Skip to main content
Glama
bvisible

MCP SSH Manager

by bvisible

MCP SSH Manager - SSH Remote Server Management via Model Context Protocol ๐Ÿš€

A Model Context Protocol (MCP) server that enables Claude Code and OpenAI Codex to manage multiple SSH connections. Execute commands, transfer files, manage databases, create backups, monitor health, and automate DevOps tasks across your servers โ€” directly from your AI assistant.

npm version npm downloads Version Claude Code OpenAI Codex MCP OpenSSF Scorecard License

MCP Toplist


๐ŸŽ‰ What's New in v3.8.5

๐Ÿ”’ Security release โ€” three command-injection advisories fixed, one of which defeated readonly mode (Released: August 28, 2026)

Upgrade if you use ssh_backup_*, ssh_db_dump, ssh_service_status or ssh_tail โ€” and especially if you rely on the readonly / restricted security modes.

  • ๐Ÿ”ด RCE bypassing readonly / restricted (GHSA-m793-whw6-f537) โ€” ssh_service_status and ssh_tail are read-only, so they stay enabled on servers you locked down, and neither quoted its arguments nor consulted the policy layer. A service name like nginx; id > /tmp/pwned executed. This defeated the exact control those modes exist to provide.

  • ๐Ÿ”ด RCE through ssh_db_dump (GHSA-796j-h5q5-jx6p) โ€” the stat command run after the dump interpolated the output path raw. The v3.6.7 patch had stopped one line short.

  • ๐ŸŸ  RCE through every ssh_backup_* tool (GHSA-qwwm-vrm9-4mw8) โ€” backup-manager.js had zero shell escaping across its 9 builders, while database-manager.js had 95. The v3.6.7 fix was never extended to it.

The quoting helper now lives in one module (src/shell-quote.js) so "did this builder quote its inputs?" has a single answer, and a new test drives 340 builder ร— argument ร— payload combinations through a real shell to prove none of them execute.

Read full changelog โ†’


Related MCP server: MCP SSH Server

๐Ÿ” Giving an agent SSH access, safely

An MCP SSH server is the most dangerous tool you can hand an AI agent: a shell on machines that matter. This one is built so you decide how far the agent can go โ€” per server, not globally.

Mode

What the agent can do

unrestricted (default)

Everything. Same behaviour as any other SSH MCP server.

readonly

Mutating tools are refused outright โ€” no deploy, no upload, no sudo, no database import. Read commands still work.

restricted

Every command must match an allow pattern and no deny pattern. Anything else is refused before it reaches the host.

SSH_SERVER_PROD_MODE=readonly
SSH_SERVER_STAGING_MODE=restricted
SSH_SERVER_STAGING_ALLOW_PATTERNS=^systemctl (status|restart) myapp$;^tail -n \d+ /var/log/

Alongside that:

  • The sudo password never reaches the remote command line. It travels on the SSH channel's stdin, so it is not visible in ps, in /proc/<pid>/cmdline, or in an auditd trail โ€” unlike the echo "$pass" | sudo -S pattern common in this category (#34).

  • Every database argument is shell-quoted through one centralised helper, guarded by a 648-combination injection test.

  • Read-only SQL is enforced, not suggested: ssh_db_query refuses anything that is not a SELECT.

  • Vulnerabilities are published, not buried. See SECURITY.md for the reporting process and the advisories already fixed.

  • Reproducible installs: the lockfile is committed, CI installs with npm ci, and a test enforces that every dependency resolves to registry.npmjs.org with an integrity hash and no unreviewed install scripts.


Previous Releases

v3.8.4 - Secrets stop reaching the log, CodeQL on every commit (August 28, 2026)

  • ๐Ÿ”’ The logger no longer writes secrets in clear text โ€” it writes to ~/.ssh-manager.log and stderr (which your MCP host captures), so one call site handing it a server config would have persisted a production password. Redaction now happens inside the logger. Also: CodeQL on every push, every action pinned by SHA, and a broken example that never parsed. Full changelog โ†’

v3.8.2 / v3.8.3 - Sudo password leak fixed, MCP Registry, signed releases (August 28, 2026)

  • ๐Ÿ”’ The sudo password no longer reaches the remote command line (#34) โ€” it travelled through echo "<password>" | sudo -S, readable in ps and /proc/<pid>/cmdline by every account on the host. It now goes over the SSH channel's stdin. Also: listed in the official MCP Registry as io.github.bvisible/mcp-ssh-manager, releases published from CI with SLSA provenance and a CycloneDX SBOM, and the per-server security modes documented at last. Full changelog โ†’

v3.8.1 - Reproducible installs and blocking quality gates (August 28, 2026)

  • Committed lockfile (#60 โ€” contributed by @cudatuda) plus npm run test:lockfile guarding it against drift and tampering. CI installs with npm ci; ESLint and the JSDoc typecheck became blocking gates after being purely decorative. Full changelog โ†’

v3.8.0 - Groups in your config, ssh_sync on Windows, tunnel crash fix (August 14, 2026)

  • ๐Ÿ‘ฅ New optional group field per server (#56 โ€” contributed by @ice616, requested in #55) โ€” tag a server with group = "production" and it is in that group: ssh_execute_group resolves members straight from your .env/TOML, union'd with any .server-groups.json you already keep. Also: ssh_sync fixed from a Windows host (#59 โ€” contributed by @2836603852), a tunnel on a busy port no longer takes the whole MCP server down, the @modelcontextprotocol/sdk floor raised to ^1.30.0 over three advisories, and JSDoc type-checking added to CI. Full changelog โ†’

v3.7.0 - Per-server SSH agent forwarding (July 13, 2026)

  • ๐Ÿ”— New opt-in FORWARD_AGENT / forward_agent option (#53 โ€” requested by @raphaelbahat in #52) โ€” the equivalent of OpenSSH's ForwardAgent yes, per server: processes on the remote host authenticate to other SSH hosts with the keys in your local ssh-agent, without copying any private key. Requires a running agent and defaults to false. Full changelog โ†’

v3.6.7 - Security: command injection fix in the database helpers (July 11, 2026)

  • ๐Ÿ”’ Every ssh_db_* argument is now shell-quoted (#51 โ€” responsibly disclosed by Ugur Ozer, Aeon AI Risk Management (http://airiskmanagement.ca), see #48) โ€” caller-controlled values (ssh_db_list most notably, which stayed allowed in readonly/restricted modes) were interpolated into shell-evaluated strings, allowing arbitrary command execution on the SSH target. A centralized shellQuote() now wraps every value across all 15 builders, guarded by a 648-combination injection test. Full changelog โ†’

v3.6.6 - SUDO_PASSWORD / DEFAULT_DIR / ssh_sync key auth work again (July 11, 2026)

  • ๐Ÿ”‘ camelCase config field reads (#50 โ€” thanks @egoan82) โ€” since the v3.0.0 ConfigLoader refactor, ssh_execute_sudo ignored SUDO_PASSWORD, DEFAULT_DIR was ignored by ssh_execute/ssh_group_execute/ssh_list_servers, and ssh_sync never passed the configured SSH key to rsync. All aligned with the loader's camelCase fields, with a regression test locking the loader output shape. Full changelog โ†’

v3.6.5 - ssh_db_query shell-injection security fix + real row_count (June 30, 2026)

  • ๐Ÿ”’ Queries are delivered on stdin via a single-quoted heredoc (#44, #45 โ€” thanks @technophile77) โ€” the remote shell no longer parses backticks/$(โ€ฆ) inside queries (which corrupted backtick identifiers and let the "SELECT-only" tool run arbitrary shell commands), and row_count now reflects each engine's real output instead of counting wrapper lines. Full changelog โ†’

v3.6.4 - Internal cleanup + a dead-code quality gate (June 18, 2026)

  • ๐Ÿงน Dead-code removal (โˆ’343 lines), zero behavioral change โ€” removed 27 unused exports and 2 duplicate exports; the MCP server and CLI behave identically (command builders/parsers byte-identical, all 37 tools verified end-to-end). A calibrated knip.json plus a blocking knip CI step keep unused code from creeping back. Full changelog โ†’

v3.6.3 - ssh_sync reports the real transfer count (June 18, 2026)

  • ๐Ÿ“Š No more false "No files needed to be transferred" (#42 โ€” thanks @MakksSh) โ€” fixed rsync --stats parsing: --stats is always passed now, and rsync 2.x/3.x wording, openrsync's B suffix, and locale separators are all handled. Full changelog โ†’

v3.6.2 - Richer tool descriptions (June 9, 2026)

  • ๐Ÿ“ All 37 tool descriptions rewritten โ€” every MCP tool now documents its real behavior (side effects, destructive vs read-only nature, idempotency, sudo/auth requirements, security-mode gating, parameter semantics) instead of a 4-to-10-word summary. Agents now know the consequences before invoking a tool; no behavioral change โ€” only description strings changed. Full changelog โ†’

v3.6.1 - Teardown hygiene follow-up (June 9, 2026)

  • ๐Ÿ”Œ Module-level timers no longer pin the event loop (follow-up to #41) โ€” tunnel-manager.js and session-manager.js registered module-level setIntervals that were never unref()'d, so importing either module kept Node's event loop alive. Both are now unref()'d. Full changelog โ†’

v3.6.0 - Live config hot reload + stdio lifecycle fix (June 9, 2026)

  • โ™ป๏ธ Configuration hot reload (#40 โ€” thanks @EnjoySR) โ€” add or edit a server in your .env/TOML and the running MCP server picks it up on the next call, no restart. A ServerConfigManager reloads lazily on file-signature change (path + mtime + size); a failed reload keeps the last known-good config; real process.env vars keep top priority. No watcher, no polling.

  • ๐Ÿ”Œ No more orphaned stdio processes (#41 โ€” thanks @LegendaryGatz) โ€” a stdio MCP server is torn down by stdin EOF / SIGTERM, not SIGINT; with only a SIGINT handler every session leaked a ~83 MB node process. Shutdown is now idempotent across SIGINT/SIGTERM/SIGHUP/stdin-close, timers are unref()'d, and the process exits ~10 ms after teardown instead of never. Full changelog โ†’

v3.5.1 - Robust SSH ping health-check on Windows/OpenSSH (May 26, 2026)

  • ๐ŸชŸ Healthy Windows sessions no longer reported as Dead (#39 โ€” thanks @username77) โ€” the liveness probe ran echo "ping" and cmd.exe echoed the quotes literally, failing a strict === 'ping' check and needlessly rebuilding live connections. Now uses echo ping parsed by a null-safe isPingAlive(stdout) helper (CRLF/quote/case-normalized), covered by tests/test-ssh-ping.js. Full changelog โ†’

v3.5.0 - Per-server security modes โ€” readonly / restricted + audit log (May 18, 2026)

A second authorization layer that filters tool invocations inside the MCP server, complementing the existing client-side autoApprove. Useful when sharing the MCP with a third-party agent, a CI bot, or any client where ssh_execute shouldn't be unconditionally trusted.

  • ๐Ÿ”’ Three modes, opt-in per server (no MODE field = identical to v3.4.x):

    • unrestricted (default) โ€” strict no-op. evaluatePolicy() early-returns on the first line, zero overhead.

    • readonly โ€” blocks mutating tools (ssh_upload, ssh_deploy, ssh_sync, ssh_execute_sudo, ssh_backup_*, ssh_db_import/dump, plus action-gated ssh_key_manage accept|remove, ssh_alert_setup set, ssh_process_manager kill) AND applies a built-in denylist on ssh_execute (rm, mv, dd, mkfs, chmod, chown, sudo, systemctl restart/stop, docker rm/stop, pipe-to-sh, redirect outside /tmp, curl|sh, etc.).

    • restricted โ€” every command must match at least one ALLOW_PATTERNS regex AND no DENY_PATTERNS regex. DENY wins. With no ALLOW_PATTERNS everything is refused (fail-closed).

  • ๐Ÿ“ Audit log โ€” opt-in JSONL per server (SSH_SERVER_<N>_AUDIT_LOG=/path/to/audit.jsonl). Records ts, server, tool, args, allowed, reason on denial, exitCode/success on execution. Sensitive arg fields (password, passphrase, sudoPassword, token, secret, apikey) are replaced with ***.

  • ๐Ÿช„ Command aliases expanded BEFORE policy evaluation โ€” a DENY pattern can't be bypassed via an alias.

  • โ™ป๏ธ Backward-compatible by design โ€” a v3.4.x .env or TOML loads identically. No MODE field โ†’ zero behavior change. The interactive wizard (ssh-manager server add) defaults all three new prompts to skip. All 13 pre-existing tests pass unmodified. New tests/test-policy.js adds 26 tests covering modes, DENY > ALLOW precedence, invalid-regex handling, redaction, and the backward-compat fast path. Full reference โ†’

v3.4.1 - Modern OpenSSH 9.x compatibility (May 16, 2026)

  • ๐Ÿ” Expanded SSH algorithm list โ€” handshake against OpenSSH 9.x out of the box (#32)

    • KEX: curve25519-sha256 (+@libssh.org), diffie-hellman-group15-sha512, diffie-hellman-group16-sha512

    • Server host key: rsa-sha2-512, rsa-sha2-256 (RFC 8332)

    • Cipher: aes128-gcm@openssh.com, aes256-gcm@openssh.com

    • HMAC: hmac-sha2-256-etm@openssh.com, hmac-sha2-512-etm@openssh.com, hmac-sha1-etm@openssh.com

    • Backward-compatible โ€” legacy algorithms preserved at lower preference, older servers (CentOS 7, Debian 10) keep working. Thanks @YoungHong1992.

v3.4.0 - Windows OpenSSH support + shell-agnostic session sync (May 7, 2026)

  • ๐ŸชŸ Windows OpenSSH encoding & syntax fixes โ€” UTF-16LE base64 PowerShell payloads (Ansible-style) + Set-Location replacing cd && (#31, thanks @WenKingSu)

  • ๐ŸŽฏ Marker-based SSH session sync โ€” UUID v4 protocol boundaries with ECHO: 0 PTY, real $? exit codes, no more "Timeout waiting for shell prompt" on custom/slow/AIX shells (#30, thanks @MakksSh)

v3.3.0 - ProxyCommand & Critical Fixes (May 2, 2026)

  • ๐Ÿ”Œ ProxyCommand support for SOCKS5 / custom proxy commands (#24)

  • โฑ๏ธ ssh_execute timeout silently capped at 30 s โ€” fixed (#28, #29)

  • ๐ŸชŸ Windows global install /bin/bash shim error โ€” fixed (#22, #23)

  • ๐Ÿ”ง server add blocked by missing rsync โ€” rsync now optional (#26)

  • ๐Ÿ”ก Hyphenated server names silently dropped โ€” validation hardened (#25, #27)

v3.2.2 - Global Install Fix & CLI Binary (April 7, 2026)

  • ๐Ÿ”ง Global install fixed: .env path resolution now uses a fallback chain instead of hardcoded __dirname โ€” works correctly with npm install -g (#16, #19)

    • Fallback chain: ~/.ssh-manager/.env โ†’ cwd/.env โ†’ ~/.env โ†’ project .env

    • Auto-creates ~/.ssh-manager/.env on first ssh-manager server add

  • ๐Ÿ“ฆ ssh-manager CLI registered as binary: npm install -g now creates both mcp-ssh-manager and ssh-manager commands (#18)

