ssh-mcp
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@ssh-mcprun 'df -h' on my webserver"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
ssh-mcp
An MCP server that gives AI agents SSH access to remote machines through your local OpenSSH client. It wraps ssh, scp, and rsync so agents can run remote commands, transfer files, maintain persistent shell sessions, set up port forwards, and read/edit/search remote files directly — all using your existing SSH config, keys, and credentials.
Why ssh-mcp?
Uses your local SSH — host aliases,
~/.ssh/config,ProxyJump, agent forwarding, and existing credentials all work naturally. No SSH libraries or key management.Native-feeling remote editing —
ssh_view/ssh_create/ssh_edit/ssh_grep/ssh_globmirror the read/edit/search tools agents already use locally, so remote files can be read, searched, and edited exactly like local ones instead of through ad hoccat/sed/grepcommands.Persistent sessions — agents can keep a shell open across multiple tool calls, just like a human would. Sessions survive context window resets when you give them a
session_name.Observable — every session records a transcript and optionally launches a detached tmux viewer so you can watch what the agent is doing in real time.
Permission-gatable — port forwarding is a separate tool from command execution, so MCP clients can allow SSH access without allowing port forwards.
Pure Python — no third-party runtime dependencies. Runs anywhere Python 3.10+ and OpenSSH are available.
Related MCP server: mcp-remote-ssh
Requirements
Python 3.10+
sshandscpon PATH (or setSSH_MCP_SSH_BIN/SSH_MCP_SCP_BIN)rsyncon PATH (or setSSH_MCP_RSYNC_BIN) — only needed forssh_syncgrepandfindon the remote host — needed forssh_grep/ssh_glob(present on effectively all POSIX systems)tmux— optional, for live session observation
Installation
With uv (recommended)
uvx --from slepp-ssh-mcp ssh-mcpOr install persistently:
uv tool install slepp-ssh-mcpWith pip
pip install slepp-ssh-mcpSetup
Claude Code
claude mcp add --transport stdio --scope user ssh-mcp -- uvx --from slepp-ssh-mcp ssh-mcpOr commit a .mcp.json to share with your team:
{
"mcpServers": {
"ssh-mcp": {
"type": "stdio",
"command": "uvx",
"args": ["--from", "slepp-ssh-mcp", "ssh-mcp"]
}
}
}Codex CLI
codex mcp add ssh-mcp -- uvx --from slepp-ssh-mcp ssh-mcpGitHub Copilot
Add to ~/.copilot/mcp-config.json (or .vscode/mcp.json per-project):
{
"mcpServers": {
"ssh-mcp": {
"type": "stdio",
"command": "uvx",
"args": ["--from", "slepp-ssh-mcp", "ssh-mcp"]
}
}
}Generic MCP client
Any stdio MCP client works. Point it at uvx --from slepp-ssh-mcp ssh-mcp or at a virtualenv's ssh-mcp entrypoint.
How it works
ssh-mcp runs as a stdio process that your MCP client spawns. It receives JSON-RPC tool calls and translates them into local ssh/scp/rsync commands. Because it uses your local SSH binary, everything in your ~/.ssh/config works — jump hosts, custom ports, key selection, SSH_AUTH_SOCK, proxy commands.
There are five modes of operation:
One-off commands (ssh_exec)
Run a command, get stdout/stderr/exit code back. Works like ssh host 'command'.
{
"target": "prod-web01",
"command": "systemctl status nginx",
"timeout": 10
}Use cwd to set the working directory, env to export variables, and tty: true for commands that need a terminal (like sudo with a password prompt). Note that tty merges stdout and stderr.
Interactive sessions (ssh_ensure_session + ssh_write_session + ssh_read_session)
For multi-step work, open a persistent shell. The agent writes commands and reads output just like typing in a terminal.
Start or reuse a session:
{
"target": "prod-web01",
"session_name": "deploy-api"
}Always use a descriptive session_name. It serves three purposes:
The agent can find the same session across multiple tool calls
The tmux observer window gets a human-readable name (e.g.,
ssh-mcp-prod-web01-deploy-api)A different agent or conversation can recover the session by name
Write a command:
{
"session_id": "a1b2c3d4e5f6",
"input": "cd /app && git pull\n",
"wait_seconds": 5
}Always include \n to press Enter. Use \u0003 for Ctrl-C, \u0004 for Ctrl-D. Set wait_seconds high enough for the command to produce output (default: 1 second).
