mcp-remote-ssh
This server provides AI agents with full remote SSH control: persistent sessions, command execution, interactive shells, file transfer, port forwarding, and secret-safe environment variable handling.
Connect & manage sessions:
ssh_connect(password/key auth),ssh_list_sessions,ssh_close_sessionExecute commands:
ssh_execute(structured stdout/stderr/exit code),ssh_sudo_executeInteractive persistent shell: open, send, read, send control keys, wait for patterns/stabilization
SFTP file operations: upload, download, read, write, list remote directories
Port forwarding: create, list, and close SSH tunnels (local → remote)
Secret-safe env injection: load a local
.envfile, inject variables into sessions, and automatically redact secret values from all tool outputsSession transcripts: start/stop recording, retrieve transcript (text/JSONL), save to local file
Security features: secret redaction across execute/shell/read outputs, shell builtins to avoid process tree exposure, stdin-based exec injection
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@mcp-remote-sshssh to staging host and execute 'uptime'"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
mcp-remote-ssh
MCP server giving AI agents full SSH access -- persistent sessions, structured command output, SFTP file transfer, port forwarding, session transcript recording, and secret-safe environment variable injection with automatic output redaction.
Why this exists
Every other SSH MCP server is missing something: no password auth, no persistent sessions, no SFTP, no port forwarding, or no structured exit codes. This one has all of them -- plus the only MCP-level secret management that prevents AI agents from ever seeing your credentials.
Related MCP server: ssh-mcp
Secret-Safe Environment Variables
The problem: When an AI agent needs to use API tokens, passwords, or keys on a remote server, the standard approach exposes secrets in the LLM's context window. The agent either reads the secret file (now it's in the conversation) or runs echo $TOKEN and sees the value in the output.
The solution: ssh_load_env_file reads secrets from a local file on your machine, injects them into the remote SSH session, and registers them for automatic output redaction. The AI agent can use the variables freely -- every tool response is scrubbed before it reaches the LLM.
# Agent calls this -- file is read from YOUR machine, not the remote host
ssh_load_env_file(session_id="abc", file_path="~/.secrets/prod.env")
→ "Loaded 3 variables from local:~/.secrets/prod.env: API_TOKEN, DB_PASS, SECRET_KEY"
# Agent tries to echo the value -- redacted automatically
ssh_execute(session_id="abc", command="echo $API_TOKEN")
→ {"stdout": "***\n", "exit_code": 0}
# Agent dumps the environment -- all secret values scrubbed
ssh_execute(session_id="abc", command="env | grep API_TOKEN")
→ {"stdout": "API_TOKEN=***\n", "exit_code": 0}
# Agent reads a file containing a secret -- also redacted
ssh_read_remote_file(session_id="abc", remote_path="/etc/app/config")
→ "db_password=***\ndb_host=localhost\n"
# Normal commands work perfectly -- no over-redaction
ssh_execute(session_id="abc", command="uname -a")
→ {"stdout": "Linux server 6.1.0 ...", "exit_code": 0}How it works
┌─────────┐ ┌──────────────────────────────┐ ┌─────────────┐
│ LLM │ ←─JSON─ │ MCP Server (your machine) │ ──SSH─→ │ Remote Host │
│ (Agent) │ │ │ │ │
└─────────┘ │ 1. Reads ~/.secrets/prod.env│ └─────────────┘
│ 2. Parses KEY=VALUE pairs │
│ 3. Stores values in memory │
│ 4. Injects into SSH session │
│ 5. Redacts ALL tool output │
└──────────────────────────────┘Local file read -- the env file lives on your machine, never on the remote host
Shell injection via builtins -- uses
read -r VAR <<< 'value' && export VAR(no process tree exposure)Stdin-based exec injection --
ssh_executefeeds secrets via stdin to a bash wrapper, so they never appear in/proc/*/cmdlineAutomatic redaction -- every tool response (
ssh_execute,ssh_shell_send,ssh_shell_read,ssh_read_remote_file) is scrubbed before reaching the LLMLongest-first matching -- prevents partial-match corruption (e.g.,
abc123is replaced beforeabc)
Security properties
Threat | Mitigated? | How |
Secret in LLM context window | Yes | Output redaction replaces values with |
Secret in remote process tree (shell) | Yes | Shell builtins ( |
Secret in remote process tree (exec) | Yes | Secrets fed via stdin, never in |
LLM tries | N/A | File is local-only, doesn't exist on remote |
LLM tries | Yes | Output is redacted |
Encoded/transformed secret (base64) | No | Only literal matches are redacted |
MITM on first SSH connection | Accepted |
|
Host key policy
This server uses Paramiko's AutoAddPolicy — unknown host keys are accepted without prompting. This is intentional for QE/lab environments where hosts are ephemeral (Beaker, cloud instances, CI machines). The trade-off:
Pro: Zero-friction connections to newly provisioned machines
Con: Vulnerable to MITM on the very first connection to an unknown host
If you operate on untrusted networks, consider wrapping connections through a VPN or SSH bastion with pre-distributed host keys. A host_key_policy parameter may be added in a future release for strict environments.