  • โšก Race condition fix: Server config is now fully loaded before the MCP server accepts requests

v3.2.0 - ProxyJump / Bastion Host Support (March 18, 2026)

  • ๐Ÿ”€ ProxyJump support: Connect to servers behind bastion/jump hosts with a simple PROXYJUMP config field (#15)

    • Chain multiple jumps (A โ†’ B โ†’ C) via recursive connections

    • Circular dependency detection prevents infinite loops

    • All tools work transparently through jump hosts

  • ๐Ÿ“ฆ npx support fixed: npx mcp-ssh-manager now works correctly (#14)

v3.1.5 - SSH Agent & Passphrase Support (March 5, 2026)

  • ๐Ÿ”‘ SSH Agent support: Automatically uses ssh-agent when SSH_AUTH_SOCK is available โ€” passphrase-protected keys work transparently

  • ๐Ÿ” Passphrase configuration: New passphrase field for both .env and TOML formats

Thanks to @snjax for the original contribution (#12).

v3.1.4 - Windows SSH Host Support (February 22, 2026)

  • ๐ŸชŸ Windows SSH host fix: Commands no longer fail on Windows hosts running OpenSSH (#10)

  • New per-server platform config field (SSH_SERVER_FOO_PLATFORM=windows or platform = "windows" in TOML)

  • When platform=windows, the Linux timeout/sh -c command wrapper is skipped and the SSH library's native timeout is used instead

  • All tools (ssh_execute, ssh_tail, ssh_monitor, ssh_deploy, ssh_execute_sudo, ssh_group_execute) are platform-aware

v3.1.2 - Windows Compatibility Fix (February 9, 2026)

  • ๐ŸชŸ Windows support: Fixed crash on Windows where process.env.HOME is undefined (#8)

  • Now uses os.homedir() for cross-platform compatibility (Linux, macOS, Windows)

v3.1.0 - Tool Activation System (November 15, 2025)

๐ŸŽฏ Context Usage Optimization

  • 92% context reduction: Enable only the tools you need (minimal mode: 5 tools vs all 37)

  • Tool management CLI: ssh-manager tools list/configure/enable/disable

  • 6 tool groups: Core, Sessions, Monitoring, Backup, Database, Advanced

  • Auto-approval export: Generate Claude Code auto-approval configs

v3.0.0 - Enterprise DevOps Platform (October 1, 2025)

This release adds 12 new MCP tools transforming SSH Manager into a comprehensive DevOps automation platform:

๐Ÿ’พ Backup & Restore System (4 tools)

  • Automated backups for MySQL, PostgreSQL, MongoDB, and file systems

  • Smart scheduling with cron integration and retention policies

  • One-click restore with cross-database support

  • Metadata tracking for audit and compliance

๐Ÿฅ Health & Monitoring (4 tools)

  • Real-time health checks with CPU, RAM, Disk, and Network metrics

  • Service monitoring for nginx, mysql, docker, and custom services

  • Process management with CPU/RAM sorting and kill capabilities

  • Alert thresholds with configurable notifications

๐Ÿ—„๏ธ Database Management (4 tools)

  • Safe database dumps with compression and selective exports

  • Database imports with automatic decompression

  • Schema exploration listing databases, tables, and collections

  • Secure queries with SQL injection prevention (SELECT-only)

๐Ÿ“Š Total: 37 MCP Tools | ๐Ÿ”ง ~4,100 Lines of Code Added | โœ… Production Ready

Read Full Changelog โ†’


๐Ÿ“‘ Table of Contents


๐ŸŒŸ Features

Core Features

  • ๐Ÿ”— Multiple SSH Connections - Manage unlimited SSH servers from a single interface

  • ๐Ÿ” Secure Authentication - Support for password, SSH key, and ssh-agent authentication (including passphrase-protected keys)

  • ๐Ÿ”€ ProxyJump / Bastion Host - Connect to servers behind jump hosts with chained multi-hop support

  • ๐Ÿ”Œ ProxyCommand / Custom Proxy - Connect through SOCKS5 proxies or custom proxy commands (ncat, ssh -W, etc.)

  • ๐Ÿ“ File Operations - Upload and download files between local and remote systems

  • โšก Command Execution - Run commands on remote servers with working directory support

  • ๐Ÿ“‚ Default Directories - Set default working directories per server for convenience

  • ๐ŸŽฏ Easy Configuration - Simple .env file setup with guided configuration tool

Enterprise DevOps Features (v3.0) ๐ŸŽ‰

  • ๐Ÿ’พ Backup & Restore - Automated backups for MySQL, PostgreSQL, MongoDB, and files

  • ๐Ÿฅ Health Monitoring - Real-time server health checks (CPU, RAM, Disk, Services)

  • ๐Ÿ—„๏ธ Database Management - Safe database operations with SQL injection prevention

  • ๐Ÿ“Š Process Management - Monitor and control server processes

  • โš ๏ธ Smart Alerts - Configurable health thresholds and notifications

v2.0 Features

  • ๐Ÿš€ Bash CLI - Lightning-fast pure Bash CLI for server management

  • ๐Ÿ“Š Advanced Logging - Comprehensive logging system with levels and history

  • ๐Ÿ”„ Rsync Integration - Bidirectional file sync with rsync support

  • ๐Ÿ’ป Persistent Sessions - Maintain shell context across multiple commands

  • ๐Ÿ‘ฅ Server Groups - Execute commands on multiple servers simultaneously

  • ๐Ÿ”ง SSH Tunnels - Local/remote port forwarding and SOCKS proxy support

  • ๐Ÿ“ˆ System Monitoring - Real-time monitoring of CPU, memory, disk, and network

  • ๐Ÿท๏ธ Server Aliases - Use short aliases instead of full server names

  • ๐Ÿš€ Smart Deployment - Automated file deployment with permission handling

  • ๐Ÿ”‘ Sudo Support - Execute commands with sudo privileges securely

  • ๐Ÿ“ OpenAI Codex Support - Compatible with OpenAI Codex via TOML configuration


โš™๏ธ Tool Management & Context Optimization

NEW in v3.1: Reduce Claude Code context usage by 92% with tool activation management!

MCP SSH Manager includes 37 tools organized into 6 groups. By default, all tools are enabled, but you can optimize for your specific workflow:

Quick Setup

# Interactive configuration wizard
ssh-manager tools configure

# View current configuration
ssh-manager tools list

# Enable/disable specific groups
ssh-manager tools enable monitoring
ssh-manager tools disable backup

Configuration Modes

Mode

Tools

Context Usage

Best For

All (default)

37 tools

~43.5k tokens

Full feature set, most users

Minimal

5 tools

~3.5k tokens

Basic SSH operations only

Custom

5-37 tools

Varies

Tailored to your workflow

Tool Groups

  • Core (5 tools) - Always enabled: list, execute, upload, download, sync

  • Sessions (4 tools) - Persistent SSH sessions

  • Monitoring (6 tools) - Health checks, service status, process management

  • Backup (4 tools) - Database and file backups

  • Database (4 tools) - MySQL, PostgreSQL, MongoDB operations

  • Advanced (14 tools) - Deployment, sudo, tunnels, groups, aliases, etc.

Benefits

  • 92% context reduction in minimal mode (~40k tokens saved)

  • Fewer approval prompts in Claude Code

  • Faster loading and cleaner interface

  • Auto-approval configuration export for Claude Code

๐Ÿ“– Complete Tool Management Guide โ†’


๐Ÿ“‹ Prerequisites

  • Node.js (v18 or higher)

  • npm (comes with Node.js)

  • Platforms: Linux, macOS, Windows

  • For Claude Code: Claude Code CLI installed

  • For OpenAI Codex: Codex CLI configured

  • Bash 4.0+ (for CLI management tools)

  • rsync (for file synchronization)

  • sshpass (optional, for rsync with password authentication)

    • macOS: brew install hudochenkov/sshpass/sshpass

    • Linux: apt-get install sshpass

๐Ÿš€ Quick Start - Claude Code

1. Install MCP SSH Manager

Option A: Install from npm (recommended)

# Install globally from npm
npm install -g mcp-ssh-manager

# Or install locally
npx mcp-ssh-manager

Option B: Install from source

# Clone and install
git clone https://github.com/bvisible/mcp-ssh-manager.git
cd mcp-ssh-manager
npm install

# Install the Bash CLI
cd cli && ./install.sh

# Configure your first server
ssh-manager server add

2. Install to Claude Code

# For personal use (current user only)
claude mcp add ssh-manager node /path/to/mcp-ssh-manager/src/index.js

# For team sharing (creates .mcp.json in project)
claude mcp add ssh-manager --scope project node /path/to/mcp-ssh-manager/src/index.js

# For all your projects
claude mcp add ssh-manager --scope user node /path/to/mcp-ssh-manager/src/index.js

To avoid being prompted for approval on every SSH command, add auto-approve configuration:

Edit ~/.config/claude-code/claude_code_config.json:

{
  "mcpServers": {
    "ssh-manager": {
      "command": "node",
      "args": ["/path/to/mcp-ssh-manager/src/index.js"],
      "autoApprove": [
        "mcp__ssh-manager__ssh_execute",
        "mcp__ssh-manager__ssh_list_servers",
        "mcp__ssh-manager__ssh_upload",
        "mcp__ssh-manager__ssh_download",
        "mcp__ssh-manager__ssh_sync",
        "mcp__ssh-manager__ssh_alias"
      ]
    }
  }
}

Important: Restart Claude Code after making this change.

For full auto-approval of all SSH tools, see the complete list in examples/claude-code-config.example.json.

3.5. Security Modes (Optional, v3.5.0+)

autoApprove is all-or-nothing per tool: once ssh_execute is approved, anything goes. If you want a second layer that filters what the MCP server actually accepts to run โ€” useful when sharing the MCP with a third-party agent, a CI bot, or a client's server โ€” declare a per-server security mode.

# In your .env โ€” three optional fields. Omit them all to keep v3.4.x behavior exactly.
SSH_SERVER_CLIENT_PROD_HOST=client-prod.example.com
SSH_SERVER_CLIENT_PROD_USER=consultant
SSH_SERVER_CLIENT_PROD_KEYPATH=~/.ssh/consultant_ed25519

SSH_SERVER_CLIENT_PROD_MODE=readonly                          # unrestricted | readonly | restricted
SSH_SERVER_CLIENT_PROD_AUDIT_LOG=~/.ssh-manager/audit.jsonl   # opt-in JSONL audit trail
# For mode=restricted, provide an allowlist of regex (DENY wins over ALLOW):
# SSH_SERVER_CI_ALLOW_PATTERNS="^docker (ps|logs);^kubectl get "
  • unrestricted (default, no field needed) โ€” identical to pre-v3.5.0 behavior. Zero overhead.

  • readonly โ€” blocks ssh_upload, ssh_deploy, ssh_sync, ssh_execute_sudo, backup/db write tools, and built-in destructive commands (rm, mv, sudo, systemctl restart, redirects outside /tmp, curl | sh, โ€ฆ).

  • restricted โ€” every ssh_execute command must match at least one ALLOW_PATTERNS regex AND no DENY_PATTERNS regex.

Existing configs are unaffected โ€” no field is mandatory, no behavior changes unless you opt in. See docs/SECURITY_MODES.md for the full reference, recipes, and limitations.

4. Start Using!

In Claude Code, you can now:

"List all my SSH servers"
"Execute 'ls -la' on production server"  # Uses default directory if set
"Run 'docker ps' on staging"
"Upload config.json to production:/etc/app/config.json"
"Download logs from staging:/var/log/app.log"

With Default Directories: If you set /var/www/html as default for production, these commands are equivalent:

  • "Run 'ls' on production" โ†’ executes in /var/www/html

  • "Run 'ls' on production in /tmp" โ†’ executes in /tmp (overrides default)


๐Ÿš€ Quick Start - OpenAI Codex

1. Install MCP SSH Manager

Same installation as Claude Code (see above), then configure for Codex:

# Set up Codex integration
ssh-manager codex setup

# Migrate existing servers to TOML format (if you have .env servers)
ssh-manager codex migrate

# Test the integration
ssh-manager codex test

2. Manual Configuration (Optional)

If you prefer manual setup, add to ~/.codex/config.toml:

[mcp_servers.ssh-manager]
command = "node"
args = ["/absolute/path/to/mcp-ssh-manager/src/index.js"]
env = { SSH_CONFIG_PATH = "/Users/you/.codex/ssh-config.toml" }
startup_timeout_ms = 20000

3. Configure Servers in TOML Format

Create or edit ~/.codex/ssh-config.toml:

[ssh_servers.production]
host = "prod.example.com"
user = "admin"
password = "secure_password"  # or use key_path
key_path = "~/.ssh/id_rsa"   # for SSH key auth (recommended)
passphrase = "key_passphrase" # optional, for passphrase-protected keys
port = 22
default_dir = "/var/www"
group = "production"          # optional, free-form label for grouping/import-export
description = "Production server"

[ssh_servers.staging]
host = "staging.example.com"
user = "deploy"
key_path = "~/.ssh/staging_key"
port = 2222
default_dir = "/home/deploy/app"

[ssh_servers.winhost]
host = "192.168.1.90"
user = "svc-ssh"
key_path = "~/.ssh/winhost_key"
port = 2222
platform = "windows"
description = "Windows host via OpenSSH"

[ssh_servers.bastion]
host = "bastion.example.com"
user = "jumpuser"
key_path = "~/.ssh/bastion_key"

[ssh_servers.internal]
host = "10.0.0.5"
user = "admin"
key_path = "~/.ssh/internal_key"
proxy_jump = "bastion"
description = "Private server behind bastion"

๐Ÿ’ก See examples/codex-ssh-config.example.toml for more complete examples!

4. Start Using in Codex!

In OpenAI Codex, you can now:

"List my SSH servers"
"Execute 'docker ps' on production"
"Upload file.txt to staging:/tmp/"
"Monitor CPU usage on all servers"
"Download production:/var/log/app.log to ./logs/"

Converting Between Formats

Switch easily between Claude Code (.env) and Codex (TOML):

# Convert .env to TOML (for Codex)
ssh-manager codex convert to-toml

# Convert TOML back to .env (for Claude Code)
ssh-manager codex convert to-env

Both formats can coexist! The system supports both simultaneously.


๐Ÿ› ๏ธ Available MCP Tools

Core Tools

ssh_list_servers

Lists all configured SSH servers with their details.

ssh_execute

Execute commands on remote servers.

  • Parameters: server (name), command, cwd (optional working directory)

  • Note: If no cwd is provided, uses the server's default directory if configured

ssh_upload

Upload files to remote servers.

  • Parameters: server, local_path, remote_path

ssh_download

Download files from remote servers.

  • Parameters: server, remote_path, local_path

Backup & Restore Tools (v2.1+) ๐Ÿ”„

ssh_backup_create

Create backup of database or files on remote server.

  • Types: MySQL, PostgreSQL, MongoDB, Files

  • Parameters: server, type, name, database, paths, retention

  • Automatic compression and metadata tracking

  • See Backup Guide for detailed usage

ssh_backup_list

List all available backups on remote server.

  • Parameters: server, type (optional filter)

  • Returns backup details with size, date, and retention info

ssh_backup_restore

Restore from a previous backup.