Read more output:
{
"session_id": "a1b2c3d4e5f6",
"wait_seconds": 10
}Check pending_output_chars in the response — if non-zero, call again to drain the buffer.
Session lifecycle:
ssh_ensure_sessionis idempotent — call it at the start of each stepSessions auto-detect dead connections via SSH keepalive (~90 seconds)
Response includes
uptime_seconds,idle_seconds, andexit_reasonfor health monitoringUse
auto_close: truefor one-shot commands that should clean up when doneExited sessions are pruned from memory after 1 hour (5 minutes for
auto_close)cwd,env, andshellonly apply when creating a new session — they are ignored when reusing an existing one
File transfer (ssh_scp, ssh_sync)
Copy files between local and remote machines.
scp — simple file/directory copy:
{
"target": "prod-web01",
"direction": "upload",
"sources": ["/local/path/app.tar.gz"],
"destination": "/tmp/"
}For upload, sources are local paths and destination is remote. For download, it's reversed. The target parameter specifies the host — don't include the host in sources or destination.
rsync — incremental sync with --delete and --exclude:
{
"target": "prod-web01",
"direction": "upload",
"source": "./dist/",
"destination": "/var/www/app/",
"delete": true,
"exclude": ["*.log", ".git"]
}Remote file access (ssh_view, ssh_create, ssh_edit, ssh_grep, ssh_glob)
These mirror the read/edit/search tools agents use locally, but operate on files on the remote host — so remote editing feels the same as local editing instead of composing cat/sed/grep by hand over ssh_exec.
ssh_view — read a file or list a directory:
{
"target": "prod-web01",
"path": "/etc/nginx/nginx.conf"
}Returns content, size_bytes, and total_lines. Content is truncated at 20KB by default — pass view_range: [start, end] (1-based, inclusive; end: -1 means "to end of file") to page through large files, or force_read_large_files: true to read the whole thing anyway. If path is a directory, returns non-hidden entries up to 2 levels deep instead.
ssh_create — write a brand-new remote file:
{
"target": "prod-web01",
"path": "/etc/systemd/system/myapp.service",
"content": "[Unit]\nDescription=My app\n..."
}Fails if path already exists or its parent directory doesn't, exactly like the local file-creation tool.
ssh_edit — exact string replacement in an existing file:
{
"target": "prod-web01",
"path": "/etc/nginx/nginx.conf",
"edits": [
{"old_str": "worker_processes 1;", "new_str": "worker_processes auto;"}
]
}Each old_str must match exactly one location in the file (as it stands after any earlier edits in the same call) — ambiguous or missing matches fail without writing anything. Pass multiple {old_str, new_str} entries in edits to batch several changes into one round trip instead of one SSH connection per edit.
ssh_grep — search remote file contents:
{
"target": "prod-web01",
"pattern": "ERROR|WARN",
"path": "/var/log/myapp",
"glob": "*.log",
"output_mode": "content"
}output_mode is files_with_matches (default), content (matching lines, with line numbers and optional context/context_before/context_after), or count (per-file match counts; files with zero matches are omitted). Backed by remote grep, preferring PCRE-like -P when available and falling back to POSIX extended regex otherwise. Always skips .git/.hg/.svn.
ssh_glob — find remote files by name:
{
"target": "prod-web01",
"pattern": "src/**/*.ts",
"path": "/srv/app"
}Supports *, ?, [seq]/[!seq], {a,b} alternation, and ** (zero or more path segments). A path segment starting with . is only matched by a pattern segment that itself starts with ., matching classic Unix glob behavior.
All five tools raise a remote_file_error (see Tools reference) for problems like a missing path, a path that already exists, or an ambiguous/missing edit match — the on-the-wire outcome you'd expect from the equivalent local tool.
Port forwarding (ssh_forward)
Create local or remote port forwards. This is a separate tool from ssh_exec so MCP clients can grant SSH access without granting port forwarding.
Local forward — make a remote service reachable locally:
{
"target": "prod-web01",
"direction": "local",
"local_port": 15432,
"remote_host": "prod-db.internal",
"remote_port": 5432
}This binds localhost:15432 and tunnels it to prod-db.internal:5432 through prod-web01.