Env file format
Standard .env format:
# Comments are ignored
API_TOKEN=your-secret-token
DB_PASSWORD="quoted values work"
SECRET_KEY='single quotes too'
export ALSO_WORKS=yesSession transcripts
Recording is off by default. Enable it per session when you need an audit log of what the agent actually ran — useful for bug reproductions and test campaigns.
# Start recording on connect
ssh_connect(host="lab.example.com", username="root", password="...", record=True)
# Or toggle later
ssh_start_recording(session_id="a1b2c3d4")
ssh_execute(session_id="a1b2c3d4", command="uname -a")
ssh_get_transcript(session_id="a1b2c3d4")
→ {"recording": true, "total_entries": 2, "transcript": "[12:01:02] --- connect: lab.example.com ---\n[12:01:05] $ uname -a\nLinux ...\n[exit 0]"}
ssh_save_transcript(session_id="a1b2c3d4", path="/tmp/lab-session.log")
ssh_stop_recording(session_id="a1b2c3d4")Execute/sudo output and shell send/read I/O are secret-redacted before they are recorded
Closing the session discards the in-memory transcript —
ssh_save_transcriptorssh_get_transcriptfirst
Installation
uvx mcp-remote-ssh # or: pip install mcp-remote-sshConfiguration
{
"mcpServers": {
"remote-ssh": {
"command": "uvx",
"args": ["mcp-remote-ssh"]
}
}
}Tools (24)
Connection
Tool | Description |
| Connect with password, key, or agent auth. Optional |
| List active sessions |
| Close a session and release resources |
Execution
Tool | Description |
| Run a command, returns |
| Run with sudo elevation |
Interactive Shell
Tool | Description |
| Open persistent shell (preserves cwd, env, processes) |
| Send text (with optional Enter) |
| Read current output buffer |
| Send Ctrl+C, Ctrl+D, etc. |
| Wait for a pattern or output to stabilize |
Secrets Management
Tool | Description |
| Load secrets from a local env file; values never returned to the LLM |
| Clear redaction registry (values become visible again) |
Transcripts
Tool | Description |
| Start recording execute/sudo/shell I/O for this session |
| Stop recording; transcript stays available until the session is closed |
| Return the transcript as text or JSONL ( |
| Write the transcript to a local file on the MCP host |
SFTP
Tool | Description |
| Upload local file to remote host |
| Download remote file to local machine |
| Read a remote text file |
| Write/append to a remote file |
| List directory with metadata |
Port Forwarding
Tool | Description |
| Create SSH tunnel (local -> remote) |
| List active tunnels |
| Close a tunnel |
Quick start
ssh_connect(host="server.example.com", username="admin", password="secret", record=True)
→ {"session_id": "a1b2c3d4", "connected": true, "recording": true}
ssh_load_env_file(session_id="a1b2c3d4", file_path="~/.secrets/prod.env")
→ "Loaded 2 variables: API_TOKEN, DB_PASS"
ssh_execute(session_id="a1b2c3d4", command="curl -H \"Authorization: Bearer $API_TOKEN\" https://api.example.com")
→ {"stdout": "{\"status\": \"ok\"}", "exit_code": 0} # token used but never visible
ssh_shell_open(session_id="a1b2c3d4")
ssh_shell_send(session_id="a1b2c3d4", data="cd /opt && make -j$(nproc)")
ssh_shell_wait(session_id="a1b2c3d4", pattern="$ ", timeout=600)
ssh_upload_file(session_id="a1b2c3d4", local_path="config.yaml", remote_path="/etc/app/config.yaml")
ssh_forward_port(session_id="a1b2c3d4", remote_port=5432, local_port=15432)Design
Built on Paramiko (SSH) + FastMCP (MCP protocol).