  • Parameters: server, backupId, database, targetPath

  • Supports cross-database restoration

ssh_backup_schedule

Schedule automatic backups using cron.

  • Parameters: server, schedule (cron format), type, name

  • Automatic cleanup based on retention policy

Health & Monitoring Tools (v2.2+) ๐Ÿฅ

ssh_health_check

Perform comprehensive health check on remote server.

  • Checks: CPU, Memory, Disk, Network, Uptime, Load average

  • Returns overall health status (healthy/warning/critical)

  • Optional detailed mode for extended metrics

ssh_service_status

Check status of services (nginx, mysql, docker, etc.).

  • Parameters: server, services (array)

  • Returns running/stopped status for each service

  • Works with both systemd and sysv init systems

ssh_process_manager

List, monitor, or kill processes on remote server.

  • Actions: list (top processes), kill (terminate), info (details)

  • Sort by CPU or memory usage

  • Filter processes by name

ssh_alert_setup

Configure health monitoring alerts and thresholds.

  • Actions: set (configure), get (view), check (test thresholds)

  • Configurable CPU, memory, and disk thresholds

  • Automatic alert triggering when thresholds exceeded

Database Management Tools (v2.3+) ๐Ÿ—„๏ธ

ssh_db_dump

Create database dump/backup on remote server.

  • Supports: MySQL, PostgreSQL, MongoDB

  • Parameters: server, type, database, outputFile, dbUser, dbPassword, dbHost, dbPort

  • Optional: compress (gzip), tables (specific tables only)

  • Returns dump size and location

ssh_db_import

Import SQL dump or restore database on remote server.

  • Supports: MySQL, PostgreSQL, MongoDB

  • Parameters: server, type, database, inputFile, dbUser, dbPassword, dbHost, dbPort

  • Handles compressed (.gz) files automatically

  • Optional: drop (drop database before restore for MongoDB)

ssh_db_list

List databases or tables on remote server.

  • Parameters: server, type, database (optional), dbUser, dbPassword, dbHost, dbPort

  • Without database: lists all databases (filters system DBs)

  • With database: lists all tables/collections

  • Returns structured list with count

ssh_db_query

Execute read-only SQL queries on remote database.

  • Parameters: server, type, database, query, dbUser, dbPassword, dbHost, dbPort

  • Security: Only SELECT queries allowed for safety

  • MongoDB: Use collection parameter for find queries

  • Returns query results with row count

Deployment Tools (v1.2+)

ssh_deploy ๐Ÿš€

Deploy files with automatic permission and backup handling.

  • Parameters: server, files (array), options (owner, permissions, backup, restart)

  • Automatically handles permission issues and creates backups

ssh_execute_sudo ๐Ÿ”

Execute commands with sudo privileges.

  • Parameters: server, command, password (optional), cwd (optional)

  • Securely handles sudo password without exposing in logs

Server Management

ssh_alias ๐Ÿท๏ธ

Manage server aliases for easier access.

  • Parameters: action (add/remove/list), alias, server

  • Example: Create alias "prod" for "production" server

ssh_command_alias ๐Ÿ“

Manage command aliases for frequently used commands.

  • Parameters: action (add/remove/list/suggest), alias, command

  • Aliases loaded from active profile

  • Example: Custom aliases for your project

ssh_hooks ๐ŸŽฃ

Manage automation hooks for SSH operations.

  • Parameters: action (list/enable/disable/status), hook

  • Hooks loaded from active profile

  • Example: Project-specific validation and automation

ssh_profile ๐Ÿ“š

Manage configuration profiles for different project types.

  • Parameters: action (list/switch/current), profile

  • Available profiles: default, frappe, docker, nodejs

  • Example: Switch between different project configurations

๐Ÿ”ง Configuration

Profiles

SSH Manager uses profiles to configure aliases and hooks for different project types:

  1. Set active profile:

    • Environment variable: export SSH_MANAGER_PROFILE=frappe

    • Configuration file: Create .ssh-manager-profile with profile name

    • Default: Uses default profile if not specified

  2. Available profiles:

    • default - Basic SSH operations

    • frappe - Frappe/ERPNext specific

    • docker - Docker container management

    • nodejs - Node.js applications

    • Create custom profiles in profiles/ directory

Environment Variables

Servers are configured in the .env file with this pattern:

# Server configuration pattern
SSH_SERVER_[NAME]_HOST=hostname_or_ip
SSH_SERVER_[NAME]_USER=username
SSH_SERVER_[NAME]_PASSWORD=password  # For password auth
SSH_SERVER_[NAME]_KEYPATH=~/.ssh/key  # For SSH key auth
SSH_SERVER_[NAME]_PASSPHRASE=key_passphrase  # Optional, for passphrase-protected keys
SSH_SERVER_[NAME]_PORT=22  # Optional, defaults to 22
SSH_SERVER_[NAME]_DEFAULT_DIR=/path/to/dir  # Optional, default working directory
SSH_SERVER_[NAME]_DESCRIPTION=Description  # Optional
SSH_SERVER_[NAME]_GROUP=production  # Optional, free-form label for grouping/import-export
SSH_SERVER_[NAME]_PLATFORM=windows  # Optional: "linux" (default) or "windows"
SSH_SERVER_[NAME]_PROXYJUMP=bastion  # Optional: name of another server to use as jump host
SSH_SERVER_[NAME]_PROXYCOMMAND=command  # Optional: custom proxy command (ncat, ssh -W, etc.)
SSH_SERVER_[NAME]_FORWARD_AGENT=true  # Optional: forward local ssh-agent to remote (needs SSH_AUTH_SOCK; security risk โ€” see SSH Agent section)

# Example: Linux server
SSH_SERVER_PRODUCTION_HOST=prod.example.com
SSH_SERVER_PRODUCTION_USER=admin
SSH_SERVER_PRODUCTION_PASSWORD=secure_password
SSH_SERVER_PRODUCTION_PORT=22
SSH_SERVER_PRODUCTION_DEFAULT_DIR=/var/www/html
SSH_SERVER_PRODUCTION_DESCRIPTION=Production Server
SSH_SERVER_PRODUCTION_SUDO_PASSWORD=secure_sudo_pass  # Optional, for automated deployments

# Example: Windows server (OpenSSH for Windows)
SSH_SERVER_WINHOST_HOST=192.168.1.90
SSH_SERVER_WINHOST_USER=svc-ssh
SSH_SERVER_WINHOST_KEYPATH=~/.ssh/winhost_key
SSH_SERVER_WINHOST_PORT=2222
SSH_SERVER_WINHOST_PLATFORM=windows
SSH_SERVER_WINHOST_DESCRIPTION=Windows host via OpenSSH

# Example: Server behind a bastion/jump host
SSH_SERVER_BASTION_HOST=bastion.example.com
SSH_SERVER_BASTION_USER=jumpuser
SSH_SERVER_BASTION_KEYPATH=~/.ssh/bastion_key

SSH_SERVER_INTERNAL_HOST=10.0.0.5
SSH_SERVER_INTERNAL_USER=admin
SSH_SERVER_INTERNAL_KEYPATH=~/.ssh/internal_key
SSH_SERVER_INTERNAL_PROXYJUMP=bastion
SSH_SERVER_INTERNAL_DESCRIPTION=Private server behind bastion

Server Management Tool

The Python management tool (tools/server_manager.py) provides:

  1. List servers - View all configured servers

  2. Add server - Interactive server configuration

  3. Test connection - Verify server connectivity

  4. Remove server - Delete server configuration

  5. Update Claude Code - Configure MCP in Claude Code

  6. Install dependencies - Setup required packages

๐Ÿ“ Project Structure

mcp-ssh-manager/
โ”œโ”€โ”€ src/
โ”‚   โ”œโ”€โ”€ index.js              # Main MCP server (37 tools)
โ”‚   โ”œโ”€โ”€ ssh-manager.js        # SSH connection handling
โ”‚   โ”œโ”€โ”€ config-loader.js      # .env & TOML config loading
โ”‚   โ”œโ”€โ”€ session-manager.js    # Persistent SSH sessions
โ”‚   โ”œโ”€โ”€ backup-manager.js     # Backup & restore
โ”‚   โ”œโ”€โ”€ health-monitor.js     # Health checks & alerts
โ”‚   โ”œโ”€โ”€ database-manager.js   # Database operations
โ”‚   โ”œโ”€โ”€ tunnel-manager.js     # SSH tunnel management
โ”‚   โ”œโ”€โ”€ server-groups.js      # Group operations
โ”‚   โ””โ”€โ”€ ...
โ”œโ”€โ”€ cli/
โ”‚   โ”œโ”€โ”€ ssh-manager           # Bash CLI entrypoint
โ”‚   โ”œโ”€โ”€ commands/              # CLI command modules
โ”‚   โ””โ”€โ”€ lib/                   # CLI libraries
โ”œโ”€โ”€ profiles/                  # Configuration profiles (frappe, docker, nodejs...)
โ”œโ”€โ”€ examples/                  # Example configs
โ”œโ”€โ”€ docs/                      # Documentation
โ””โ”€โ”€ package.json

๐Ÿงช Testing

Test Server Connection

python tools/test-connection.py production

Verify MCP Installation

claude mcp list

Check Server Status in Claude Code

/mcp

๐Ÿ”’ Security Best Practices

  1. Never commit .env files - Always use .env.example as template

  2. Use SSH keys when possible - More secure than passwords

  3. Limit server access - Use minimal required permissions

  4. Rotate credentials - Update passwords and keys regularly

๐Ÿ”‘ Passphrase-Protected SSH Keys

MCP SSH Manager supports passphrase-protected SSH keys in two ways:

Option 1: SSH Agent (recommended)

If your SSH key is loaded into ssh-agent, MCP SSH Manager will use it automatically โ€” no configuration changes needed:

# Add your key to the agent (enter passphrase once)
ssh-add ~/.ssh/your_key

# Verify the key is loaded
ssh-add -l

The server detects the SSH_AUTH_SOCK environment variable and connects to the running agent. This is the same mechanism that regular ssh uses for GUI passphrase prompts.

Option 2: Passphrase in configuration

You can store the passphrase directly in the server config:

.env format:

SSH_SERVER_MYSERVER_KEYPATH=~/.ssh/id_rsa
SSH_SERVER_MYSERVER_PASSPHRASE="your_passphrase"

TOML format:

[ssh_servers.myserver]
key_path = "~/.ssh/id_rsa"
passphrase = "your_passphrase"

Note: SSH Agent is preferred over storing passphrases in config files for better security.

๐Ÿ”— SSH Agent Forwarding

Enable per-server agent forwarding (the equivalent of OpenSSH's ForwardAgent yes) so processes on the remote host can authenticate to other SSH hosts using the keys in your local ssh-agent โ€” e.g. git clone over SSH on a remote server using your local GitHub key, without copying any private key to the server.

It is opt-in per server and defaults to false. It requires a running local agent (SSH_AUTH_SOCK present); when the agent is unavailable the flag is simply ignored.

.env format:

SSH_SERVER_MYSERVER_FORWARD_AGENT=true

TOML format:

[ssh_servers.myserver]
forward_agent = true

โš ๏ธ Security warning: agent forwarding lets any process that can read the forwarded agent socket on the remote host โ€” including anyone with root there โ€” use your loaded keys to impersonate you against other hosts for the life of the connection. Only enable it for servers you trust, mirroring the same caution ssh_config(5) advises for ForwardAgent.

๐Ÿ“š Advanced Usage

ProxyJump / Bastion Host

Connect to servers behind a bastion or jump host. The connection is tunneled through the jump server transparently โ€” all tools (execute, upload, download, sync) work as usual.

# Define the bastion server
SSH_SERVER_BASTION_HOST=bastion.example.com
SSH_SERVER_BASTION_USER=jumpuser
SSH_SERVER_BASTION_KEYPATH=~/.ssh/bastion_key

# Point the target server to the bastion
SSH_SERVER_PRIVATE_HOST=10.0.0.5
SSH_SERVER_PRIVATE_USER=admin
SSH_SERVER_PRIVATE_PROXYJUMP=bastion

Or in TOML:

[ssh_servers.bastion]
host = "bastion.example.com"
user = "jumpuser"
key_path = "~/.ssh/bastion_key"

[ssh_servers.private]
host = "10.0.0.5"
user = "admin"
proxy_jump = "bastion"

Chained jumps are supported: if bastion itself has a proxy_jump, the chain is followed recursively. Circular references are detected and rejected.

ProxyCommand / Custom Proxy

Connect through SOCKS5 proxies or custom proxy commands. The proxy command executes locally and forwards traffic to the remote host.

# SOCKS5 proxy via ncat
SSH_SERVER_SOCKS_HOST=target.example.com
SSH_SERVER_SOCKS_USER=admin
SSH_SERVER_SOCKS_PROXYCOMMAND="ncat --proxy 127.0.0.1:1080 --proxy-type socks5 %h %p"

# Windows SSH proxy command
SSH_SERVER_WINPROXY_HOST=internal.example.com
SSH_SERVER_WINPROXY_USER=admin
SSH_SERVER_WINPROXY_PROXYCOMMAND="C:\Windows\System32\OpenSSH\ssh.exe -W %h:%p user@jump-host"

Or in TOML:

[ssh_servers.socks]
host = "target.example.com"
user = "admin"
proxy_command = "ncat --proxy 127.0.0.1:1080 --proxy-type socks5 %h %p"

[ssh_servers.winproxy]
host = "internal.example.com"
user = "admin"
proxy_command = "C:\\Windows\\System32\\OpenSSH\\ssh.exe -W %h:%p user@jump-host"

The proxy command must be a valid command that reads from stdin and writes to stdout, accepting %h and %p placeholders for host and port.

Server Groups

Tag a server with group and it becomes part of that group โ€” no extra file to maintain. The label is free-form and travels with the server definition, so it survives an export to (or import from) another tool.

SSH_SERVER_WEB1_HOST=10.0.0.1
SSH_SERVER_WEB1_USER=deploy
SSH_SERVER_WEB1_GROUP=production

SSH_SERVER_WEB2_HOST=10.0.0.2
SSH_SERVER_WEB2_USER=deploy
SSH_SERVER_WEB2_GROUP=production

Or in TOML:

[ssh_servers.web1]
host = "10.0.0.1"
user = "deploy"
group = "production"

Both servers are then reachable as a group:

Run "uptime" on the production group     โ†’ ssh_execute_group
List my server groups                    โ†’ ssh_group_manage (action: list)

ssh_list_servers also reports the group of each server, so you can see membership without opening the config.

How it combines with ssh_group_manage: groups you create with ssh_group_manage live in .server-groups.json and carry execution settings (strategy, delay, stop-on-error). Groups implied by the group field carry membership only. When a name exists on both sides, membership is the union โ€” the stored list plus every server tagged with that name โ€” and the stored execution settings apply. Group names are case-insensitive.

A group that exists only through the group field is read-only for ssh_group_manage: to change who belongs to it, edit the servers' group in your .env/TOML. Creating a group of the same name with ssh_group_manage is still allowed and simply adds stored members and settings on top.

Documentation

๐Ÿ› Troubleshooting

Claude Code Crashes / Interruptions

Symptoms:

  • Claude shows "Interrupted: What should Claude do instead?"

