"MCP SSH Reloaded - SSH Server/Tool for Model Context Protocol" matching MCP tools:

• add_ssh_keyA

  BorealHostB

  Inject your SSH public key into a site's container for direct SSH access. The key is appended to /home/admin/.ssh/authorized_keys. Only available for VPS/dedicated plans. Requires: API key with write scope. Args: slug: Site identifier public_key: SSH public key string. Supported types: ssh-ed25519, ssh-rsa, ecdsa-sha2-nistp256/384/521 Returns: {"success": true, "message": "SSH key added", "ssh_command": "ssh admin@184.107.x.x"} Errors: VALIDATION_ERROR: Invalid or unsupported key format FORBIDDEN: Plan does not support SSH

  ConnectorNo auth

• read_fileA

  BorealHostB

  Read the contents of a file from a site's container. Max file size: 512KB. Binary files are rejected — use the site's file manager or SSH for binary files. Requires: API key with read scope. Args: slug: Site identifier path: Relative path to the file Returns: {"path": "wp-config.php", "content": "<?php ...", "size": 1234, "encoding": "utf-8"} Errors: NOT_FOUND: File doesn't exist VALIDATION_ERROR: File is binary or exceeds 512KB

  ConnectorNo auth

• search_events_toolA

  HoneyLabsA

  Individual honeypot events with every field, newest first, filtered by source, network, port, protocol or fingerprint. Use when the user wants to see the records themselves: "show me the events from this IP", "what hit port 443 yesterday", "every request carrying this JA4", "all RDP traffic regardless of port". Do not use it to judge one address (use ioc_lookup_tool), to rank or count (use top_attackers_tool or attack_timeline_tool), to search request text (use payload_search_tool), or for a CVE (use cve_lookup_tool). Filters, all optional and combined with AND: source_ip, country (ISO 3166 two-letter code), asn ('AS12345'), dest_port, protocol ('tls', or '' for raw TCP), app_protocol (detected layer-7 protocol such as 'ssh', 'rdp', 'mssql-tds', 'rtsp', 'smbv1', 'bittorrent' or 'mining', whatever the port), http_method, request_header (substring of the masked request headers), source_domain (reverse DNS substring), ja4 or ja3 (exact TLS client fingerprint), akin (exact HTTP request fingerprint such as b11cun030_00040014_54d07b6d), has_client_cert (true for clients that presented an mTLS certificate), ip_version (4 or 6). limit is 1 to 500, default 100. since and until are ISO-8601 UTC timestamps; the span between them may not exceed the query window of the caller's plan (https://honeylabs.net/pricing.json). Each record carries source_ip, country, asn, dest_port, user_agent, url_path, http_request_headers, tls_client_ja4, tls_client_ja3, tls_client_hello_hex (the raw ClientHello), ssh_client_hassh, tls_client_cert_subject and issuer, event_sequence, event_duration, byte counts, network_protocol, application_protocol and timestamp. TCP events from first-contact sensors only.

  ConnectorNo auth

• get_ssh_infoA

  BorealHostB

  Get SSH connection info for a VPS/dedicated site. Only available for VPS/dedicated plans (not shared hosting). Requires: API key with read scope. Args: slug: Site identifier Returns: {"host": "184.107.x.x", "port": 22, "username": "admin", "ssh_command": "ssh admin@184.107.x.x"} Errors: NOT_FOUND: Unknown slug FORBIDDEN: Plan does not support SSH (shared plans)

  ConnectorNo auth

• scalix_computer_set_ssh_keysA

  Scalix CloudA

  Replace the ssh keys authorised for root on a persistent Linux machine. This is how you revoke: send the list without the key you want gone, and on a running machine it stops working immediately. Sending an empty list removes every key. Not a patch — whatever you send becomes the whole list, so read the current keys from scalix_computer_list first if you mean to add one.

  Connector

  Destructive

  No auth

• run_instance_commandA

  Cycle MCPA

  Run a shell command inside a running container instance on Cycle, over the instance's SSH gateway, and return the shell output. Use this for one-time setup that must run inside a container — e.g. initializing a MongoDB replica set with 'mongosh --eval "rs.initiate({...})"'. The instance must be RUNNING (start the container first). If the container has multiple instances, pass 'instance' (id or hostname); otherwise the sole instance is used. Containers reach each other by hostname over the environment's private network, so commands can reference sibling containers (e.g. mongo-1:27017). This executes an arbitrary command inside your container — it is powerful and mutating. Always call with preview:true first: it echoes back the exact command and target without making any connection, so the user can confirm it is what they intend (nothing is validated — the command may still fail when run). Confirm with the user, then call again without preview. Never run a command without explicit confirmation. Short-lived SSH credentials are generated for the run and expired immediately after. The command runs in an interactive shell; make destructive commands idempotent where possible.