ssh_executeusesexec_command()for clean structured output with real exit codesWhen secrets are loaded,
ssh_executefeeds exports via stdin to abashwrapper, thenexecs the actual command -- secrets never appear in the process treessh_shell_*usesinvoke_shell()for persistent interactive sessionsAll blocking Paramiko calls run in
run_in_executorto stay asyncShell keeps a 500KB rolling buffer for
shell_readpollingSecret redaction uses longest-first string replacement across all output paths
Session transcripts are in-memory, off by default, and discarded when the session is closed
License
MIT
Available Tools
18 toolsssh_close_forwardA
Close a specific port forward.
Args: session_id: The session ID returned by ssh_connect. forward_id: The forward ID returned by ssh_forward_port.
Returns: Confirmation message.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | ||
| forward_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It states the action and the return value (confirmation message), but does not disclose potential side effects on the session or any prerequisites beyond the parameter origins.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is brief, front-loading the purpose, and then efficiently listing arguments and return. Every sentence is necessary and avoids redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with two straightforward parameters and an output schema (indicated), the description covers all essential information: what it does, how to get parameters, and what to expect as a result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description fully compensates by explaining each parameter's provenance: session_id comes from ssh_connect, forward_id from ssh_forward_port. This adds significant meaning beyond the schema's bare type declarations.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with 'Close a specific port forward,' clearly stating the action (close) and the resource (port forward). This distinguishes it from sibling tools like ssh_forward_port (open) and ssh_close_session (close session).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly details how to obtain the required parameters: session_id from ssh_connect and forward_id from ssh_forward_port. This provides clear usage context, but it does not explicitly state when not to use this tool or mention alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_close_sessionA
Close an SSH session and release all its resources (shell, SFTP, port forwards). WARNING: this kills any running processes in the session.
Args: session_id: The session ID returned by ssh_connect.
Returns: Confirmation message.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description provides critical behavioral context: it kills running processes and releases all resources. The warning about processes is explicitly stated. However, it does not describe whether the operation is synchronous or if there are any side effects beyond what is mentioned.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is brief and front-loaded: the first sentence states the main purpose, followed by a warning, then the parameter description. Every sentence adds value with no redundancy. It is well-structured for an AI agent to quickly understand.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (one parameter, no nested objects), the description covers key aspects: what it does, what it releases, the warning, the parameter source, and the return type. Output schema exists but is not shown; the description mentions a confirmation message. It feels complete for effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter, session_id, is described as 'The session ID returned by ssh_connect,' which adds valuable context beyond the schema's data type. Since schema coverage is 0%, this description compensates well. No other parameters exist.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool closes an SSH session and releases all resources, including shell, SFTP, and port forwards. It distinguishes from siblings like ssh_close_forward by specifying it closes the session itself. The warning about killing processes adds further specificity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not explicitly state when to use this tool versus alternatives, though the context from sibling names makes it somewhat clear. It lacks explicit exclusions or guidance on prerequisites. However, the purpose is evident from the name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_connectA
Connect to a remote host via SSH. Returns a session_id for use with all other tools. Supports password and key-based authentication.
Args: host: Hostname or IP address of the remote server. username: SSH username (default: root). password: Password for authentication. Leave empty for key-based auth. key_path: Path to SSH private key file. Leave empty for password auth. port: SSH port (default: 22). timeout: Connection timeout in seconds (default: 60).
Returns: Session info dict with session_id, host, and connection status.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | ||
| username | No | root | |
| password | No | ||
| key_path | No | ||
| port | No | ||
| timeout | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It covers authentication methods, parameter defaults, and return value structure. However, it lacks details on error handling, retry behavior, or potential side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a clear opening sentence, followed by an Args list and Returns section. Each sentence adds value, and the overall length is appropriate for the complexity of the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers purpose, all parameters, and return value. Given the presence of an output schema and moderate complexity, it is sufficiently complete. Minor omission of error conditions prevents a score of 5.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description provides comprehensive explanations for all 6 parameters, including defaults and usage hints (e.g., leave empty for key-based vs password auth). This adds significant value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Connect' and clearly states the tool's function to establish an SSH connection, returning a session_id for use with other SSH tools. This distinguishes it from sibling tools like ssh_execute or ssh_close_session.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage as the entry point for SSH operations by stating the session_id is for use with all other tools. However, it does not explicitly provide when-not-to-use scenarios or mention alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_download_fileA
Download a file from the remote host to the local machine via SFTP.