  • MCP tools execute but Claude stops working

  • Commands succeed but Claude freezes

Solution: v3.1.1 includes automatic fixes:

  • โœ… Output auto-truncated to prevent context overflow

  • โœ… Timeout increased to 2 minutes (default), max 5 minutes

  • โœ… Standardized error responses

Performance Tuning (add to .env):

# Reduce output size (default: 10000 characters)
MCP_SSH_MAX_OUTPUT_LENGTH=5000

# Increase timeout for slow commands (default: 120000ms)
MCP_SSH_DEFAULT_TIMEOUT=180000

# Use compact JSON to save tokens (default: false)
MCP_SSH_COMPACT_JSON=true

For large outputs:

# Instead of: cat huge-log.txt
# Use: tail -n 100 huge-log.txt
# Or: grep ERROR huge-log.txt | tail -n 50

See docs/TROUBLESHOOTING.md for complete guide.

MCP Tools Not Available

  1. Ensure MCP is installed: claude mcp list

  2. Restart Claude Code after installation

  3. Check server logs for errors

Connection Failed

  1. Test connection: ssh-manager server test [server_name]

  2. Verify network connectivity

  3. Check firewall rules

  4. Ensure SSH service is running on remote server

Permission Denied

  1. Verify username and password/key

  2. Check SSH key permissions: chmod 600 ~/.ssh/your_key

  3. Ensure user has necessary permissions on remote server

๐Ÿ“š Usage Examples

Backup & Restore

"Backup production MySQL database before deployment"
"List all backups on production server"
"Restore backup from yesterday"
"Schedule daily database backup at 2 AM"
"Backup website files excluding cache and logs"

For detailed backup examples, see examples/backup-workflow.md and docs/BACKUP_GUIDE.md.

Using the Bash CLI

# Basic server management
ssh-manager server list
ssh-manager server add
ssh-manager ssh prod1

# File synchronization
ssh-manager sync push prod1 ./app /var/www/
ssh-manager sync pull prod1 /var/log/app.log ./

# SSH tunnels
ssh-manager tunnel create prod1 local 3307:localhost:3306
ssh-manager tunnel list

# Execute commands
ssh-manager exec prod1 "docker ps"

Using in Claude Code or OpenAI Codex

Once installed, simply ask your AI assistant:

Claude Code examples:

  • "List my SSH servers"

  • "Execute 'df -h' on production server"

  • "Upload this file to staging:/var/www/"

  • "Create an SSH tunnel to access remote MySQL"

  • "Monitor CPU usage on all servers"

  • "Start a persistent session on prod1"

OpenAI Codex examples:

  • "Show my SSH servers"

  • "Run df -h on production"

  • "Upload file.txt to staging:/tmp/"

  • "Check CPU usage on all servers"

Both AI assistants support the same MCP tools! ๐Ÿš€


๐Ÿค Contributing

We welcome contributions! Please see CONTRIBUTING.md for details.

Development Setup

  1. Fork the repository

  2. Clone and install dependencies

  3. Setup pre-commit hooks for code quality:

    ./scripts/setup-hooks.sh
  4. Create your feature branch

  5. Make your changes (hooks will validate on commit)

  6. Push to your branch

  7. Open a Pull Request

Code Quality

This project uses automated quality checks:

  • ESLint for JavaScript linting

  • Black for Python formatting

  • Flake8 for Python linting

  • Prettier for code formatting

  • Pre-commit hooks for automated validation

  • Secret detection to prevent credential leaks

Run validation manually: ./scripts/validate.sh

๐Ÿ“„ License

This project is licensed under the MIT License - see the LICENSE file for details.

๐Ÿ™ Acknowledgments


Known Limitations

Command Timeout

  • The timeout parameter for SSH commands is advisory only

  • Due to SSH2 library limitations, commands may continue running on the server even after timeout

  • On Linux/macOS hosts, a system timeout wrapper is used for reliable command termination

  • Windows hosts: Set PLATFORM=windows in your server config to skip the Linux timeout/sh -c wrapper (which is incompatible with Windows OpenSSH)

SSH Sync (rsync)

  • Password authentication requires sshpass to be installed

  • SSH key authentication is recommended for better security and reliability

  • Windows MCP hosts: pass native local paths such as local:C:\project or local:.\project; ssh_sync converts drive-letter and UNC paths to MSYS2 format before launching rsync. Prefer native paths, since Node checks them on disk using Windows path semantics โ€” a path already written as /c/... or //server/share is passed through to rsync untouched rather than converted twice.

  • Large file transfers may take time and appear to hang - be patient

Connection Management

  • Connections are pooled and reused for performance

  • If a connection becomes stale, it will be automatically reconnected on next use

  • Force reconnection by using the ssh_connection_status tool with reconnect action

๐Ÿ“ง Support

For issues, questions, or suggestions:

  • Open an issue on GitHub Issues

  • Check existing issues before creating new ones


Made with โค๏ธ for the Claude Code community

Available Tools

37 tools
ssh_alert_setupA

Configures and evaluates CPU, memory, and disk usage alert thresholds for a remote server. The action parameter selects: set writes the threshold config to /etc/ssh-manager-alerts.json on the remote host (mutating, may need write access to /etc, and is blocked on readonly servers); get reads back that config; check reads current metrics and compares them to stored thresholds. get and check are read-only. enabled defaults to true; check errors if no config exists yet.

ParametersJSON Schema
NameRequiredDescriptionDefault
actionYesAction: set thresholds, get config, or check current metrics against thresholds
serverYesServer name
enabledNoEnable or disable alerts (default: true)
cpuThresholdNoCPU usage threshold percentage (e.g., 80)
diskThresholdNoDisk usage threshold percentage (e.g., 85)
memoryThresholdNoMemory usage threshold percentage (e.g., 90)

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure, and it delivers. It identifies set as mutating, names the exact config file path, notes write-access requirements, explicitly labels get and check as read-only, reveals the default for enabled, and flags the error case for check.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: a high-level purpose statement followed by a compact breakdown of the three actions and their side effects. Every sentence adds necessary information, and the mutating/read-only distinction is front-loaded rather than buried.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with six parameters and no output schema, the description covers actions, side effects, permissions, defaults, and error conditions well. It stops short of describing the exact shape of get/check return values, but the verbal descriptions of 'reads back that config' and 'compares them to stored thresholds' give an agent enough operational clarity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds real value by explaining what the action parameter does for each enum value and by clarifying the enabled default and check error behavior, which the schema alone does not convey. That warrants a step above baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb-resource pairing: 'Configures and evaluates CPU, memory, and disk usage alert thresholds for a remote server.' It then enumerates the three action modes, making it clear this tool manages alert thresholds rather than performing general SSH execution or monitoring.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly explains when to use set, get, and check, and includes important constraints like 'blocked on readonly servers' and 'check errors if no config exists yet.' It does not explicitly compare this tool to sibling tools, but the action-specific guidance is strong enough for an agent to route usage correctly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_aliasA

Manages local name aliases that let you reference a configured server by a shorter or alternative name. The action parameter selects add, remove, or list. add creates an alias pointing to an existing server and requires both alias and server; remove deletes an alias and requires alias; list shows all aliases (read-only). add and remove persist the alias mapping locally. The target server must already exist for add to succeed.

ParametersJSON Schema
NameRequiredDescriptionDefault
aliasNoAlias name (for add/remove)
actionYesAction to perform
serverNoServer name (for add)

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It effectively discloses that add and remove persist the alias mapping locally, list is read-only, and add requires the target server to already exist. It doesn't mention error handling (e.g., duplicate alias, removing a non-existent alias) but covers the core side effects and prerequisites.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences, each earning its place: first sentence states the overall purpose, second explains the action parameter and per-action requirements, third covers persistence and the prerequisite for add. It is front-loaded with the core purpose and avoids unnecessary words or padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a three-parameter tool with an enum action and no output schema, the description is largely complete. It covers all actions, required parameters, persistence behavior, and the add prerequisite. It omits specifics about return values (e.g., what list returns) and error cases, but these are minor for a CRUD-like alias manager. Given the simplicity, the description is sufficient for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with basic descriptions for each parameter. The description adds meaning by explaining the 'action' parameter selects add/remove/list, that 'alias' is required for add and remove, and 'server' is required for add. This goes beyond the schema's generic descriptions (e.g., 'for add/remove') by specifying conditional requirements and the role of each parameter in different actions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Manages local name aliases that let you reference a configured server by a shorter or alternative name.' It then breaks down the three actions, making the function unambiguous. Though it doesn't explicitly name ssh_command_alias as a distinct sibling, the focus on 'server' aliases versus 'command' aliases makes the differentiation clear without reading the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool (when you need to manage server name aliases) but provides no exclusions or references to sibling tools. It doesn't explicitly say 'use this instead of ssh_command_alias' or mention alternative tools for similar operations. The usage context is implied through the purpose, but the lack of explicit comparison or 'when not to use' guidance leaves a gap.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_backup_createA

Creates a database or file backup on the remote server over SSH, writing a compressed archive plus a JSON metadata file into backupDir. Supports mysql, postgresql, mongodb, and files (full is not yet implemented and errors). Database types require database; files requires paths. After writing it prunes backups older than retention days (default 7); compress defaults to true. Runs pre-backup and post-backup hooks.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesBackup name (e.g., production, app-data)
typeYesBackup type: mysql, postgresql, mongodb, files, or full
pathsNoPaths to backup (for files type)
dbHostNoDatabase host (default: localhost)
dbPortNoDatabase port
dbUserNoDatabase user
serverYesServer name
excludeNoPatterns to exclude from backup
compressNoCompress backup (default: true)
databaseNoDatabase name (required for db types)
backupDirNoBackup directory (default: /var/backups/ssh-manager)
retentionNoRetention period in days (default: 7)
dbPasswordNoDatabase password

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It candidly discloses side effects: writing two artifacts, pruning old backups by retention, running pre/post hooks, defaulting compression, and erroring on 'full'.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four compact sentences front-load the core action and artifact description, then pack defaults, pruning behavior, and hooks without redundancy. Every sentence contributes operational value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 13-parameter remote mutation tool with no annotations and no output schema, the description covers essential conditions, defaults, side effects, and the failure mode for unsupported types. An agent has enough to validate inputs and anticipate consequences before calling.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds valuable cross-parameter constraints: database types require database, files requires paths, and defaults for retention, compress, and backupDir. This goes beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a concrete action ('Creates...backup'), identifies the transport ('over SSH'), and specifies the output artifacts ('compressed archive plus a JSON metadata file'). The supported types and explicit 'full' error help distinguish it from sibling backup tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Clearly communicates the use context: on-demand SSH backups with type-specific prerequisites and an unsupported full mode. It doesn't explicitly say when to prefer this over ssh_db_dump or ssh_backup_schedule, but the context is strong enough for an agent to infer the intended use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_backup_listA

Lists existing backups found in backupDir on the remote server, returning each backup id, type, database or paths, size, compression, retention, status, and creation time parsed from stored metadata. Read-only: it inspects the filesystem and mutates nothing. Optional type filters results to mysql, postgresql, mongodb, files, or full. backupDir defaults to the configured backup directory.

ParametersJSON Schema
NameRequiredDescriptionDefault
typeNoFilter by backup type
serverYesServer name
backupDirNoBackup directory (default: /var/backups/ssh-manager)

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It explicitly states 'Read-only: it inspects the filesystem and mutates nothing', which is a key behavioral disclosure. It also mentions that it parses metadata from stored metadata, providing transparency on the operation's nature.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, front-loaded with the primary purpose, and every sentence adds relevant detail without redundancy. No fluff or unnecessary information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a list operation, the description is complete: it specifies the resource, optional filters, defaults, and the output fields. It does not mention error scenarios or authentication, but these are not typically required for a read-only list. The information provided is sufficient for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description reiterates the type enum and the backupDir default, which are already in the schema, but adds value by explaining the purpose of the 'type' filter and the output fields. It does not significantly extend beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Lists existing backups'), the resource (backupDir on remote server), and enumerates the returned fields. It is distinct from sibling tools like ssh_backup_create or ssh_backup_restore by focusing on listing/inspection.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains how to invoke the tool (optional type filter, backupDir default) but does not explicitly state when to use it versus alternatives, such as 'use this to view backups instead of creating/restoring'. No exclusions or alternative tool names are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_backup_restoreA

Restores a previously created backup identified by backupId, reading its metadata to pick the engine. This is destructive and overwrites the target: PostgreSQL runs pg_restore with --clean --if-exists which DROPs existing objects, MongoDB runs mongorestore --drop, and MySQL pipes the dump into the live database replacing matching objects. Supports mysql, postgresql, mongodb, and files. Runs pre-restore and post-restore hooks.

ParametersJSON Schema
NameRequiredDescriptionDefault
dbHostNoDatabase host (default: localhost)
dbPortNoDatabase port
dbUserNoDatabase user
serverYesServer name
backupIdYesBackup ID to restore
databaseNoTarget database name (for db restores)
backupDirNoBackup directory (default: /var/backups/ssh-manager)
dbPasswordNoDatabase password
targetPathNoTarget path for files restore (default: /)

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden, and it delivers: it explicitly warns that the operation is destructive and overwrites the target, details per-engine behavior (pg_restore --clean --if-exists, mongorestore --drop, MySQL piping), and mentions pre/post-restore hooks. This is exemplary disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is four focused sentences: main action first, then destructive warning, then engine-specific details, then supported engines and hooks. Every sentence adds value; no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive restore operation with no annotations or output schema, the description covers the essential behavioral facts, engine differences, supported engines, and hooks. The only notable gap is the lack of any statement about return values, success/failure indication, or required preconditions beyond the existence of the backup.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds context about engine selection via metadata but does not elaborate on individual parameter semantics beyond what the schema already provides. No deduction is warranted given the full schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Restores a previously created backup identified by backupId'. It also explains the engine-selection mechanism, which distinguishes this from siblings like ssh_backup_create and ssh_db_import. The purpose is immediately unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'previously created backup' clearly ties this tool to backup-creation workflows, and the supported engines are listed. However, it does not explicitly name alternative tools such as ssh_db_import or state when one should be preferred over the other, leaving some routing to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_backup_scheduleA

Schedules a recurring backup on the remote server by writing an executable bash script to /usr/local/bin/ssh-manager-backup-NAME.sh and installing a crontab entry for the given cron expression. Mutates the remote filesystem and crontab, and typically needs root to write that path. Supports mysql, postgresql, mongodb, and files; the generated script also deletes backups older than retention days (default 7).

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesBackup name
typeYesBackup type
pathsNoPaths to backup (for files type)
serverYesServer name
databaseNoDatabase name (for db types)
scheduleYesCron schedule (e.g., "0 2 * * *" for daily at 2 AM)
retentionNoRetention period in days (default: 7)

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It explicitly states the tool mutates the remote filesystem and crontab, writes an executable script to a specific path, typically needs root, and that the generated script deletes old backups based on retention. This is unusually transparent for a mutating tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each earning its place: first states the core scheduling action, second discloses side effects and permissions, third lists supported types and default retention. The information is front-loaded and free of filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is largely complete for a 7-parameter tool: it explains side effects, permission needs, supported backup types, and the retention default. The main gap is that it does not clarify conditional parameter requirements, such as paths being needed when type=files, though the schema partially signals this.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds some context by referencing the cron expression, supported backup types, and retention default, but it does not need to deeply explain individual parameters because the schema already documents them well.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource: it 'schedules a recurring backup' by writing a script and installing a crontab entry. It clearly distinguishes itself from one-off siblings like ssh_backup_create and restore by emphasizing recurrence via cron.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes the usage context clear: recurring backups via cron on a remote server, with explicit mention of requiring root to write the target path. It does not explicitly name an alternative for one-off backups, but the recurring/cron framing is sufficient to route an agent correctly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_command_aliasA

Manages local shorthand aliases that map a short name to a full command string, stored in local config with no remote execution or side effects. The action selects behavior: add (requires both alias and command), remove (requires alias), list to show all aliases tagged as profile or custom, or suggest to return existing aliases matching a search term passed in the command field. Adding an existing alias overwrites it.