Remote forward — expose a local service on the remote host:
{
"target": "prod-web01",
"direction": "remote",
"local_port": 3000,
"remote_host": "localhost",
"remote_port": 8080
}Forwards bind to 127.0.0.1 by default. Set bind_address: "0.0.0.0" to expose on all interfaces (use with caution).
Use ssh_list_forwards to see active forwards and ssh_stop_forward to tear them down.
Watching sessions
Every interactive session records a transcript to ~/.local/state/ssh-mcp/<session_id>/transcript.log.
By default, sessions also launch a detached tmux window so you can watch in real time. The tmux session name includes the target and session name for easy identification:
# List ssh-mcp tmux sessions
tmux ls | grep ssh-mcp
# Attach to watch
tmux attach -t ssh-mcp-prod-web01-deploy-apiIf you prefer not to use tmux, set observer_mode: "transcript" and tail the transcript file directly — the response includes an observer_command you can copy-paste.
The tmux observer is tied to the session lifecycle: stopping a session closes its tmux window. The MCP server also cleans up tmux on shutdown.
Environment variables
Variable | Default | Description |
|
| Path to the SSH client |
|
| Path to the SCP client |
|
| Path to rsync |
|
| Path to tmux |
|
| Where transcripts are stored |
Security
ssh-mcp is designed for single-developer use on your own machine. It runs SSH commands as your user with your credentials.
What's protected:
Port forwarding flags (
-L,-R,-D,-W) and dangerous SSH options (ProxyCommand,LocalCommand,LocalForward,RemoteForward,DynamicForward) are blocked inextra_ssh_args. The only way to create forwards is through the explicitssh_forwardtool, which MCP clients can permission-gate.Transcript files are created with mode
0600and the state directory with0700.All command arguments use
shlex.quote()to prevent shell injection. Subprocess calls use list arguments, nevershell=True.Environment variable names are validated against
^[A-Za-z_][A-Za-z0-9_]*$.
What's not protected:
An agent with
ssh_execaccess can run arbitrary commands on any host your SSH config can reach. The security boundary is SSH itself (keys, known_hosts).Transcript files persist on disk after sessions end and may contain secrets (passwords typed at sudo prompts, API keys in output). Clean up
SSH_MCP_STATE_DIRwhen you no longer need them.The
shellparameter lets agents choose any remote executable. This is by design — the tool is for remote execution.
Known limitations
POSIX-only remotes —
cwd,env, andshellwrapping assumes a POSIX shell on the remote side. Windows SSH targets need commands written for their shell.PTY output — interactive sessions use a PTY, so output includes terminal formatting (ANSI escape codes, command echo, line wrapping). This is intentional — it matches what a human would see.
No multiplexing — each
ssh_execcall opens a new SSH connection. If your agent runs many rapid commands to the same host, consider using a session instead, or configureControlMasterin your~/.ssh/config.Transcript growth — transcripts grow without bound for long-running sessions. The response includes
transcript_size_bytesso you can monitor this. Restart the session if it gets too large.Forward connections are standalone — each
ssh_forwardopens its own SSH connection. Forwards are not tied to sessions.Remote file tools are text-oriented —
ssh_view/ssh_create/ssh_editdecode remote content as UTF-8 witherrors="replace"; binary files may come back with stray replacement characters. They're built for source/config files, like their local counterparts.ssh_editisn't fully atomic — it reads the file, applies edits locally, then writes the result back in a second SSH round trip. A concurrent external write between the two round trips could be overwritten, same class of risk as editing any file that's being modified elsewhere.ssh_grepregex flavor depends on the remote — it prefers PCRE-like-P(closer to what agents expect) when the remotegrep/ggrepsupports it, otherwise falls back to POSIX extended regex (-E), which lacks things like\d/\w/\b.multilinematching isn't supported.ssh_glob/ssh_greplist the whole subtree — matching happens after enumerating files underpathvia remotefind; scopepathto something reasonable on very large trees.
Tools reference
Tool | Description |
| Run a one-off remote command |
| Copy files via scp |
| Incremental sync via rsync |
| Read a remote file (with paging) or list a remote directory |
| Create a new remote file |
| Exact string replacement in an existing remote file |
| Search remote file contents |
| Find remote files by name pattern |
| Start a new interactive session |
| Reuse or start an interactive session (recommended) |
| Read output from a session |
| Write input to a session |
| Stop a session |
| List tracked sessions |
| Start a port forward |
| List tracked forwards |
| Stop a port forward |
All session and forward tools accept standard SSH connection parameters: port, identity_file, known_hosts_file, strict_host_key_checking, and extra_ssh_args. So do ssh_view, ssh_create, ssh_edit, ssh_grep, and ssh_glob.