Args: session_id: The session ID returned by ssh_connect. remote_path: Path to the file on the remote host. local_path: Destination path on the local machine.
Returns: Confirmation message with file size.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | ||
| remote_path | Yes | ||
| local_path | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It explains SFTP usage and return type (confirmation with file size), but omits details like overwrite behavior, permissions, or error handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and structured with Args/Returns sections. A slight improvement could integrate Args into a single sentence, but no fluff is present.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple file download, the description covers basics: arguments and return. However, it lacks details like overwrite behavior and prerequisites (active session). With output schema present, return is partially covered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description adds clear semantics for each parameter, including session_id origin and path roles. This compensates well.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool downloads a file from remote to local via SFTP, using a specific verb and resource. It distinguishes from siblings like ssh_upload_file and ssh_read_remote_file.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. It doesn't mention when to prefer download over read or other transfer methods.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_executeA
Execute a command on the remote host and return structured output. Each call runs in an independent exec channel -- no state is shared between calls (use ssh_shell_* tools for persistent state).
Args: session_id: The session ID returned by ssh_connect. command: Shell command to execute. timeout: Maximum seconds to wait for the command to finish (default: 120).
Returns: Dict with stdout, stderr, and exit_code.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | ||
| command | Yes | ||
| timeout | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, but description discloses independent exec channel, no shared state, timeout default, and return structure (stdout, stderr, exit_code).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short paragraphs with front-loaded purpose, no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers purpose, parameters, return values, and tool distinction. Output schema exists, so return details are complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so description fully explains all three parameters: session_id, command, timeout with default value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear verb ('execute') and resource ('command on remote host'). Distinguishes from sibling ssh_shell_* tools for persistent state.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when not to use (for persistent state, use ssh_shell_* tools) and clarifies independent exec channels.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_forward_portA
Create an SSH port forward (local -> remote). Connections to 127.0.0.1:local_port will be tunneled through SSH to remote_host:remote_port.
If local_port is 0, a random available port is chosen.
Args: session_id: The session ID returned by ssh_connect. remote_port: Port on the remote side to forward to. local_port: Local port to listen on (0 = auto-assign). remote_host: Host on the remote side (default: localhost, i.e. the SSH server itself).
Returns: Dict with forward_id, local_port, remote_host, and remote_port.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | ||
| remote_port | Yes | ||
| local_port | No | ||
| remote_host | No | localhost |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description bears full burden. Describes connection tunneling and return value. Does not mention side effects or prerequisites (e.g., session must be active), but is reasonably transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with clear header, Args, and Returns sections. Every sentence adds value without redundancy. Appropriate length for a parameterized tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers purpose, all parameters, and return value. Lacks explicit mention of prerequisite (active SSH session via ssh_connect) but session_id parameter implies it. Overall sufficient for agent invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but the description thoroughly documents all 4 parameters in an Args section, including defaults and meaning. Adds critical semantic value beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states 'Create an SSH port forward (local -> remote)' and explains the tunneling behavior. Differentiates from siblings like ssh_close_forward, ssh_list_forwards by focusing on creation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides guidance on local_port=0 for auto-assignment. Implicitly suggests usage for port forwarding, but does not explicitly state when not to use or mention alternatives like ssh_execute.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_list_forwardsA
List all active port forwards for an SSH session.
Args: session_id: The session ID returned by ssh_connect.
Returns: List of forward info dicts.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It discloses that the tool lists active port forwards (read-only) and returns a list of forward info dicts. This is sufficient behavioral context for a simple listing operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: one sentence for purpose, plus structured Args/Returns. Every sentence adds value with no waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, output schema exists), the description adequately covers what it does, its input, and output. Sibling differentiation is clear from context. A small gap: no mention of error conditions (e.g., invalid session).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Even though schema description coverage is 0%, the description adds meaning beyond the schema by explaining session_id as 'The session ID returned by ssh_connect', clarifying its origin and necessity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'List all active port forwards for an SSH session', using a specific verb ('list') and resource ('active port forwards'). It distinguishes from sibling tools like ssh_forward_port (creates forwards) and ssh_close_forward (closes forwards).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage after ssh_connect (references session_id), but does not provide explicit when-to-use or when-not-to-use guidance nor alternatives. The usage context is clear enough for an experienced agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_list_remote_dirA
List files and directories at a path on the remote host via SFTP.