ParametersJSON Schema
NameRequiredDescriptionDefault
aliasNoAlias name (for add/remove)
actionYesAction to perform
commandNoCommand to alias (for add) or search term (for suggest)

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full transparency burden and does well by disclosing no remote execution, no side effects, local config storage, and overwrite-on-add behavior. It does not mention result format, error handling, or config file location, so it stops short of 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, all substantive and well organized: main purpose first, action semantics second, and the overwrite caveat last. There is no filler, and nothing merely repeats the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema or annotations and four distinct actions, the description explains each action's behavior and even gives high-level return expectations for list and suggest. It does not specify exact result formatting or failure behavior, but an agent has sufficient information to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is already 100%, and the description adds meaningful operational detail beyond the schema by binding each action to its required parameters (e.g., command doubles as the search term for suggest, add needs both alias and command). This mapping is not fully inferable from the enum alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the resource ('local shorthand aliases' mapping a short name to a full command string) and scopes behavior to local config with no remote execution, which distinguishes it from the many remote-execution siblings. It falls short of 5 because it does not explicitly differentiate from the similarly named 'ssh_alias' sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description offers clear action-specific usage guidance: add requires both alias and command, remove requires alias, suggest uses the command field as a search term, and list shows profile/custom-tagged aliases. The 'local config with no remote execution or side effects' phrase gives selection context versus remote tools, although no alternative tool is named explicitly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_connection_statusA

Inspects and manages the pooled SSH connections held by this server process; affects only local in-memory connections, never remote state. The action parameter selects: status lists active connections with age and keepalive (read-only); reconnect closes then reopens one connection; disconnect closes one connection; cleanup drops aged-out and dead connections. The server parameter is required for reconnect and disconnect and ignored otherwise.

ParametersJSON Schema
NameRequiredDescriptionDefault
actionYesAction to perform
serverNoServer name (for reconnect/disconnect)

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the transparency burden and largely meets it: status is labeled read-only, reconnect closes then reopens, disconnect closes, cleanup drops aged-out/dead connections, and all effects are confined to local in-memory state. It stops short of noting failure modes or in-flight operation impact.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two dense sentences: the first sets scope and the second maps actions and parameters. Every clause carries useful information with no filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter tool with no output schema, the description fully equips an agent to choose an action, supply server when required, and anticipate the local-only side effects. Nothing critical for correct invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although the schema describes both parameters, the description adds real semantic value by explaining each action enum value's effect and the conditional requirement/ignored behavior of server. This is precisely the disambiguation an agent needs beyond the generic schema text.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly identifies the tool as inspecting and managing pooled SSH connections held by the local server process, then breaks it into four explicit actions. The 'never remote state' boundary distinguishes it from sibling SSH tools that operate on remote servers.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides concrete action semantics and states exactly when the server parameter is required versus ignored. It does not name sibling alternatives explicitly, but the local-only/never-remote scoping gives an agent enough context to avoid using it for remote-state operations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_db_dumpA

Dumps a database to a file on the remote server over SSH; it reads data only and does not modify the database. Supports mysql (using --single-transaction --routines --triggers), postgresql (custom format with --clean --if-exists, restorable via pg_restore), and mongodb. compress defaults to true and gzips the output. The optional tables list applies to MySQL and PostgreSQL only and is ignored for MongoDB.

ParametersJSON Schema
NameRequiredDescriptionDefault
typeYesDatabase type
dbHostNoDatabase host (default: localhost)
dbPortNoDatabase port
dbUserNoDatabase user
serverYesServer name
tablesNoSpecific tables to dump (MySQL/PostgreSQL only)
compressNoCompress output with gzip (default: true)
databaseYesDatabase name
dbPasswordNoDatabase password
outputFileYesOutput file path (will be created on remote server)

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the behavioral disclosure burden. It transparently notes that the database is not modified, explains engine-specific flags, states that compression defaults to true with gzip, and warns that the tables list is ignored for MongoDB. It could also clarify overwrite behavior for an existing output file, but the core side effects are disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but efficient. The main purpose is front-loaded in the first sentence, and every subsequent sentence adds non-obvious operational detail without repetition or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 10-parameter tool with no output schema, the description covers the most important operational nuances: read-only behavior, database-specific flags, compression, and table-list limitations. It is slightly incomplete regarding what happens if the remote output file already exists and what the tool returns after completion, but these are minor gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds meaningful context beyond the schema: MySQL flags, PostgreSQL custom format and pg_restore compatibility, the compression default, and the MySQL/PostgreSQL-only behavior of the tables parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action, 'Dumps a database to a file on the remote server over SSH,' and clarifies it 'reads data only and does not modify the database.' This clearly differentiates it from sibling tools like ssh_db_import, ssh_db_query, and ssh_db_list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use the tool by emphasizing read-only behavior and listing supported database types. It does not explicitly name alternative tools for write operations, but the read-only framing makes the intended use unmistakable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_db_importA

Imports a dump file into a target database on the remote server and is destructive to existing data. PostgreSQL uses pg_restore --clean --if-exists which DROPs existing objects before loading; MongoDB uses mongorestore with --drop controlled by the drop flag (default true); MySQL pipes the file into the live database, replacing objects defined in it. Supports mysql, postgresql, mongodb. Compressed .gz inputs are decompressed automatically.

ParametersJSON Schema
NameRequiredDescriptionDefault
dropNoDrop existing collections/tables before import (MongoDB only, default: true)
typeYesDatabase type
dbHostNoDatabase host (default: localhost)
dbPortNoDatabase port
dbUserNoDatabase user
serverYesServer name
databaseYesTarget database name
inputFileYesInput file path (on remote server)
dbPasswordNoDatabase password

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations present, the description fully carries the behavioral burden. It explicitly discloses destructive behavior, the exact PostgreSQL DROP semantics, MongoDB's --drop default, MySQL's replacement behavior, and automatic .gz decompression.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tightly packed sentences front-load the most critical fact (destructive), then give DB-specific behavior and supported input handling. No filler or redundant restatement of schema fields.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the essential operational facts for a destructive import tool: supported database engines, per-engine destructive behavior, the drop flag's default, and compressed input handling. No output schema is present, but return values are not necessary for an agent to invoke this correctly; the missing details are optional parameters already documented by the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents all parameters. The description clarifies the drop flag and database-type-specific behavior, but it does not add substantial new detail about most parameters such as server, database, dbHost, dbPort, or inputFile.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a clear action ('imports a dump file into a target database') with a specific resource and context (remote server). Distinguishes itself from sibling tools like ssh_db_dump and ssh_db_query through the explicit import and destructive-restore framing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear context by naming supported database types and explicitly warning that the operation is destructive. Does not name alternative tools or when-not-to-use conditions, but the import purpose is unambiguous enough for an agent to select it over export/query siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_db_listA

Lists database objects on the remote server for the given engine without modifying anything. When database is provided it lists the tables (SQL) or collections (MongoDB) of that database; when omitted it lists all databases with common system databases filtered out. Supports mysql, postgresql, and mongodb. Returns the items and a count. Read-only and safe to call repeatedly.

ParametersJSON Schema
NameRequiredDescriptionDefault
typeYesDatabase type
dbHostNoDatabase host (default: localhost)
dbPortNoDatabase port
dbUserNoDatabase user
serverYesServer name
databaseNoDatabase name (if provided, lists tables/collections; if omitted, lists databases)
dbPasswordNoDatabase password

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and does well by stating the operation is non-modifying, read-only, safe to call repeatedly, and filters system databases. It could add details about authentication or error behavior, but the key behavioral traits are disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three compact sentences, front-loaded with the core purpose and safety guarantee. Every sentence earns its place, and there is no redundant phrasing or repeated schema content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a list-style tool with no output schema, the description covers purpose, parameter-dependent behavior, supported engines, return shape, and safety profile. It could mention how credentials are resolved or what happens on connection failure, but nothing critical is missing for selecting and invoking the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema documents all parameters with descriptions, so the baseline is 3. The description adds meaningful context beyond the schema by explaining how the 'database' parameter changes behavior, which engines are supported, and what the return payload contains.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Lists') with a clearly defined resource ('database objects on the remote server') and states it modifies nothing. It also distinguishes its behavior from siblings like ssh_db_query, ssh_db_dump, and ssh_db_import by focusing on introspection only.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear usage context: when 'database' is provided it lists tables/collections, and when omitted it lists databases with system databases filtered out. It also notes the tool is read-only and safe to call repeatedly, but it does not explicitly name alternatives or state when to prefer another tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_db_queryA

Runs a read-only query against a remote database. For mysql and postgresql it is strictly limited to SELECT: the query must begin with SELECT and any insert, update, delete, drop, create, alter, truncate, grant, revoke, or exec keyword is rejected before execution. For mongodb it runs a find() and requires the collection parameter. Returns the raw command output as text.

ParametersJSON Schema
NameRequiredDescriptionDefault
typeYesDatabase type
queryYesSQL query (SELECT only) or MongoDB find query
dbHostNoDatabase host (default: localhost)
dbPortNoDatabase port
dbUserNoDatabase user
serverYesServer name
databaseYesDatabase name
collectionNoCollection name (MongoDB only)
dbPasswordNoDatabase password

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full disclosure burden. It does so thoroughly: read-only guarantee, exact rejection list for unsafe SQL keywords, MongoDB find behavior, collection requirement, and raw text output are all explicitly stated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences with no filler. The core action is front-loaded, followed by necessary per-type restrictions and the output format, making every sentence earn its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 9-parameter SSH database tool with no output schema and no annotations, this description covers invocation constraints, safety restrictions, the MongoDB special case, and return type. An agent has enough information to call it correctly without needing to inspect the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds value beyond the schema by constraining query semantics per database type and clarifying when collection is mandatory. It does not discuss auth-related parameters, but their schema descriptions already cover them.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb-resource pair: runs a read-only query against a remote database. The database-type branches for SELECT and find() add precision and clearly distinguish this from sibling write, import, and export tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It establishes a clear usage context: read-only database queries, with type-specific rules such as queries must begin with SELECT and MongoDB requires the collection parameter. It does not explicitly name alternatives or exclusion conditions, but the read-only framing provides strong directional guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_deployA

Deploys a list of local files to remote paths on the named server, uploading each to a temporary location first and then moving it into place. Mutates remote state. By default it backs up any existing target file before overwriting; backup can be disabled per call. Options can set owner and permissions, supply a sudo password, and name a single service to restart afterward. Detects sensible owner and permission defaults from the remote path. Runs pre and post deploy hooks. Blocked entirely on servers in readonly or restricted security mode.

ParametersJSON Schema
NameRequiredDescriptionDefault
filesYesArray of files to deploy
serverYesServer name or alias
optionsNoDeployment options

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations to carry safety/behavior information, the description carries the full burden and does so richly. It discloses mutation of remote state, the temporary-upload-before-move sequence, backup-on-overwrite behavior, sudo password usage, hook execution, and blocking on readonly/restricted servers.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Every sentence in the description earns its place; the core action and mutation warning are front-loaded, followed by backup, option coverage, defaults, hooks, and the security-mode blocker. Despite covering many facets, it stays compact and scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a state-mutating deployment tool with nested parameters and no output schema, the description covers almost everything an agent needs: mechanics, backup behavior, options, defaults, hooks, and security restrictions. It does not describe the return format or failure cleanup behavior, which keeps it from a 5.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds real meaning beyond the schema: it explains that each file is uploaded to a temporary location before being moved, that backup is on by default and can be disabled, that owner/permission defaults are detected from the remote path, and that restart targets a single service. This enriches the bare parameter names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence states a specific action, resource, and target: deploying a list of local files to remote paths on a named server, with a distinctive temp-then-move mechanism. It is clear, but it never explicitly contrasts with closely related siblings such as ssh_upload or ssh_sync, so differentiation is left to inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear operational context: use for multi-file deployment with backup defaults, owner/permission handling, hooks, optional service restart, and a hard exclusion on readonly/restricted servers. It does not explicitly say when to prefer this over ssh_upload or ssh_sync, so it falls short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_downloadA

Downloads one remote file from the named server to a local destination path over SFTP, overwriting any existing local file at that path. Affects only the local filesystem and is read-only on the remote side, so it stays allowed even on servers in readonly or restricted security mode. Reads the remote file using the configured SSH user, which must have permission to read it. Handles single files only; use ssh_sync for directories.