  Connector

  Destructive

  API key

• runA

  Comment.ioA

  Run one Comment.io command or restricted shell script in your workspace, exactly as an SSH exec: same commands, output and exit codes. Start with {"command":"help"}. The command runs on Comment.io, not on your machine; pass text for --stdin commands in stdin. Every call ends within 45 seconds: error: deadline (exit 3) means the outcome is unknown and writes may still land within seconds. After a deadline, a nonzero exit or a lost response, reread state rather than repeating a mutation.

  Connector

  Destructive

  OAuth

• harden_bastionA

  AnkraB

  Harden the sshd configuration of an Ankra-provisioned cluster's SSH bastion by applying a curated, lockout-safe action set as a revertable drop-in under /etc/ssh/sshd_config.d: disable_password_auth (also disables keyboard-interactive auth), disable_x11_forwarding, restrict_root_login (root becomes key-only), tighten_auth_limits (MaxAuthTries 3, LoginGraceTime 20, MaxStartups 10:30:200), or revert_hardening to remove the drop-in and restore the previous configuration. Omitting actions applies the full hardening set. It does NOT run arbitrary commands - only these curated actions, with every guardrail enforced server-side. The job validates the new configuration with sshd -t BEFORE activating it, rolls back automatically if validation fails, reloads (never restarts) sshd so existing sessions survive, and proves a fresh SSH connection still authenticates afterwards. The platform's own key-authenticated connection is the lockout backstop: disabling password auth cannot cut off platform access. It refuses to disable password authentication while the journal shows password logins in the last 7 days unless acknowledge_password_lockout is true - run diagnose_bastion first and confirm those consumers hold working keys. The result's report is authoritative: 'applied' true or false, 'refused' with 'refusal_reason' when a guardrail stopped it, 'validation'/'reload' when the new configuration was rejected or the reload failed, and 'fully_effective' plus 'shadowed_directives' when the drop-in is live but an earlier-matching sshd directive overrides part of it. Use this after diagnose_bastion reports password authentication enabled, sustained brute-force pressure, or MaxStartups throttling.

  Connector

  Destructive

  OAuth

• fastero_create_ssh_keyA

  FasteroA

  Get the SSH key for a new connection to a database behind an SSH bastion (jump host), before fastero_create_connection; a database Fastero reaches directly needs none. Fastero makes one Ed25519 key per connection and keeps its private half. Returns sshKeyId, the public key (sshPublicKey) and, when host and port are given, authorizedKeysLine: the line for the SSH user's ~/.ssh/authorized_keys on the bastion, which lets the key reach only that database through the bastion and nothing else. fastero_create_connection then takes the sshKeyId in creds. The same key comes back until a connection uses it or a week has passed. Owners, admins and editors of the organisation can get one.

  ConnectorAPI key

• interactive_credentials_toolA

  HoneyLabsA

  Plaintext logins captured by the interactive sensors (sensors that answer as a real service and hold the session): username, password, the service they were tried on, the outcome and the source address, newest first, plus the pairs tried most and a per-service breakdown. Use for "what passwords are attackers trying on SSH", "which credentials did this IP try", "what logins hit MySQL this week". For whether an address is hostile overall, use ioc_lookup_tool; for the rest of what it did in its sessions, use interactive_sessions_tool. service: a service name such as ssh-password, telnet-login, mysql-login, rdp-credssp or smb-ntlmssp, or empty for all. source: an address or CIDR, or empty for all. window: 24h, 7d (default) or 30d, capped at the plan's query window. limit: 1 to 200, default 50. These records feed no verdict, and ioc_lookup_tool does not include them.

  ConnectorNo auth

• attack_timeline_toolA

  HoneyLabsA

  Event counts over time, in hourly or daily buckets, optionally filtered by protocol, country or destination port. Use for "show the trend this week", "was there a spike on port 22", "how has SSH scanning changed over 30 days". Do not use it to find who caused a spike (follow up with top_attackers_tool on the same window and filter) or to see the events themselves (use search_events_tool). bucket: 'hour' or 'day' (default). filter_protocol: 'tls', or '' for raw TCP. filter_country: ISO two-letter code. filter_dest_port: a port number. since and until are ISO-8601 UTC within the plan's query window. Counts are raw totals from the first-contact sensors.