Args: session_id: The session ID returned by ssh_connect. remote_path: Directory path on the remote host (default: current directory).
Returns: List of dicts with name, size, modified timestamp, and is_dir flag.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | ||
| remote_path | No | . |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description bears the full burden. It discloses the method (SFTP) and return structure (list of dicts with name, size, timestamp, is_dir). It implicitly indicates a non-destructive read operation, but could explicitly state no side effects or safe to call.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise with clear sections (Args, Returns). Every sentence provides necessary information without redundancy. Ideal length for an MCP tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (2 params, output schema provided), the description is nearly complete. It covers parameters and return format. Could be improved by noting error conditions or path restrictions, but overall sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description adds meaning: it explains session_id as coming from ssh_connect, and remote_path with default '.' as current directory. This clarifies usage beyond the schema's type and default.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('List files and directories at a path') and the resource ('remote host via SFTP'). It distinguishes from sibling tools like ssh_download_file or ssh_read_remote_file by focusing on enumeration.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use or when-not-to-use guidance is provided. It does not mention prerequisites (e.g., session must be active) or alternatives among siblings. The description assumes the agent already knows the context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_list_sessionsA
List all active SSH sessions with their connection status and details.
Returns: List of session info dicts.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden but only states it lists sessions and returns data. It does not disclose whether the operation is read-only, any permissions needed, or side effects, though the tool is seemingly benign.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences with no wasted words. It front-loads the action and includes a return value specification, making it efficient and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (zero parameters, clear return type) and the existence of an output schema, the description is fully adequate. It covers all necessary context for an agent to understand and use the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has no parameters, and schema coverage is 100% by default. The description adds no parameter-specific meaning beyond what the schema provides, earning a baseline score of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states what the tool does: list all active SSH sessions with connection status and details. It distinguishes from sibling tools like ssh_list_forwards which list forwards, making its purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use or when-not-to-use guidance is provided. The use case is implied for viewing sessions, but there is no mention of alternatives or exclusions, meeting only the minimum viable standard.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_read_remote_fileA
Read a text file on the remote host and return its contents. For large files, use max_bytes to limit the amount read.
Args: session_id: The session ID returned by ssh_connect. remote_path: Path to the file on the remote host. max_bytes: Maximum bytes to read (default: 1MB). Set to 0 for no limit.
Returns: File contents as text.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | ||
| remote_path | Yes | ||
| max_bytes | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It explains the read-only nature, return of file contents, and behavior of max_bytes. It could mention error handling or encoding assumptions, but overall is transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured with an Args section and Returns. Every sentence adds value without repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of an output schema (though not shown), the description adequately explains the return value. It covers the necessary context for using the tool, though it could mention potential encoding issues or error conditions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite 0% schema description coverage, the description explains each parameter: session_id (from ssh_connect), remote_path (path), and max_bytes (limit, default 1MB, 0 for no limit). This fully compensates for the lack of schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it reads a text file on a remote host and returns its contents. It distinguishes from siblings like ssh_write_remote_file and ssh_download_file by naming the specific action and resource.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides guidance on using max_bytes for large files and mentions that session_id comes from ssh_connect. However, it does not explicitly state when not to use this tool or compare with alternatives like ssh_download_file for binary files.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_shell_openA
Open a persistent interactive shell on the SSH session. The shell preserves working directory, environment variables, and running processes across multiple send/read calls. Ideal for screen/tmux, long builds, etc.
If a shell is already open, this is a no-op (returns existing shell info).
Args: session_id: The session ID returned by ssh_connect. term: Terminal type (default: xterm). width: Terminal width in columns (default: 200). height: Terminal height in rows (default: 50).