ParametersJSON Schema
NameRequiredDescriptionDefault
serverYesServer name
localPathYesLocal destination path
remotePathYesRemote file path

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so thoroughly. It discloses side effects ('overwriting any existing local file'), remote-side scope ('read-only on the remote side'), permission requirements ('configured SSH user, which must have permission to read it'), and operational constraints (single file only).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three information-dense sentences front-load the action, then add constraints and alternatives in a logical order. Every sentence earns its place with no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a three-parameter tool with no output schema, this description is complete. It covers action, side effects, permission requirements, security-mode compatibility, and the directory alternative. An agent has enough to decide when to use it and how to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description augments the schema by explaining that localPath will be overwritten and that remotePath must be readable by the SSH user, which adds meaningful operational context to the parameter behaviors.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific action and resource: 'Downloads one remote file from the named server to a local destination path over SFTP.' It explicitly clarifies the single-file scope and points to ssh_sync for directories, making it unmistakably distinct from siblings like ssh_upload and ssh_sync.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It directly states when to use the tool versus alternatives: 'Handles single files only; use ssh_sync for directories.' It also provides a contextual prerequisiteโ€”allowed even on servers in readonly or restricted security modeโ€”which helps the agent decide suitability without external lookup.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_executeA

Runs a shell command over SSH on a named configured server and returns stdout, stderr, and exit code. Mutates remote state depending on the command; not read-only. Expands command aliases before running. Uses the cwd parameter or, if omitted, the server configured default directory; adapts syntax for Linux versus Windows PowerShell targets. Timeout defaults to 120000 ms and is capped at 300000 ms. Under readonly mode destructive commands like rm or dd are refused; under restricted mode the command must match allow patterns. Output is truncated when very large.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoWorking directory (optional, uses default if configured)
serverYesServer name from configuration
commandYesCommand to execute
timeoutNoCommand timeout in milliseconds (default: 120000, max: 300000)

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully carries the burden of behavioral disclosure. It explicitly states that the tool mutates remote state, expands aliases, handles cwd fallback, adapts to Linux/Windows, has timeout limits, enforces readonly/restricted mode restrictions, and truncates large output. This is comprehensive transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose in the first sentence, then adds details in a logical sequence: mutation, alias expansion, cwd, OS adaptation, timeout, mode restrictions, and truncation. Every sentence carries unique information without redundancy, making it efficient for its depth.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a general execution tool with 4 parameters and no output schema, the description covers return values, edge cases (truncation, mode restrictions), configuration defaults, and behavioral nuances. It is complete enough for an agent to call correctly without missing critical information.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and each parameter has a description. The description adds value beyond the schema by explaining cwd fallback behavior, timeout default and cap, and command alias expansion, which clarifies the operational context of these parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it runs a shell command over SSH and returns stdout, stderr, and exit code. It distinguishes itself from siblings by detailing alias expansion, OS-adaptive syntax, and timeout behavior, enabling an agent to recognize it as the generic execution tool even without naming alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not explicitly say when to use this tool versus siblings like ssh_execute_sudo or ssh_execute_group. It provides behavioral context such as not being read-only and mode restrictions, but the selection criteria are implied rather than stated, leaving the agent to infer usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_execute_groupA

Runs one command on every server belonging to the named group and returns a per-server success or failure report. Members come from the groups defined with ssh_group_manage plus every server whose configuration carries a matching group field, so a group can exist through the config alone. Mutates remote state on each member and is not idempotent. Best-effort: the security policy of each server is evaluated independently, so readonly or restricted members are reported as failed without aborting the rest unless stopOnError is set. Strategy may be parallel, sequential, or rolling (delay applies between servers). Per-server timeout is 30000 ms; cwd defaults to the default_dir of each server.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoWorking directory
delayNoDelay between servers in ms (for rolling)
groupYesGroup name (e.g., "production", "staging", "all")
commandYesCommand to execute
strategyNoExecution strategy
stopOnErrorNoStop execution on first error

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so thoroughly: it discloses remote mutation, non-idempotence, per-server policy failures, best-effort semantics, stopOnError interaction, strategy meaning, timeout, and cwd default. There is no contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four dense sentences front-load the primary action and return value, then add only high-value behavioral detail. No filler or repetition of schema text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutating group command with no annotations and no output schema, this description covers membership resolution, failure semantics, strategies, timeout, and cwd default. The only mild gap is an exact report format, but 'per-server success or failure report' is sufficient for invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, but the description adds material behavior beyond the schema: group membership can exist through config alone, cwd defaults to default_dir, timeout is 30000 ms, and stopOnError only changes the best-effort abort behavior. It also clarifies how delay applies to the rolling strategy.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with 'Runs one command on every server belonging to the named group', naming a specific verb, target resource, and group scope. This clearly separates it from single-host tools like ssh_execute and from ssh_execute_sudo.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes the intended context clear: group-wide execution over servers derived from ssh_group_manage or host config. It also explains best-effort failure handling, strategies, and stopOnError, but does not explicitly state when to prefer an alternative such as single-server ssh_execute.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_execute_sudoA

Runs a command with elevated privileges via sudo on the named server and returns the exit code and output. Prepends sudo when absent. If a password is given, or a sudo password is configured for the server, it is piped to sudo -S and masked in the returned output. Mutates remote state and can be destructive. Honors the cwd parameter or the server default directory and adapts to Linux or Windows. Timeout defaults to 30000 ms. Blocked entirely in readonly mode; in restricted mode the command must satisfy the allow and deny patterns.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoWorking directory
serverYesServer name or alias
commandYesCommand to execute with sudo
timeoutNoCommand timeout in milliseconds (default: 30000)
passwordNoSudo password (will be masked in output)

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations at all, the description carries the full disclosure burden and more than meets it. It flags that the command 'mutates remote state and can be destructive,' explains sudo -S password piping and output masking, notes readiness for Linux/Windows, cwd honoring, timeout defaults, and readonly/restricted mode constraints. This is exemplary behavioral transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but well-organized, front-loading the purpose and then layering behavioral details. Each sentence adds distinct value: password handling, mutability/destructiveness, directory and OS behavior, timeout, and execution modes. Slightly long but no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite lacking an output schema, the description explicitly states the return value (exit code and output) and addresses key context signals: parameters, default timeout, OS adaptation, cwd behavior, and restricted/readonly execution constraints. This is sufficient for an agent to invoke and interpret the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers all five parameters with descriptions, yielding 100% coverage. The description adds valuable semantics beyond the schema by explaining password piping and masking, the timeout default, cwd honoring, and sudo prepending, giving the agent operational details the schema does not convey.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a precise, specific verb phrase: 'Runs a command with elevated privileges via sudo on the named server and returns the exit code and output.' This clearly identifies the action, the target resource, the elevation mechanism, and the expected result, making it readily distinguishable from the sibling ssh_execute tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description establishes a clear use context: elevated sudo privileges on a named server, with caveats about password handling and readonly/restricted mode behavior. It does not explicitly name alternatives or state 'when not to use,' but the sudo focus implicitly differentiates it from plain ssh_execute.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_group_manageA

Creates, updates, deletes, and inspects named server groups used by ssh_execute_group, persisting changes to local configuration only with no remote side effects. The action selects the operation: create, update, delete, add-servers, remove-servers, or list. Every action except list requires name; add-servers and remove-servers also require a non-empty servers array. list is read-only and also reports the groups derived from the per-server group field of the SSH configuration, which are read-only here and change only by editing that configuration. Optional strategy, delay, and stopOnError set default group execution behavior.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNoGroup name
delayNoDelay between servers in ms
actionYesAction to perform
serversNoServer names
strategyNoExecution strategy
descriptionNoGroup description
stopOnErrorNoStop on error flag

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral disclosure burden and does well: it states persistence to local configuration only, absence of remote side effects, and that list also reports read-only derived groups. It does not cover failure semantics or idempotency, but the main safety-relevant behaviors are disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but well-organized: first sentence states purpose and scope, second defines the operation contract, and third explains read-only behavior and optional defaults. Every sentence earns its place with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers action semantics, per-action parameter requirements, persistence scope, read-only behavior, and default execution options. It does not describe return values or error behavior for create/update/delete, but the tool is otherwise sufficiently scoped for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds substantial value beyond the schema's 100% parameter coverage by specifying conditional requirements: list is exempt from name, add/remove require non-empty servers, and strategy/delay/stopOnError serve as default execution behavior. These relationships are not encoded in the input schema, making the prose essential.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear compound operationโ€”'Creates, updates, deletes, and inspects named server groups'โ€”and identifies the resource scope as local configuration with no remote side effects. It also names the dependent sibling, ssh_execute_group, distinguishing this management tool from execution tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit per-action usage requirements: list is read-only, all other actions require name, and add-servers/remove-servers require a non-empty servers array. It does not explicitly name a competing alternative, but it clearly positions the tool as local group management in contrast to remote-execution siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_health_checkA

Runs a comprehensive read-only health check on the named server by executing diagnostic shell commands over SSH, then returns parsed JSON with overall status, CPU, memory, disk usage, and uptime. It only reads metrics and changes nothing on the remote host. Set detailed to true to additionally include load average and network metrics; it defaults to false. Critical CPU, memory, or disk conditions are surfaced in a critical_issues list.

ParametersJSON Schema
NameRequiredDescriptionDefault
serverYesServer name
detailedNoInclude detailed metrics (network, load average)

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It clearly states the tool is read-only ('only reads metrics and changes nothing') and describes the output structure (parsed JSON, critical_issues list). It also mentions the default value of 'detailed' and what it includes. It does not cover error handling, authentication prerequisites, or behavior on SSH failure, but for a health check these are secondary. The disclosure is strong but not exhaustive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is four concise sentences, each adding a distinct piece of value: purpose, safety guarantee, parameter behavior, and output highlights. It is front-loaded with the primary purpose and avoids redundancy. No sentence is wasted; the structure is efficient and informative.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity (2 params, no output schema, but no nested objects) and the fact that there are no annotations, the description is remarkably complete. It specifies the return format (parsed JSON), the key fields (status, CPU, memory, disk, uptime, critical_issues), and parameter behavior. The only missing aspects (error handling, auth details) are likely standard across the ssh_* family and adequately implied by the context. Nothing essential for correct invocation is absent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds meaning beyond the schema: for 'detailed', it clarifies the default (false) and the specific additional metrics (load average and network). For 'server', it implies a predefined named server rather than arbitrary host string. These additions exceed the schema's minimal descriptions, thus warranting a 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Runs'), a resource ('the named server'), and a defined outcome ('returns parsed JSON with overall status, CPU, memory, disk usage, and uptime'). It clearly distinguishes this from siblings like ssh_execute (arbitrary commands) and ssh_monitor (likely continuous monitoring) by emphasizing 'read-only health check' and 'diagnostic shell commands'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for one-off health diagnostics and explicitly notes it 'only reads metrics' and 'changes nothing', which suggests safe, non-disruptive use. However, it does not explicitly name alternative tools or state when not to use it (e.g., 'for ongoing monitoring, use ssh_monitor' or 'for arbitrary commands, use ssh_execute'). The context is clear but lacks explicit exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_historyA

Returns the in-memory log of SSH commands previously run through this server process during the current session, formatted with timestamps, server, duration, and success status. Purely local and read-only: it opens no SSH connection and does not persist across restarts. Optional filters narrow the results by server name, by success or failure, and by a search substring in the command text; limit defaults to 20 most recent entries. Does not expose command output, only the commands and their outcomes.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoNumber of commands to show (default: 20)
searchNoSearch in commands
serverNoFilter by server name
successNoFilter by success/failure

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully discloses behavior: it opens no SSH connection, is read-only, retains data only for the current process, and does not expose command output. This goes well beyond a basic function statement and gives the agent a precise safety and side-effect profile.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core function, then adds behavioral caveats and filter semantics in a logical order. Every sentence earns its place with no redundant wording or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only lookup with four optional parameters and no output schema, the description covers what the agent needs: what is returned (timestamps, server, duration, success status), what is excluded (command output), and the current-session limitation. Nothing critical is missing for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds meaningful context by explaining that filters 'narrow the results', that 'search' targets substring in command text, and that 'limit' defaults to the 20 most recent entries. This is extra value beyond the schema's terse field descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States the exact action ('Returns the in-memory log of SSH commands') with a specific resource and scope ('through this server process during the current session'). The read-only, local nature and explicit disambiguation from execution tools clearly distinguish it from siblings like ssh_execute or ssh_session_list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear context that this is for reviewing commands from the current in-memory session only, and explicitly notes it does not persist across restarts. It does not name alternative tools or state when not to use it, but the unique purpose makes usage obvious.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_hooksA

Manages automation hooks that fire around SSH operations such as pre-deploy, toggling them on or off in local configuration only with no immediate remote action. The action selects behavior: list shows each hook with its enabled state, description, and action count; enable and disable flip a hook and both require the hook name; status summarizes which hooks are currently enabled versus disabled. Toggling persists and affects later operations.

ParametersJSON Schema
NameRequiredDescriptionDefault
hookNoHook name (for enable/disable)
actionYesAction to perform

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full transparency burden and handles it well. It explicitly discloses the side-effect profile: changes are local, persistent, have no immediate remote action, and affect later operations. It also describes what list and status reveal, which is useful behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded with the core resource and key constraint. The main redundancy is the phrase 'The action selects behavior,' which is followed by an explicit enumeration, but the overall structure is dense and scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter tool with no output schema, the description is complete: it covers all action branches, parameter usage, side effects, persistence, and the nature of list/status output. Nothing essential is missing for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds real meaning by explaining what each action does and clarifying that enable and disable both require the hook name. This goes beyond the terse schema descriptions and the raw enum values.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly identifies the resource as SSH automation hooks and names the supported operations: list, enable, disable, and status. The phrase 'local configuration only with no immediate remote action' helps distinguish this tool from remote-execution siblings like ssh_execute and ssh_deploy.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when each action is appropriate, including that list and status are informational, while enable and disable require a hook name. It also notes the tool only affects local configuration and has no immediate remote action, though it does not explicitly name alternative tools or when not to use this one beyond that scope.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_key_manageA

Manages SSH host key fingerprints in your local known_hosts file for the named server. The action parameter selects: verify, check, and list are read-only comparisons or listings; accept adds or updates the host key in known_hosts; remove deletes it. accept and remove mutate local state and are blocked on servers configured as readonly. server is required for every action except list. autoAccept defaults to false and should be used with caution.

ParametersJSON Schema
NameRequiredDescriptionDefault
actionYesAction to perform
serverNoServer name (required for most actions)
autoAcceptNoAutomatically accept new keys (use with caution)

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full responsibility for behavioral disclosure. It explicitly classifies verify/check/list as read-only, states that accept and remove mutate local state, and warns that autoAccept should be used with caution. It also tells the agent that mutation is blocked on readonly servers, which is essential safety context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded with the tool's purpose, then moves through action semantics and safety conditions. Every sentence contributes information, with no filler or repetition of schema trivia.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the main actions, mutation risks, readonly blocking, and parameter requirements. However, it does not clearly distinguish verify, check, and list from one another, which could lead an agent to choose the wrong read-only action. Since there is no output schema, some indication of return behavior would also have improved completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although schema coverage is 100%, the schema only says 'Action to perform' for action and 'use with caution' for autoAccept. The description adds real semantic value by grouping the enum values into read-only versus mutating operations, clarifying the conditional requirement for server, and giving the default and caution for autoAccept.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: it manages SSH host key fingerprints in the local known_hosts file for a named server. It then enumerates concrete actions, making it easy to distinguish from sibling tools like ssh_execute or ssh_tunnel_create.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly explains what each action does and notes that server is required for every action except list. It also mentions that accept and remove are blocked on readonly servers, giving useful usage constraints, though it does not explicitly name alternative tools for comparison.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_list_serversA

Lists all SSH servers defined in the loaded configuration, returning for each the name, host, user, port, authentication type (password or key), default directory, group, and description. Read-only and local: it reads configuration only and opens no SSH connections. Deliberately omits secrets, so no passwords, key paths, passphrases, or sudo passwords are returned. Takes no parameters. Useful as a first call to discover which server names other tools accept.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully covers behavioral traits: read-only, local, opens no SSH connections, and deliberately omits secrets. This is exemplary transparency for a list tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured, front-loading the purpose in the first sentence. Each subsequent sentence adds unique value: return fields, safety, secrets, parameters, and use case.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool with no output schema, the description is complete: it lists return fields, describes read-only behavior, clarifies no secrets, states no parameters, and gives a concrete usage scenario.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema is empty and the description explicitly states 'Takes no parameters,' leaving no ambiguity. Since there are zero parameters, no further semantics are required, and the baseline of 4 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Lists all SSH servers defined in the loaded configuration' with specific verb and resource, and enumerates the return fields. It distinguishes itself from sibling tools by being the server list, not sessions or tunnels.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit usage context: 'Useful as a first call to discover which server names other tools accept.' It also notes read-only and local behavior, but does not explicitly name alternatives or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_monitorA

Collects a read-only snapshot of system resources on the named Linux server by running inspection commands such as top, free, df, ss, and ps. The type parameter selects the view and defaults to overview; other values are cpu, memory, disk, network, and process. Does not change remote state and needs no sudo. The interval and duration parameters are accepted for continuous monitoring intent but a single snapshot is gathered. Targets Linux tooling, so output may be empty on Windows hosts.