  ConnectorNo auth

• attach_compute_volumeA

  BorealHostB

  Restore a detached volume onto a fresh instance — optionally a new type. Pass a different instance_type to move the same machine to different hardware: this is the closest thing to changing instance type that the provider allows, since it has no resize API at all. The restore runs at first boot and the machine reboots into itself, so the instance answers SSH BEFORE it is ready. Poll get_compute_volume and give it a few minutes (measured: ~6 min for a 10 GB GPU machine end to end). The machine keeps its SSH host keys, so your client will not warn about a changed host identity. Requires: API key with write scope. Args: volume_id: A volume in state "detached" ssh_public_key: Required — installed via cloud-init at boot instance_type: Defaults to the type it last ran on root_disk_size: GB. May grow, never shrink below the volume's size. Returns: Volume dict with state "attached" and a new instance. Errors: CONFLICT: Volume is not detached, or has no snapshot yet

  ConnectorNo auth

• file_readA

  Local MCPB

  Reads a plain text file from the local filesystem by its absolute path — the primary, default tool for reading a local text file (use this unless the file is a PDF, Word, Excel, or PowerPoint document, which have their own readers). Reads anywhere on this Mac — home, external disks, cloud drives, /tmp — with one exception: credential and identity locations (keychains, ~/.ssh, ~/.aws, browser logins, another user's home, Time Machine backups) are never read. Supports .txt, .md, .csv, .json, .xml, .log, .yaml, .toml and common code file types; auto-detects UTF-8 with Latin-1/Windows-1252 fallback. For files in OneDrive use onedrive_read_file, in Google Drive gdrive_read_file; for PDFs pdf_read, Word word_read, Excel excel_read.

  ConnectorOAuth

• inspect_targetA

  opencode-workbenchA

  Probe one Linux machine — this host (`local`) or a remote host over SSH (`ssh`) — and report its OS, kernel, architecture, package manager, Node/npm, OpenCode, Docker, and per-tool detection flags, plus the names (never values) of credentials present. Read-only: it runs one shell probe as the target user (over SSH when `mode:ssh`), installs nothing, writes nothing, contacts no external service, and can take a few seconds per hop. Parameter semantics: `target.mode` selects local vs ssh (default `local`); `target.host` is required only for ssh; `target.user` defaults to the ssh config/current user; `target.cwd` sets the directory for relative checks; `target.port`/`identityFile` pass straight to ssh. Use it to see what a clone would touch, then plan_clone to turn that into an ordered plan and apply_clone to perform it.

  ConnectorNo auth

• connect_wordpressA

  XeoRankB

  Connect a WordPress site to XeoRank. Just pass the domain (https:// and www are stripped for you). Returns `onboard_url` — PRESENT THAT TO THE USER AS A CLICKABLE LINK and stop there. That one page walks them through installing the connector plugin, opens their wp-admin, and completes the connection automatically — there is NO Application Password to copy and NO follow-up tool call needed. Poll list_wordpress_sites (or verify_wordpress) to confirm it flipped to verified. Pass transport='ssh' only as a Hostinger fallback.

  ConnectorOAuth

• inspect_targetA

  opencode-workbenchA

  Probe one Linux machine — this host (`local`) or a remote host over SSH (`ssh`) — and report its OS, kernel, architecture, package manager, Node/npm, OpenCode, Docker, and per-tool detection flags, plus the names (never values) of credentials present. Read-only: it runs one shell probe as the target user (over SSH when `mode:ssh`), installs nothing, writes nothing, contacts no external service, and can take a few seconds per hop. Parameter semantics: `target.mode` selects local vs ssh (default `local`); `target.host` is required only for ssh; `target.user` defaults to the ssh config/current user; `target.cwd` sets the directory for relative checks; `target.port`/`identityFile` pass straight to ssh. Use it to see what a clone would touch, then plan_clone to turn that into an ordered plan and apply_clone to perform it.

  ConnectorNo auth

• propose_planA

  AskYourStackB

  When a job has several risky steps (deleting folders, dropping tables, changing SSH or closing access in the firewall, a reboot), list the exact calls you mean to make and ask for the user's approval once, instead of stopping at each one. steps: [{tool, args, why}] with tool one of run, start_job, write_file, db_query, magento, wp, rollback and args exactly as you will pass them later; why is one plain sentence for the user. The answer says which steps need approval and gives one link for the user. After they approve, make each call exactly as written (an approved step runs once, within 2 hours); steps that need no approval just run. Nothing in a plan runs by itself, and a changed step needs a new approval.