Returns: Confirmation that the shell is open.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | ||
| term | No | xterm | |
| width | No | ||
| height | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, disclosure is thorough: describes idempotency (no-op if open), return value (confirmation), and that it preserves state. Could mention potential side effects but overall strong.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise with no unnecessary words. Well-structured: purpose first, then idempotency note, then clear Args/Returns sections.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given tool complexity, covers essential aspects: purpose, idempotency, parameter details, return value. With output schema available, description sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but description compensates by describing all parameters: session_id as return from ssh_connect, and defaults for term, width, height. Adds meaning beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it opens a persistent interactive shell that preserves state across calls, and explicitly distinguishes from siblings like ssh_execute by noting it's ideal for screen/tmux and long builds.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides context for when to use (persistent shells, long builds) and notes no-op behavior. However, lacks explicit guidance on when not to use or alternatives like ssh_execute for one-off commands.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_shell_readA
Read the current content of the interactive shell buffer. Use this to poll for output from long-running commands without sending anything.
Args: session_id: The session ID returned by ssh_connect. lines: Number of tail lines to return (default: 100).
Returns: Recent shell output (tail of buffer).
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | ||
| lines | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, but description covers key behaviors: it only reads, returns tail lines, and does not send input. No contradictions or missing destructive warnings.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Concise with clear Args/Returns structure. No unnecessary sentences; every part adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity, presence of output schema, and clear description of return value, the description is complete. No gaps identified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% but description adds meaningful detail: explains session_id is from ssh_connect, and lines controls tail lines with default 100. This compensates fully for the missing schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Explicitly states it reads the interactive shell buffer for polling output without sending anything, clearly distinguishing it from siblings like ssh_shell_send or ssh_shell_wait.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Specifies when to use (poll for output from long-running commands without sending anything). Does not explicitly list when-not or alternatives, but the context and sibling names provide implicit guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_shell_sendA
Send text to the interactive shell. By default appends Enter (newline) and waits briefly to capture output.
Args: session_id: The session ID returned by ssh_connect. data: Text to send to the shell. press_enter: Whether to append a newline after the text (default: True). wait: Seconds to wait for output after sending (default: 1.0). read_lines: Number of tail lines to return from the shell buffer (default: 100).
Returns: Recent shell output (tail of buffer).
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | ||
| data | Yes | ||
| press_enter | No | ||
| wait | No | ||
| read_lines | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It discloses key behaviors: appending Enter by default, waiting for output, and returning tail of buffer. However, it does not mention error handling, blocking behavior, or safety of special characters, which would strengthen transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is efficiently structured: a summary sentence followed by clear Args and Returns sections. Every sentence adds value without redundancy, and the front-loaded summary immediately conveys the tool's core action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 5 parameters, no annotations, and a presumed simple output schema, the description covers essential usage details. It explains behavior, parameters, and return value. However, it lacks specifics on output structure or potential blocking behavior, leaving minor gaps for a complete understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, but the description explains each parameter's purpose and default values (e.g., press_enter, wait, read_lines). This adds critical meaning beyond the raw schema, enabling correct parameter usage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Send text to the interactive shell', specifying the verb 'send' and resource 'interactive shell'. It differentiates from siblings like ssh_execute (non-interactive) and ssh_shell_read (read-only), making the tool's purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use for interactive shell sessions, contrasting with ssh_execute for non-interactive commands. However, it does not explicitly state when to avoid this tool (e.g., for non-interactive tasks) or mention prerequisites like an active session from ssh_connect.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_shell_send_controlA
Send a control character to the interactive shell. Common keys: "c" for Ctrl+C (interrupt), "d" for Ctrl+D (EOF), "z" for Ctrl+Z (suspend), "l" for Ctrl+L (clear screen), "a" for Ctrl+A (screen prefix).
Args: session_id: The session ID returned by ssh_connect. key: Single letter for the control key (e.g. "c" sends Ctrl+C).