Development
python3 -m pip install build
python3 -m unittest discover -s tests -v
python3 -m compileall src
python3 -m buildLicense
MIT. See LICENSE.
Available Tools
17 toolsssh_createA
Create a new remote file over SSH with the given content — the remote counterpart of the local file-creation tool. Fails if the path already exists (use ssh_edit to modify an existing file) or if the remote parent directory doesn't exist.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Absolute (or login-directory-relative) remote path to create. Must not already exist. | |
| port | No | ||
| target | Yes | OpenSSH target such as host, alias, or user@host. | |
| content | Yes | Full content to write to the new file. | |
| timeout | No | Local timeout in seconds. | |
| identity_file | No | ||
| extra_ssh_args | No | Additional ssh(1) flags passed verbatim, e.g. ["-J", "jumphost"]. Prefer the dedicated port, identity_file, and strict_host_key_checking parameters. | |
| known_hosts_file | No | ||
| strict_host_key_checking | No | Boolean or one of yes, no, ask, accept-new, off. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It transparently states the two key failure modes: fails if the path already exists and fails if the parent directory doesn't exist. This goes beyond minimal disclosure and addresses the most likely risks for a file-creation operation. However, it does not mention authentication/session preconditions or return behavior, leaving some gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences: the first states the primary purpose and orientation, the second gives essential failure conditions and the alternative tool. No redundancy, clearly front-loaded, every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description thoroughly covers the core create operation and its main failure conditions, and it differentiates from ssh_edit. However, for a tool with 9 parameters and no output schema or annotations, it leaves out several pieces of context: how it interacts with SSH sessions (sibling tools ssh_start_session, ssh_ensure_session exist), how it differs from file-transfer tools like ssh_scp or ssh_sync, and what the tool returns on success. This is not fully complete, but it is adequate for the primary use case.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 67% (6 of 9 params described), which is moderate. The description adds meaningful context for the 'path' parameter by specifying it must not already exist and its parent directory must exist, and it clarifies 'content' as the full content to write. However, it does not explain the remaining parameters (port, identity_file, known_hosts_file, extra_ssh_args, timeout, strict_host_key_checking) beyond what the schema already provides. Baseline 3 is appropriate for this moderate coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Create'), the resource ('a new remote file'), and the method ('over SSH'). It explicitly distinguishes from ssh_edit, which is the primary sibling alternative, and also references the local file-creation tool as a counterpart. This satisfies the specific verb+resource+scope requirement.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit when-to-use context: use this for creating a new remote file, not for modifying an existing one (use ssh_edit instead). It also provides a critical precondition (parent directory must exist) and a failure condition (path already exists). This is direct, actionable guidance for an AI agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_editA
Replace exact text in an existing remote file over SSH — the remote counterpart of the local file-editing tool. Each edit's 'old_str' must match exactly one location in the file (as it stands after any earlier edits in the same call); ambiguous or missing matches fail without writing anything. Provide multiple {old_str, new_str} entries in 'edits' to batch several changes to the same file into a single read-then-write round trip instead of one SSH round trip per edit.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Absolute (or login-directory-relative) remote path. Must already exist as a regular file. | |
| port | No | ||
| edits | Yes | One or more replacements, applied in order against the file's current remote content. | |
| target | Yes | OpenSSH target such as host, alias, or user@host. | |
| timeout | No | Local timeout in seconds. | |
| identity_file | No | ||
| extra_ssh_args | No | Additional ssh(1) flags passed verbatim, e.g. ["-J", "jumphost"]. Prefer the dedicated port, identity_file, and strict_host_key_checking parameters. | |
| known_hosts_file | No | ||
| strict_host_key_checking | No | Boolean or one of yes, no, ask, accept-new, off. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the behavioral burden. It transparently discloses critical behavior: each old_str must match exactly one location, edits are applied in order, and ambiguous or missing matches fail without writing anything. It also explains the read-then-write batching behavior, which is useful beyond the schema. It does not mention permissions or backup behavior, but the core mutation semantics are well disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences long, front-loaded with the core action, and every sentence contributes: the first states purpose, the second explains safety guarantees, and the third gives batching rationale. There is no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given nine parameters, no annotations, and no output schema, the description covers the operation's main semantics well: exact matching, atomicity on failure, sequential edits, and batching efficiency. It does not describe return values or file permission implications, which are not strictly required but would round out completeness. Overall, it provides enough context for an agent to select and invoke the tool safely.