action first and the control-signal example parenthetically attached. No padding or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a three-parameter interactive I/O tool with no output schema, the description adequately covers what is written and that incremental screen output is returned, and the schema fills in the rest. Only the absence of session-lifecycle/error expectations keeps it from being fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, covering input, sessionId, and waitForMs, so the schema already documents all three parameters. The description only restates the control-character example already present in the input schema, adding no new semantics such as expected byte encoding or how waitForMs truncates output.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (写入/write input or control signals) against a specific resource (指定的持久 PTY 终端/persistent PTY session), and the Ctrl+C example makes the intent concrete. It implicitly separates itself from one-shot ssh_exec by insisting on a persistent PTY, but never names a sibling explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The mention of a 'persistent PTY session' implies this is for interactive sessions started via ssh_session_start, but the description never states when to choose this over ssh_exec or how it relates to ssh_session_close. Usage is inferable rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_session_startA
在远程主机启动持久交互式伪终端 (PTY) 会话,支持跨多次输入维持环境状态
| Name | Required | Description | Default |
|---|---|---|---|
| cols | No | 伪终端列数宽度,默认 120 | |
| rows | No | 伪终端行数高度,默认 30 | |
| connectionId | No | 目标连接标识符,缺省时自动路由至当前默认连接 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the full behavioral burden. It usefully discloses that the session is persistent and state-preserving, but omits lifecycle facts: that it must be driven by ssh_session_send and torn down with ssh_session_close, whether sessions are resource-limited, or what happens on reconnect.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; the core action and its key differentiator (persistent state) come first.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a session-lifecycle tool with no annotations and no output schema, the description covers what it does but not how the returned session is used or closed. An agent still needs the sibling tools to understand the full lifecycle, leaving a real gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so cols, rows, and connectionId are already documented in the schema (including defaults and the default-connection routing behavior). The description adds no parameter-level meaning, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: start a persistent interactive PTY session on a remote host. The qualifiers '持久交互式' and '跨多次输入维持环境状态' implicitly separate it from the one-shot ssh_exec sibling, though no sibling is named explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear context for when to use it — when an agent needs an interactive session whose state survives multiple inputs. It stops short of stating exclusions or naming ssh_exec/ssh_connect as alternatives, so it is clear context without routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
17 tool updates
v1.2.5- First observed
sftp_download - First observed
sftp_list_dir - First observed
sftp_mkdir - First observed
sftp_read_file - First observed
sftp_remove - First observed
sftp_stat - First observed
sftp_upload - First observed
sftp_write_file - First observed
ssh_connect - First observed
ssh_disconnect - First observed
ssh_exec - First observed
ssh_list_config_hosts - First observed
ssh_list_connections - First observed
ssh_ping - First observed
ssh_session_close - First observed
ssh_session_send - First observed
ssh_session_start
TDQS
Scored across 17 tools
Tools are largely distinct by resource and action, with clear SSH vs SFTP prefixes. Minor potential confusion exists between text-file operations (sftp_read_file/sftp_write_file) and file-transfer operations (sftp_upload/sftp_download), and between one-off execution (ssh_exec) and persistent sessions (ssh_session_start/send/close), but descriptions clarify boundaries well.
All tool names use consistent snake_case with clear ssh_ or sftp_ prefixes and predictable verb_noun or action forms. The pattern is highly regular across connection, execution, and file-transfer domains.
17 tools is slightly above the ideal 3-15 range but reasonable for a server covering SSH connection lifecycle, command execution, persistent sessions, and SFTP file operations. Each tool appears to serve a distinct purpose, though the surface could be tightened.
Core SSH and SFTP workflows are well covered: connection management, command execution, persistent PTY sessions, and file read/write/list/stat/mkdir/remove/upload/download. Minor gaps include sftp_rename and permission operations (chmod/chown), which agents can work around via ssh_exec.
Maintenance
Related MCP Connectors
Operate Linux, macOS and Windows from your LLM. Every action runs through an auditable allowlist.
- emisarOAuthdev.emisar
Let AI operate servers without SSH. Choose actions, approve risky changes, and audit every step.
Scoped, audited SSH exec, sessions, and SFTP on your saved servers without exposing credentials
Work on your own computers from Claude or ChatGPT: run commands, edit and search files.
Related MCP Servers
- AlicenseAqualityCmaintenanceEnables AI assistants to securely execute remote SSH commands, perform file transfers, and monitor system status through a standardized interface. It features robust security controls including command whitelisting, blacklisting, and credential isolation to prevent unauthorized operations.1021 npmMIT
- AlicenseNot gradedqualityCmaintenanceEnables AI assistants to securely execute commands, transfer files, and manage port forwarding on remote servers via SSH.133 npm37Apache 2.0
- AlicenseAqualityDmaintenanceEnables AI agents to execute SSH commands, read files, and list directories on remote hosts with a configurable command-safety policy.5MIT
- FlicenseAqualityCmaintenanceEnables LLMs to securely SSH into remote servers, execute commands, and manage files via SFTP including listing, reading, writing, deleting, and renaming files.11-