Returns: Confirmation and recent shell output.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | ||
| key | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description bears full burden. It states sending control characters modifies shell state, lists common keys and their effects, and mentions return of confirmation and output. Lacks disclosure of potential disruptive side effects or error handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Highly concise and well-structured: purpose first, then key list, then args, then returns. Every sentence adds value with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers purpose, params, and returns. For a simple 2-param tool with output schema present, it is mostly complete. Could add notes on invalid keys or session handle validation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema coverage, description adds meaning: session_id is from ssh_connect, key is a single letter. Explicitly maps values to control characters, compensating well for missing schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specifies verb 'Send' and resource 'control character to the interactive shell'. Clearly distinguishes from sibling ssh_shell_send (which sends text) by focusing on control characters.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Lists common control keys with explanations, guiding when to use (e.g., Ctrl+C for interrupt). However, does not explicitly state when not to use or contrast with alternatives like ssh_shell_send.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_shell_waitA
Wait for the shell output to contain a specific pattern, or for the output to stabilize (no new output for two poll intervals). Useful for waiting on long-running commands to complete.
Args: session_id: The session ID returned by ssh_connect. pattern: Text pattern to wait for (e.g. a shell prompt like "$ " or "# "). If empty, waits for output to stabilize. timeout: Maximum seconds to wait (default: 300). poll_interval: Seconds between polls (default: 2.0). lines: Number of tail lines to return (default: 100).
Returns: Shell output when the pattern is found or output stabilizes.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | ||
| pattern | No | ||
| timeout | No | ||
| poll_interval | No | ||
| lines | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It discloses stabilization behavior (no new output for two poll intervals) and all parameters. It lacks details on timeout behavior (e.g., error vs empty result) but is otherwise transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded, stating the main purpose in the first sentence. Parameter details are listed cleanly with defaults. No unnecessary text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the core behavior and all parameters. With an output schema present (though not shown), the description appropriately omits detailed return format. It is complete for a wait tool, though missing edge-case handling (e.g., invalid session).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, so the description is essential. It explains every parameter: session_id (from ssh_connect), pattern (empty = wait for stabilize), timeout (max seconds), poll_interval, and lines (tail lines to return). This adds full semantic meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: waiting for shell output to contain a specific pattern or for output to stabilize. The verb 'wait' combined with the resource 'shell output' is specific and distinct from sibling SSH tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions it is 'useful for waiting on long-running commands to complete,' which implies a use case. However, it does not explicitly contrast with alternatives like ssh_shell_read or ssh_execute, nor does it provide when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_sudo_executeA
Execute a command with sudo on the remote host. If the user already has passwordless sudo, leave sudo_password empty.
Args: session_id: The session ID returned by ssh_connect. command: Shell command to execute under sudo. sudo_password: Password for sudo prompt (empty for passwordless sudo). timeout: Maximum seconds to wait (default: 120).
Returns: Dict with stdout, stderr, and exit_code.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | ||
| command | Yes | ||
| sudo_password | No | ||
| timeout | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without any annotations, the description transparently explains the tool's behavior: executing commands with sudo, requiring a session_id from ssh_connect, and outlining parameters and return values. It does not hide any inherent risks, though it could mention potential destructive impacts of commands, but it's not misleading.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured: a brief purpose sentence, a conditional note about passwordless sudo, an Args list, and Returns. Every sentence adds value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (4 parameters, output schema, part of a suite), the description covers all necessary information: parameter semantics, return structure, prerequisite session_id, and default timeout. The agent can confidently invoke the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description's Args section provides meaningful explanations for all four parameters: session_id, command, sudo_password, and timeout. This adds critical context beyond the schema's type and default values, enabling correct invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Execute a command with sudo on the remote host' with a specific verb (execute) and resource (command with sudo on remote host). It effectively distinguishes this from the sibling ssh_execute tool by specifying sudo involvement.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description includes guidance on when to leave sudo_password empty for passwordless sudo, which is useful. While it does not explicitly contrast with sibling tools like ssh_execute, the purpose implies usage when sudo privileges are needed, which is sufficient for an agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_upload_fileB
Upload a local file to the remote host via SFTP.
Args: session_id: The session ID returned by ssh_connect. local_path: Path to the file on the local machine. remote_path: Destination path on the remote host.