ParametersJSON Schema
NameRequiredDescriptionDefault
typeNoType of monitoring (default: overview)
serverYesServer name from configuration
durationNoDuration in seconds for continuous monitoring
intervalNoUpdate interval in seconds for continuous monitoring

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations available, the description carries the full burdenโ€”and it does excellently. It explicitly states the tool is read-only, changes no remote state, requires no sudo, and only gathers a single snapshot even when interval and duration are provided. This is transparent and prevents misuse.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four sentences with no filler. The main capability is front-loaded, parameter behavior is explained, and important caveats about monitoring semantics, sudo, and platform support each earn their place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The core call-time decision points are covered: inputs, default behavior, safety, and platform caveats. Since there is no output schema, the description could have been slightly more explicit about the shape or format of the returned snapshot, but the named commands and resource categories give a reasonable expectation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already covers all parameters at 100%, but the description adds real value by explaining that type defaults to overview, enumerating its possible values, and clarifying that interval and duration do not actually enable continuous monitoring. This goes beyond the schema without being redundant.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Collects a read-only snapshot of system resources on the named Linux server.' It also names the inspection commands and the type parameter's view options, which clearly distinguishes it from execution, transfer, session, and tunnel siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for when the tool is appropriate: read-only monitoring without state changes or sudo, and notes a Linux-only expectation with potential empty output on Windows. It does not explicitly name alternatives like ssh_execute or ssh_execute_sudo, so it falls just short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_process_managerA

Lists, inspects, or terminates processes on a remote server over SSH. The action parameter selects: list returns top processes (read-only), info returns details for one process (read-only), and kill sends a signal to terminate a process and mutates remote state. pid is required for kill and info. kill is blocked on servers configured as readonly. signal defaults to TERM, sortBy defaults to cpu, and limit defaults to 20; filter narrows the list by name or command.

ParametersJSON Schema
NameRequiredDescriptionDefault
pidNoProcess ID (required for kill and info actions)
limitNoNumber of processes to return (default: 20)
actionYesAction: list processes, kill process, or get process info
filterNoFilter processes by name/command
serverYesServer name
signalNoSignal to send when killing (default: TERM)
sortByNoSort processes by CPU or memory (default: cpu)

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations present, the description properly carries the behavioral disclosure burden: it explicitly marks list and info as read-only, kill as mutating remote state, and notes the readonly-server block. It also exposes defaults for signal, sortBy, and limit, which helps the agent predict behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences cover actions, read-only vs mutating behavior, required parameters, constraints, and defaults. The most important behavioral distinction is front-loaded, and every sentence earns its place without fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 7 parameters, 3 enums, and no annotations or output schema, the description covers the essential invocation requirements: action selection, pid requirement, readonly constraint, and default behavior. It does not detail the output shape, but it communicates enough for correct selection and basic invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema coverage is 100%, so the baseline is 3. The description mostly repeats information already in the schema property descriptions, such as pid being required for kill/info, filter narrowing by name/command, and the defaults for signal, sortBy, and limit. It adds little novel semantic meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses specific action verbs ('Lists, inspects, or terminates processes') and names the resource (processes on a remote server over SSH). It clearly distinguishes the three modes via the action parameter, making it immediately obvious what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for when each action is appropriate: list and info are read-only, kill mutates state, and kill is blocked on readonly servers. It states that pid is required for kill and info, but it does not explicitly compare this tool to sibling alternatives like ssh_execute.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_profileA

Manages SSH Manager profiles that bundle command aliases and hooks for different project types, affecting local configuration only with no remote side effects. The action selects behavior: list shows available profiles and the active one, current shows the active profile details, and switch activates a named profile and requires the profile argument. A successful switch reports that Claude Code must be restarted before the new profile takes effect.

ParametersJSON Schema
NameRequiredDescriptionDefault
actionYesAction to perform
profileNoProfile name (for switch)

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so well: it states the tool's local-only scope, no remote side effects, that switch requires a profile argument, and that a successful switch requires a Claude Code restart.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences, each earns its place: scope/safety, action semantics, post-switch behavior. No filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple enum-driven tool with no output schema, it describes what list/current return and what switch reports, plus side-effect scope. Nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds semantic meaning by explaining what each action does, and by specifically tying the profile parameter to the switch action as required.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Identifies a specific resource (SSH Manager profiles) and the concrete operations (list, current, switch), and immediately disambiguates from the remote-action sibling tools by stating local configuration only, no remote side effects.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Conveys clear context: use when working with project-type profiles, and explicitly warns that only local configuration is affected. Does not name alternatives or state when not to use, so it stops short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_service_statusA

Checks the running state of the named system services on a remote server by querying each one over SSH, returning JSON per service plus running and stopped counts and an aggregate health rating. Read-only: it inspects status without starting, stopping, or restarting anything. The services array parameter is required and lists the service names to check, for example nginx, mysql, or docker; common names are resolved to their actual unit names automatically.

ParametersJSON Schema
NameRequiredDescriptionDefault
serverYesServer name
servicesYesService names to check (e.g., nginx, mysql, docker)

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the behavioral disclosure burden and does well: it explicitly says the operation is read-only, describes the JSON response shape, counts, and health rating, and explains automatic name resolution. It doesn't cover error handling or authentication requirements, but the core behavior is transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three focused sentences: what it does and returns, its read-only safety guarantee, and essential parameter guidance. No filler or repetition of schema content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the operation, safety profile, parameter requirements, name resolution behavior, and return value shape, which is especially important given there is no output schema. Minor gaps like error behavior and how the server is identified are not fully addressed, but the agent has enough to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds real value by stating services is required, giving concrete examples, and explaining that common names are resolved to unit names automatically. This goes beyond the schema's simple 'Service names to check' description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool checks the running state of services over SSH and lists the key outputs. However, it does not explicitly distinguish itself from closely related siblings like ssh_process_manager or ssh_health_check.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes it clear this is for inspecting service status rather than changing it, so usage context is implied. But it does not explicitly state when to prefer this tool over alternatives or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_session_closeA

Terminates an open SSH session given its session ID, writing exit to the remote shell, ending it, and discarding its in-memory history and context; the session ID becomes unusable afterward. Destructive to session state but does not delete remote files. Passing the literal value all closes every active session at once, ignoring individual close errors. It does not drop the pooled underlying connection, only the interactive shell.

ParametersJSON Schema
NameRequiredDescriptionDefault
sessionYesSession ID to close (or "all" to close all sessions)

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations present, the description carries the full burden, and it delivers: it discloses destruction of session state, that remote files are not deleted, that 'all' closes every session while ignoring individual errors, and that the pooled underlying connection is retained. This is far beyond minimal disclosure for a mutating tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Every sentence adds a distinct, valuable fact: the core termination behavior, the destructive scope, the special 'all' semantics, and the pooled-connection nuance. There is no filler, and the most important information appears first.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter destructive action with no output schema, the description covers everything an agent needs to invoke it correctly: required input format, edge cases ('all'), side effects, and what it does not affect. The description is self-sufficient even though no return-value details are provided.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already covers the single parameter at 100%, including the special 'all' value. The description adds meaningful behavioral detail beyond the schema, such as the fact that 'all' ignores individual close errors and that the session ID becomes unusable afterward.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource: it terminates an SSH session by session ID, with details about writing exit, discarding history/context, and invalidating the ID. It clearly distinguishes itself from sibling tools like ssh_session_start, ssh_session_send, and ssh_session_list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes the tool's function obvious, but it does not explicitly state when to prefer this tool over alternatives or mention any exclusions. The use case is strongly impliedโ€”closing sessions started by ssh_session_startโ€”but the description does not spell out the relationship with sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_session_listA

Lists currently active SSH sessions with their ID, server, state, working directory, command count, age, idle time, and any defined variables. Read-only: it inspects in-memory session state and changes nothing on remote hosts or local config. The optional server argument is a case-insensitive substring filter on server name; omit it to list every active session. Closed sessions are excluded from the results.

ParametersJSON Schema
NameRequiredDescriptionDefault
serverNoFilter by server name

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations present, the description carries full responsibility and delivers: it states the operation reads in-memory session state, changes nothing on remote hosts or local config, and excludes closed sessions. This is exactly the behavioral context an agent needs to safely invoke an inspection tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each earning its place: the first defines the tool's output, the second establishes safety, and the third explains parameter behavior. Information is front-loaded and no words are wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter list tool with no output schema, this description is fully sufficient: it states return fields, filter semantics, read-only nature, and exclusion of closed sessions. Nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although the schema already documents server as 'Filter by server name' (100% coverage), the description adds crucial semantics: the parameter is optional, is a case-insensitive substring match, and omitting it lists all active sessions. This materially improves parameter understanding beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resourceโ€”'Lists currently active SSH sessions'โ€”and enumerates the exact fields returned, distinguishing it from sibling session-mutation and listing tools. No ambiguity about what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly conveys that this is a read-only inspection tool and explains how to use the optional server filter, including the omit-to-list-all behavior. It does not name explicit alternative tools for mutation, but the read-only framing tells an agent when not to use it, so the usage context is solid.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_session_sendA

Runs one command inside an already-open session identified by its session ID, reusing the persisted working directory, environment, and history of that shell. Mutates remote state like any shell command and is not idempotent; cd and export update the saved context for subsequent calls. Commands run through a bash-style shell (Unix-oriented). The security policy of the underlying server is enforced, so readonly or restricted servers may refuse. Default timeout is 30000 ms.

ParametersJSON Schema
NameRequiredDescriptionDefault
commandYesCommand to execute in the session
sessionYesSession ID from ssh_session_start
timeoutNoCommand timeout in milliseconds (default: 30000)

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden and does so thoroughly: it discloses mutation, non-idempotency, persistence of cd/export changes, bash-style Unix interpretation, potential refusal by readonly/restricted servers, and default timeout. This gives the agent a clear safety and side-effect profile.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but well-ordered: core purpose first, followed by side-effect warnings and operational constraints. The only slight redundancy is repeating the timeout default already present in the schema, but every other sentence adds valuable information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers purpose, prerequisites, side effects, shell behavior, security restrictions, and timeout, which is sufficient for invocation. It does not explain the return value or error format, and there is no output schema to compensate, so it is not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the schema documents all three parameters, so the baseline is 3. The description adds extra command-parameter semantics by explaining that commands reuse the session's persisted state and that cd/export mutate that state for later calls, which goes beyond the schema's terse 'Command to execute in the session.'

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description opens with a specific verb and resource: 'Runs one command inside an already-open session identified by its session ID.' It clearly distinguishes this from sibling one-shot tools by emphasizing the persisted session context, so an agent can identify what this tool is for.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly establishes the required context: the session must already be open and is identified by a session ID, implying use after ssh_session_start and not as a standalone execution tool. It does not explicitly name alternatives or exclusions, but the context is strong enough to guide selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_session_startA

Opens a new persistent interactive shell on the named configured server and returns a generated session ID. Stateful and side-effecting: it establishes (or reuses pooled) SSH connection and keeps an open shell that preserves working directory, environment, and command history across later ssh_session_send calls, unlike one-shot ssh_execute. The optional name is only a human label. The session stays open and consumes a remote shell until ssh_session_close is called.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNoOptional session name for identification
serverYesServer name from configuration

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It openly states that the tool is stateful, side-effecting, may reuse pooled connections, keeps an open shell, preserves working directory/environment/history, and consumes a remote shell until ssh_session_close is called. This is thorough and accurate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense, information-rich sentences with no redundancy. The core behavior is front-loaded, and every sentence adds value by covering statefulness, lifecycle, comparison to alternatives, and parameter semantics.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite no output schema, the description gives the key return value (generated session ID), defines the lifecycle, and warns that the session consumes resources until closed. Sufficient context is provided for an agent to select and invoke the tool successfully.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the parameters are already documented. The description adds meaningful context beyond the schema by explaining that 'server' refers to a named configured server and that 'name' is only a human label, which clarifies intent and prevents misuse.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb and resource: opens a new persistent interactive shell on a configured server and returns a session ID. It explicitly differentiates from one-shot ssh_execute, and the stateful, multi-call nature is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly conveys when to use this tool: when a persistent shell with preserved context across subsequent calls is needed, and contrasts it with ssh_execute. It could be slightly more explicit about when not to use it or when to choose other siblings, but the intended usage is strongly implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_syncA

Synchronizes files or directories between local and remote using rsync over SSH on the named server. Each of source and destination must carry a local: or remote: prefix and one side must be local and the other remote; with no prefix it assumes a push from local to remote. On Windows MCP hosts, provide native Windows local paths such as C:\project or .\project; the tool converts drive-letter and UNC paths to MSYS2 format before spawning rsync. Do not pre-convert a local path to /c/project because Node performs local filesystem checks using Windows path semantics. Mutates the destination. Setting delete true removes destination files absent from source, which is destructive; dryRun true previews without changing anything. Compression is on by default. Password authentication requires sshpass installed locally. Blocked on readonly or restricted servers. Timeout defaults to 30000 ms.

ParametersJSON Schema
NameRequiredDescriptionDefault
deleteNoDelete files in destination not in source
dryRunNoPerform dry run without actual changes
serverYesServer name from configuration
sourceYesSource path with a "local:" or "remote:" prefix. On Windows, use a native local path such as "local:C:\project" or "local:.\project"; do not pre-convert it to MSYS2 /c/... syntax.
excludeNoPatterns to exclude from sync
timeoutNoTimeout in milliseconds (default: 30000)
verboseNoShow detailed progress
checksumNoUse checksum instead of timestamp for comparison
compressNoCompress during transfer
destinationYesDestination path with a "local:" or "remote:" prefix. On Windows, use a native local path such as "local:C:\output" or "local:.\output"; do not pre-convert it to MSYS2 /c/... syntax.

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so thoroughly. It discloses that the tool mutates the destination, that delete true is destructive, that dryRun true is safe, that compression is on by default, that password auth requires sshpass, that it is blocked on readonly/restricted servers, and that the timeout defaults to 30000 ms.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but efficient, with the core purpose front-loaded and every subsequent sentence carrying operational or safety value. The Windows path warning is lengthy but essential, and no unnecessary fluff is present.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 10-parameter tool with no annotations and no output schema, the description covers path semantics, defaults, destructive behavior, auth requirements, and blocking conditions comprehensively. The only notable gap is that it does not describe the return value or result output, which would normally be helpful given the absence of an output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although schema coverage is 100%, the description adds significant meaning beyond the schema: local:/remote: prefix semantics, Windows native path requirements and the MSYS2 conversion warning, the no-prefix push assumption, and functional details for delete, dryRun, compress, and timeout defaults.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: synchronizes files or directories between local and remote using rsync over SSH on the named server. It clearly distinguishes this from one-way transfer siblings like ssh_upload and ssh_download by requiring local:/remote: prefixes and supporting bidirectional sync.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides strong usage context: both source and destination need prefixes, exactly one side must be local and the other remote, and a missing prefix assumes a push from local to remote. It also gives platform-specific path guidance and prerequisites like sshpass, though it does not explicitly name alternatives or when-not-to-use cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_tailA

Reads the tail of a remote log file on the named server, optionally filtered by a grep pattern. Read-only; it does not modify remote state. Behavior depends on follow, which defaults to true: in follow mode it starts a streaming tail whose output is written to the server process stderr rather than returned, and the response only reports a session note, so to capture content directly set follow to false to get the last N lines back. The lines parameter defaults to 10.