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 67%, leaving port, identity_file, and known_hosts_file undocumented. The description compensates by adding meaningful semantics to the 'edits' parameter: uniqueness requirement, sequential application, and batching benefit. It also adds guidance to prefer dedicated port/identity_file/strict_host_key_checking parameters over extra_ssh_args. This adds value beyond the schema, though some standard SSH parameters remain thin.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb+resource: 'Replace exact text in an existing remote file over SSH', making the purpose unmistakable. It also distinguishes itself from siblings by labeling it the 'remote counterpart of the local file-editing tool,' which clearly separates it from other SSH operations like exec, scp, or view.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear usage context: use for exact-text replacement in remote files and batch multiple edits to avoid multiple SSH round trips. It does not name explicit alternative tools for cases like fuzzy edits or complete file rewrites, but the guidance is otherwise clear and actionable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_ensure_sessionA
Return an existing running SSH session or start a new one. This is the recommended tool for agent workflows — always provide a descriptive session_name so the session can be reliably found across tool calls and conversations. When a session is reused (reused=true in response), the cwd, env, and shell parameters are ignored — they only apply when creating a new session. Check 'created' vs 'reused' in the response to know which happened.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Remote directory to cd into (only when creating a new session). | |
| env | No | Remote environment variables (only when creating a new session). | |
| port | No | ||
| shell | No | Remote shell executable (only when creating a new session). | |
| target | Yes | OpenSSH target such as host, alias, or user@host. | |
| auto_close | No | When true, the session is automatically cleaned up after the remote shell or command exits. Only applies when creating a new session. Default: false. | |
| session_name | No | Stable name for this session, used for recovery and reuse across tool calls. Choose a short, descriptive kebab-case name reflecting the task, e.g. 'deploy-staging', 'tail-api-logs', 'debug-worker-3'. This name also appears in tmux session listings for human observers. Strongly recommended for any multi-step workflow. | |
| wait_seconds | No | Seconds to wait for initial output. Default: 1.0. | |
| identity_file | No | ||
| observer_mode | No | Observer mode to ensure on the reused or newly created session. Defaults to 'tmux' and falls back to transcript-only observation if tmux is unavailable. | |
| extra_ssh_args | No | Additional ssh(1) flags passed verbatim, e.g. ["-J", "jumphost"]. Prefer the dedicated port, identity_file, and strict_host_key_checking parameters. | |
| known_hosts_file | No | ||
| max_output_chars | No | ||
| strict_host_key_checking | No | Boolean or one of yes, no, ask, accept-new, off. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It transparently explains the reuse-ignore semantics and the response status distinction, which are essential for correct usage. It does not mention potential side effects like tmux creation or auth behavior, but the core get-or-create behavior is well disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact, front-loaded with the primary purpose, and then provides essential usage and behavioral notes in three sentences. Every sentence adds value; there is no fluff or repetition of schema details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 14 parameters and a get-or-create workflow, the description covers the most critical contextual points: session naming for reliability, the reuse behavior, and the response interpretation. It does not enumerate every parameter (schema does that), but it gives the agent enough context to use the tool correctly in a multi-step workflow.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 71%, and the description adds crucial semantics beyond the schema: it names the specific parameters (cwd, env, shell) that are ignored on reuse and explains their scope (only apply when creating). This directly compensates for potential ambiguity in the schema and helps the agent reason about parameter relevance per call.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a precise verb and resource: 'Return an existing running SSH session or start a new one.' It clearly distinguishes this get-or-create tool from sibling tools like ssh_list_sessions and ssh_start_session by framing its role as the recommended session management entry point for agent workflows.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use it ('recommended tool for agent workflows') and provides actionable guidance: always provide a descriptive session_name. It also clarifies the critical conditional behavior—when a session is reused, cwd/env/shell are ignored—and instructs the agent to check the 'created' vs 'reused' response field to know which case occurred.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_execA