Returns: Confirmation message with file size.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | ||
| local_path | Yes | ||
| remote_path | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided. Description does not disclose behavioral traits such as overwrite behavior, permission requirements, or error handling for missing local files or full remote storage. Only mentions return of confirmation with file size.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Concise and well-structured with Args and Returns sections. Front-loaded with purpose. No unnecessary text, but could be more compact by omitting the 'Args:' header since schema already lists parameters.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given complexity (3 required params, no enums) and presence of output schema, description covers basic purpose and parameters but lacks usage context, behavioral details, and error conditions. Adequate but not thorough.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description adds meaning by explaining session_id comes from ssh_connect, local_path is on local machine, remote_path is destination. However, lacks detail (e.g., path formats, required existence). Partially compensates for schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states 'Upload a local file to the remote host via SFTP.' The verb 'Upload' is specific and the resource (local file to remote host) is unambiguous. Distinguishes from siblings like ssh_download_file, ssh_write_remote_file.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus siblings (e.g., ssh_write_remote_file). Does not mention prerequisites like needing an active session or alternative tools for different scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_write_remote_fileA
Write text content to a file on the remote host via SFTP.
Args: session_id: The session ID returned by ssh_connect. remote_path: Path to the file on the remote host. content: Text content to write. append: If True, append to existing file instead of overwriting (default: False).
Returns: Confirmation message with bytes written.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | ||
| remote_path | Yes | ||
| content | Yes | ||
| append | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; description covers parameters and return but fails to disclose potential destructive behavior (overwrite by default) or permissions needed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Structured with Args/Returns, but could be slightly more concise; no wasted words but a bit verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers parameters and return, but lacks details on file creation, error handling, or permissions. Output schema exists but not shown; still fairly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 0% description coverage; the description fully explains each parameter including default for append, adding significant value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the tool writes text content to a remote file via SFTP, distinguishing it from siblings like ssh_read_remote_file and ssh_upload_file.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Does not explicitly provide when-to-use or alternatives, but the purpose is clear; lacks guidance on distinguishing from ssh_upload_file for binary files.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
18 tool updates
v0.3.0- First observed
ssh_close_forward - First observed
ssh_close_session - First observed
ssh_connect - First observed
ssh_download_file - First observed
ssh_execute - First observed
ssh_forward_port - First observed
ssh_list_forwards - First observed
ssh_list_remote_dir - First observed
ssh_list_sessions - First observed
ssh_read_remote_file - First observed
ssh_shell_open - First observed
ssh_shell_read - First observed
ssh_shell_send - First observed
ssh_shell_send_control - First observed
ssh_shell_wait - First observed
ssh_sudo_execute - First observed
ssh_upload_file - First observed
ssh_write_remote_file
TDQS
Each tool targets a distinct operation: connection, execution, file transfer, shell interaction, port forwarding, and session management. No overlaps; even similar tools like ssh_execute and ssh_sudo_execute are clearly differentiated by the sudo aspect.
All tools follow the pattern `ssh_<verb>_<noun>`, with shell tools using `ssh_shell_<verb>` as a consistent sub-pattern. No mixed conventions or atypical naming.
18 tools cover the full scope of SSH remote management: connection, stateless and persistent execution, file operations, port forwarding, and session control. Each tool feels justified and the count is appropriate for the domain.
Core workflows are well covered (connect, execute, file transfer, shell, port forwarding). Minor gaps exist: no direct file delete/rename or directory creation tool, but these can be achieved via command execution. Overall, the surface is nearly complete.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
MCP server for building and testing AI agents with multi-model experimentation and insights.
MCP server connecting AI agents to 100+ apps (Gmail, Slack, Notion, GitHub) via one-click OAuth.
MCP server connecting AI agents to non-custodial staking data across 130+ networks.
MCP server for AI agents to plan, verify, and deploy Cloudflare-native apps.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceAn MCP server that gives AI assistants full SSH/SFTP remote operations — session management, command execution, interactive shells, file transfers, port forwarding, and system diagnostics.2MIT
- AlicenseAqualityCmaintenanceAn MCP server that gives AI agents SSH access to remote machines through your local OpenSSH client, enabling remote command execution, file transfer, persistent shell sessions, and port forwarding.1716MIT
- AlicenseNot gradedqualityDmaintenanceMCP server that enables AI agents to run fully interactive SSH sessions (via tmux) and execute commands like a human operator, with persistent sessions and multiple concurrent connections.6MIT
- AlicenseAqualityDmaintenanceSSH MCP is a Model Context Protocol tool for managing and interacting with multiple virtual machines over SSH. It simplifies executing commands on remote servers using the standard SSH config file format.44MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/faizbawa/mcp-remote-ssh'
If you have feedback or need assistance with the MCP directory API, please join our Discord server