ParametersJSON Schema
NameRequiredDescriptionDefault
fileYesPath to the log file to tail
grepNoFilter lines with grep pattern
linesNoNumber of lines to show initially (default: 10)
followNoFollow file for new content (default: true)
serverYesServer name from configuration

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure โ€” and it delivers. It states the tool is read-only and does not modify remote state, and crucially reveals a non-obvious behavior: in follow mode (the default), output is written to server process stderr and the response only returns a session note, not content. It then tells the agent how to get content (set follow=false). This is exactly the kind of behavioral nuance a caller must know and could never infer from the schema alone.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose is front-loaded in the first sentence, and every sentence earns its place โ€” purpose, safety claim, behavioral mode explanation, and defaults. The third sentence is a long, multi-clause run-on that packs several facts (streaming, stderr destination, session-note response, follow=false alternative, lines default) into one dense stretch. It is information-dense rather than bloated, but it could be restructured into clearer discrete sentences for easier parsing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and no annotations, the description must explain return behavior โ€” and it does, telling the agent that follow mode yields only a session note while follow=false returns the last N lines. Defaults are disclosed. Minor gaps remain: no mention of error behavior (unknown server, missing file), no clarification of whether grep applies in follow mode, and no detail on what the session note references. These are secondary to the core call-and-interpret cycle, which is well covered.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds significant value on top: it explains that `follow` changes the entire output behavior (session note vs. returned lines) and that `lines` defaults to 10. It also reinforces `server` as a named configuration entry and `file` as the log path. The description does not merely echo schema text; it explains the behavioral consequences of the key parameter, which lifts it above baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Reads the tail of a remote log file on the named server, optionally filtered by a grep pattern.' This precisely states what the tool does and clearly differentiates it from siblings like ssh_execute, ssh_monitor, or ssh_db_query โ€” none of which tail log files. An agent can identify this tool's purpose without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The use case is clearly implied: tail a remote log file, with optional grep filtering. The description gives strong internal mode-selection guidance (set follow=false to capture content directly vs. follow=true for streaming). However, it never names alternative tools or states when NOT to use this tool, despite 35 siblings including monitoring-oriented tools (ssh_monitor, ssh_service_status, ssh_health_check) that an agent might confuse it with. The routing to siblings is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_tunnel_closeA

Tears down active SSH tunnels created earlier, freeing the bound local ports; this affects only local tunnel state, not the remote host. Exactly one of tunnelId or server must be supplied: tunnelId closes that single tunnel, while server closes every tunnel for the named server and reports how many were closed. Supplying neither raises an error. Closing is final and cannot be undone.

ParametersJSON Schema
NameRequiredDescriptionDefault
serverNoClose all tunnels for this server
tunnelIdNoTunnel ID to close

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full behavioral burden, and it does so thoroughly. It discloses that the operation is irreversible ('Closing is final and cannot be undone'), scoped to local state only, and that the server mode reports how many tunnels were closed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences convey the action, scope, parameter contract, error behavior, and irreversibility without any filler. The most important scoping information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter tool with no output schema and no annotations, the description is complete enough to invoke correctly: it explains what each parameter does, the exclusivity constraint, the error case, the local-only effect, and the destructive finality. An agent has sufficient information to decide when and how to call this tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although the schema already describes both parameters, the description adds critical semantics beyond the schema: the exact-one requirement, the difference between single-tunnel and server-wide closing, and the error condition when neither is supplied. This meaningfully helps an agent choose and populate the right parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific action ('Tears down active SSH tunnels') and a clear resource ('active SSH tunnels created earlier'), and immediately clarifies scope by saying it affects only local tunnel state and not the remote host. This distinguishes the tool from related SSH tools like ssh_tunnel_create and ssh_session_close without ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit parameter-selection rules: exactly one of tunnelId or server must be supplied, tunnelId targets one tunnel, server targets all tunnels for that server, and supplying neither raises an error. It provides clear operational context, though it does not explicitly name alternatives such as ssh_tunnel_list for discovering tunnel IDs.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_tunnel_createA

Opens a new SSH connection to the named server and starts a port-forwarding or SOCKS proxy tunnel that keeps running until closed. The type parameter selects local forward, remote forward, or dynamic SOCKS5 proxy. localPort is always required; remoteHost and remotePort are required for local and remote types but ignored for dynamic. localHost defaults to 127.0.0.1. Returns a tunnel ID used later to close it.

ParametersJSON Schema
NameRequiredDescriptionDefault
typeYesTunnel type
serverYesServer name or alias
localHostNoLocal host (default: 127.0.0.1)
localPortYesLocal port
remoteHostNoRemote host (not needed for dynamic)
remotePortNoRemote port (not needed for dynamic)

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the behavioral disclosure burden. It clearly states the tunnel 'keeps running until closed' and that a tunnel ID is returned for later closure, which are important side-effect and lifecycle traits. It does not mention authentication requirements or failure modes, but the core persistent behavior is transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise: three sentences with no redundant wording. It front-loads the core action, then efficiently covers mode selection, required vs. optional parameters, defaults, and return value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of annotations and output schema, the description covers the essential invocation details: operation, parameter rules, default values, and return value. It is slightly incomplete by not referencing the sibling close/list tools or noting authentication prerequisites, but it is sufficient for correct basic invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although the schema already has 100% description coverage, the tool description adds significant semantic value beyond it: it explains how 'type' selects among local, remote, and dynamic modes, that localPort is always required, that remoteHost/remotePort are conditionally required, and that localHost defaults to 127.0.0.1. This helps an agent construct valid invocations.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Opens a new SSH connection') and names the exact resource ('port-forwarding or SOCKS proxy tunnel'), clearly distinguishing this from generic SSH execution tools. It also explains the tunnel lifecycle and return value, leaving no ambiguity about what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for when to use the tool: when a persistent SSH tunnel is needed. It explains the three tunnel types and parameter requirements per type, but it does not explicitly name alternative sibling tools or state when not to use this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_tunnel_listA

Lists currently active SSH tunnels tracked by this process, showing each tunnel ID, server, type, state, local and remote endpoints, active and total connection counts, bytes transferred, error count, and timestamps. Read-only: it does not create, modify, or close anything. The optional server parameter filters results to one server; omit it to list every active tunnel across all servers.

ParametersJSON Schema
NameRequiredDescriptionDefault
serverNoFilter by server name

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description delivers important behavioral traits: it is read-only, does not create/modify/close anything, and only lists tunnels tracked by this process. It also specifies the exact data returned, though it does not cover potential side effects like error handling or resource limits, which are not critical for a simple list operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a compact, well-structured set of three sentences. It leads with the core purpose, lists the output fields, states the read-only nature, and explains the parameter. Every sentence adds value with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a list tool with one optional parameter, the description is complete: it identifies the resource, the filter, the output fields, and the read-only semantics. It doesn't mention pagination or output limits, but these are not essential for a simple listing operation and are not indicated by the presence of an output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already describes the 'server' parameter as a filter, but the description adds the nuance that it filters to one server and that omitting it lists all tunnels across servers. This clarifies the optional behavior beyond the schema's basic description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists active SSH tunnels tracked by the process, enumerating the specific fields returned. It distinguishes itself from sibling tools like ssh_tunnel_create and ssh_tunnel_close by being a read-only listing operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool (for inspecting active tunnels) and explicitly notes it is read-only, signaling not to use it for modifications. It does not name alternative tools directly, but the read-only statement and the presence of create/close siblings provide adequate context for an agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_uploadA

Uploads one local file to a remote destination path over SFTP on the named server, overwriting any existing remote file at that path. Mutates remote state and is not idempotent beyond replacing the target. Creates no backup. Requires the local file to exist. Does not use sudo, so the remote path must be writable by the configured SSH user. This tool is blocked entirely on servers set to readonly or restricted security mode. For directory trees use ssh_sync instead.

ParametersJSON Schema
NameRequiredDescriptionDefault
serverYesServer name
localPathYesLocal file path
remotePathYesRemote destination path

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It thoroughly covers side effects: 'overwriting any existing remote file,' 'mutates remote state and is not idempotent beyond replacing the target,' 'creates no backup,' and the no-sudo limitation. It also discloses security-mode blocking. This is exemplary transparency for a mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is largely efficient and front-loaded with the core action. However, there is mild redundancy: 'overwriting any existing remote file at that path' is restated by 'not idempotent beyond replacing the target.' Both convey the same overwrite behavior, so a sentence could be trimmed. Overall it remains compact and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a three-parameter mutation tool with no output schema and no annotations, the description supplies all critical operational context: prerequisites, destination writability, overwrite behavior, backup absence, security-mode restriction, and sibling routing. No essential information an agent needs to call this tool correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% but the descriptions are minimal (e.g., 'Local file path', 'Remote destination path'). The description adds meaningful semantics beyond that: localPath must reference an existing local file, remotePath must be writable by the configured SSH user, and the upload overwrites any existing remote file. This enriches the parameter meaning without overloading.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource: 'Uploads one local file to a remote destination path over SFTP on the named server.' It clearly distinguishes itself from siblings like ssh_download (opposite direction) and ssh_sync ('For directory trees use ssh_sync instead'). An agent can understand exactly what this tool does without ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly names the alternative (ssh_sync) and the condition that selects it: 'For directory trees use ssh_sync instead.' It also provides concrete usage constraints: the local file must exist, the remote path must be writable by the SSH user, and the tool is blocked on readonly/restricted servers. This gives clear when-to-use and when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 36 tool updatesv3.8.5
    • Changedssh_alert_setup1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_alias1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_backup_create1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_backup_list1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_backup_restore1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_backup_schedule1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_command_alias1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_connection_status1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_db_dump1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_db_import1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_db_list1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_db_query1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_deploy3 fields changed
      • removedInput schema / additionalProperties
        Removed value: -false
      • removedInput schema / properties / files / items / additionalProperties
        Removed value: -false
      • removedInput schema / properties / options / additionalProperties
        Removed value: -false
    • Changedssh_download1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_execute1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_execute_group1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_execute_sudo1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_group_manage1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_health_check1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_history1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_hooks1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_key_manage1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_monitor1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_process_manager1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_profile1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_service_status1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_session_close1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_session_list1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_session_send1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_session_start1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_sync1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_tail1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_tunnel_close1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_tunnel_create1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_tunnel_list1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedssh_upload1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
  2. 1 tool updatev3.8.0
    • Changedssh_sync2 fields changed
      • changedInput schema / properties / destination / description
        Previous value: -"Destination path (use \"local:\" or \"remote:\" prefix)"New value: +"Destination path with a \"local:\" or \"remote:\" prefix. On Windows, use a native local path such as \"local:C:\\output\" or \"local:.\\output\"; do not pre-convert it to MSYS2 /c/... syntax."
      • changedInput schema / properties / source / description
        Previous value: -"Source path (use \"local:\" or \"remote:\" prefix)"New value: +"Source path with a \"local:\" or \"remote:\" prefix. On Windows, use a native local path such as \"local:C:\\project\" or \"local:.\\project\"; do not pre-convert it to MSYS2 /c/... syntax."
  3. 1 tool updatev3.1.3
    • Changedssh_execute1 field changed
      • changedInput schema / properties / timeout / description
        Previous value: -"Command timeout in milliseconds (default: 30000)"New value: +"Command timeout in milliseconds (default: 120000, max: 300000)"
  4. 30 tool updatesv1.0.0
    • Addedssh_alert_setup
    • Addedssh_backup_create
    • Addedssh_backup_list
    • Addedssh_backup_restore
    • Addedssh_backup_schedule
    • Addedssh_connection_status
    • Addedssh_db_dump
    • Addedssh_db_import
    • Addedssh_db_list
    • Addedssh_db_query
    • Changedssh_execute1 field changed
      • addedInput schema / properties / timeout
        Added value: +{
        +  "description": "Command timeout in milliseconds (default: 30000)",
        +  "type": "number"
        +}
    • Addedssh_execute_group
    • Changedssh_execute_sudo1 field changed
      • addedInput schema / properties / timeout
        Added value: +{
        +  "description": "Command timeout in milliseconds (default: 30000)",
        +  "type": "number"
        +}
    • Addedssh_group_manage
    • Addedssh_health_check
    • Addedssh_history
    • Addedssh_key_manage
    • Changedssh_list_servers1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Addedssh_monitor
    • Addedssh_process_manager
    • Addedssh_service_status
    • Addedssh_session_close
    • Addedssh_session_list
    • Addedssh_session_send
    • Addedssh_session_start
    • Addedssh_sync
    • Addedssh_tail
    • Addedssh_tunnel_close
    • Addedssh_tunnel_create
    • Addedssh_tunnel_list
  5. 10 tool updates
    • First observedssh_alias
    • First observedssh_command_alias
    • First observedssh_deploy
    • First observedssh_download
    • First observedssh_execute
    • First observedssh_execute_sudo
    • First observedssh_hooks
    • First observedssh_list_servers
    • First observedssh_profile
    • First observedssh_upload

TDQS

A3.7/5.0
Disambiguation2/5

Several tools have overlapping purposes: ssh_execute and ssh_session_send both run commands; ssh_db_dump, ssh_backup_create, and ssh_db_import overlap on database backups/restores; ssh_monitor, ssh_health_check, and ssh_alert_setup all inspect CPU/memory/disk. The distinction between ssh_alias and ssh_command_alias is particularly confusing, and the agent may misselect among these without careful reading.

Naming Consistency4/5

All tools share the ssh_ prefix and mostly use a noun_verb (e.g., ssh_session_list, ssh_backup_create) or action_noun (ssh_execute_sudo, ssh_tunnel_create) pattern. Names are readable and consistent in style, though ssh_hooks, ssh_profile, and ssh_alias are less pattern-based than the others, and ssh_alias vs ssh_command_alias is a notable collision.

Tool Count2/5

37 tools is well above the 25-tool threshold for a heavy tool set. While an SSH manager may legitimately cover many subdomains, the set includes redundancies (e.g., db_dump vs backup_create, monitor vs health_check) and could be consolidated to around 25โ€“30 tools without losing functionality. The count feels bloated rather than tightly scoped.

Completeness3/5

The tool surface covers a wide range: sessions, execution, file transfer, deployment, tunnels, backups, databases, monitoring, and local configuration. However, there are notable gaps: no tools to add, update, or remove server definitions (only list_servers), no service start/stop/restart (only status), and no way to start or launch processes (only kill/list). These are common SSH operations and would require workarounds.

Maintenance

ActivityActive
ResponsivenessWithin a week

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    C
    maintenance
    Enables SSH remote access to servers through Claude, allowing users to execute commands, transfer files via SFTP, and manage multiple remote connections using natural language.
    12
    8
    MIT
  • A
    license
    Not graded
    quality
    Not graded
    maintenance
    Connects Claude to remote servers via SSH to execute commands, manage files, and browse directories. It allows users to add, edit, and switch between multiple server configurations through natural language conversations.
    -
  • -
    license
    Not graded
    quality
    Not graded
    maintenance
    Enables Claude Code to control remote servers via SSH for automated deployment, testing, and operations, including command execution and file transfer.
    4
    -

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/bvisible/mcp-ssh-manager'

If you have feedback or need assistance with the MCP directory API, please join our Discord server