  ConnectorOAuth

• publish_private_vpsA

  mcpB

  Publish a user-requested HTTP application from either pilot, including the smaller pilot on its own, at a generated public HTTPS URL. First install and start the application, enable its production authentication and verify its local HTTP port. This publishes the app only; it does not assign a public VM IP or expose database/SSH ports. Responses consume the existing shared 5 GB outgoing account budget. No paid VM is created. Inspect get_private_vps_action until complete and give the returned URL to the user together with their separately obtained SSH command. If installation fails, preserve the VM and give SSH access; do not claim a working URL. Reuse request_key after a timeout. One fixed application port per pilot lifetime; deleting the pilot removes its route.

  ConnectorNo auth

• kenwea_notary_check_toolsA

  Kenwea NotaryA

  Score an MCP server's tool definitions for what they ask of the model, before you connect it. Input: tools, the tools array of a server's tools/list answer (each {name, description, inputSchema}); or server, the server's name as Smithery lists it (for example brave or owner/name), whose published definitions are read from Smithery. Behavior: runs nothing and calls no server. Fixed rules read each description and every parameter description against the tool's own input schema, because anything in the prose the schema does not need is where an injected instruction lives: tags that frame text as instructions (<IMPORTANT>, <instructions>), HTML comments and invisible characters (zero width, bidirectional controls, Unicode tags), asking the model to drop its instructions, to keep something from the user, or to put a file's contents into an argument, naming files where secrets live (~/.ssh, ~/.cursor/mcp.json, ~/.aws), asking for a credential the schema has no parameter for, steering the model off the web or other servers toward this one, and speaking to the model rather than describing the tool. No model reads the text, so the same definitions always get the same findings and anyone can redo them. Keyless, read-only. Returns: level (clean, review or suspicious), summary, findings (each with tool, rule, severity, where and an excerpt), rulesVersion and inputSha256, the SHA-256 of the definitions as read. A finding is a reason to read the definition, not a verdict on the server: on 500 Smithery servers (12,598 tools, rules 2026-10-31.1) 495 were clean, 3 review and 2 suspicious, and read by hand none hid an order or reached for data: the 3 steer the model off web search toward the server, the 2 were a vendor's response instructions and a false positive. Not for: what a server's code does when it runs (use kenwea_notary_check on its npm package).

  ConnectorNo auth

• read_contractA

  TeardropA

  Call any view/pure function on a smart contract and return the decoded result, using a supplied ABI fragment. Supports historical reads via block_identifier and caller_address context for msg.sender-dependent views. Read-only: state-changing functions are rejected. Use when: Use when a protocol question needs a contract read that no higher-level tool covers — e.g. a niche view function or a protocol outside the standard tool set. Prefer purpose-built tools (get_defi_positions, get_lending_rates) for supported protocols. Limitations: Requires a valid ABI fragment; payable/nonpayable functions are rejected. Ethereum mainnet and Base only, with bounded RPC timeout and retry. Alternatives: get_defi_positions, get_lending_rates, get_token_approvals

  ConnectorNo auth

• get_vm_console_accessA

  Cycle MCPA

  Mint serial-over-SSH credentials so the USER can open their own interactive console session on a virtual machine, and return the exact ssh command to run. Use this when a person wants to drive the console themselves — poke around, watch a boot, run an interactive installer or a TUI. To run a specific command and get its output back, use run_vm_command instead; do NOT take these credentials and try to drive an interactive shell yourself. What comes back: the ssh command, the connection address, the connection secret (used at ssh's own password prompt), and the token's expiry. The credentials reach the VM's serial console through the Cycle gateway — no VM networking required, so this works even with public networking disabled or the guest's network broken. Logging IN to the guest is separate: past ssh, the console lands at the guest's own login prompt. The response includes the generated root password when it is still retrievable (~10 minutes after creation); after that the user needs their own guest credentials or an attached SSH key. Relay the credentials to the user plainly so they can paste the command. They are short-lived and they grant root-capable console access — treat them as a secret, do not write them into files, commits, or issues. action:"revoke" expires ALL serial-over-SSH tokens for the VM, immediately disconnecting every active console session on it (including a session the user is in the middle of, and anyone else's). It is a mutation: confirm with the user before calling it.

  Connector

  Destructive

  API key