Run a one-off remote SSH command and return stdout, stderr, and exit metadata. The command runs in a non-interactive context. Use 'cwd' and 'env' for remote directory and environment setup (requires a POSIX shell on the remote). For interactive or long-running commands, use ssh_ensure_session instead.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Remote directory to cd into before running the command. | |
| env | No | Remote environment variables exported before the command runs. | |
| tty | No | Request a remote TTY (ssh -tt). Required for interactive commands (sudo with password prompt, etc.). Avoid for scripted commands: stdout and stderr are merged and ANSI escape codes will be present in output. Default: false. | |
| port | No | ||
| shell | No | Remote shell executable used to wrap the command when shell/cwd/env behavior is needed. | |
| target | Yes | OpenSSH target such as host, alias, or user@host. | |
| command | Yes | Remote command string to execute. | |
| timeout | No | Local timeout in seconds. | |
| identity_file | No | ||
| extra_ssh_args | No | Additional ssh(1) flags passed verbatim, e.g. ["-J", "jumphost"]. Prefer the dedicated port, identity_file, and strict_host_key_checking parameters. | |
| known_hosts_file | No | ||
| strict_host_key_checking | No | Boolean or one of yes, no, ask, accept-new, off. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses non-interactive behavior, the POSIX shell requirement, and that stdout/stderr/exit metadata are returned. However, it omits potential side effects of arbitrary command execution, authentication behaviors, and timeout handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three concise sentences: the first states the purpose and output, the second gives parameter guidance, and the third provides an alternative. Front-loaded and free of redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (12 parameters, no output schema), the description provides a good overview but does not fully specify return structure, timeout behavior, or edge cases. It explains enough to start using the tool, but the schema and sibling context are needed for complete understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers 75% of parameters with descriptions, so the baseline is 3. The description adds value by mentioning cwd and env, but does not compensate for the missing port, identity_file, and known_hosts_file descriptions. Those names are self-explanatory in an SSH context, so the marginal contribution is modest.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool runs a one-off remote SSH command and returns stdout, stderr, and exit metadata. This specific verb and resource distinguish it from sibling session-management tools like ssh_ensure_session and ssh_start_session.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly notes the non-interactive context and directs users to ssh_ensure_session for interactive or long-running commands. It also provides guidance on using cwd/env and the POSIX shell requirement, giving clear when-to-use and alternative instructions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_forwardA
Start a dedicated SSH port forward (local or remote). This is a separate tool from ssh_exec/ssh_start_session so MCP clients can permission-gate port forwarding independently. Use direction 'local' to make a remote service reachable on a local port, or 'remote' to expose a local service on the remote host.
| Name | Required | Description | Default |
|---|---|---|---|
| port | No | ||
| target | Yes | OpenSSH target such as host, alias, or user@host. | |
| direction | Yes | Forward direction. 'local' binds a local port that tunnels to a remote host:port. 'remote' binds a remote port that tunnels back to a local host:port. | |
| local_port | Yes | Port on the local side. | |
| remote_host | Yes | Destination host from the SSH server's perspective. | |
| remote_port | Yes | Destination port. | |
| bind_address | No | Address to bind on. Default: 127.0.0.1. Set to 0.0.0.0 to expose on all interfaces (use with caution). | |
| identity_file | No | ||
| extra_ssh_args | No | Additional ssh(1) flags passed verbatim, e.g. ["-J", "jumphost"]. Prefer the dedicated port, identity_file, and strict_host_key_checking parameters. | |
| known_hosts_file | No | ||
| strict_host_key_checking | No | Boolean or one of yes, no, ask, accept-new, off. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It explains the direction semantics but omits critical operational details: whether the forward is long-running, whether it blocks, how it can be stopped (the sibling ssh_stop_forward is not mentioned), authentication requirements, or failure modes. This is a significant gap for a tool that starts a persistent process.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences, all information-dense and front-loaded. The first sentence states the core purpose, the second explains the permission-gating differentiation, and the third provides actionable direction guidance. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a complex tool with 11 parameters, no output schema, and no annotations. The description covers the core concept and direction semantics, but lacks essential context about return values, long-running behavior, prerequisites, and how to manage the forward after creation. Given the complexity, the description is incomplete and leaves too much to inference.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 73%, so the baseline is 3. The description adds meaningful context for the 'direction' parameter with detailed usage examples, but it does not clarify the undocumented parameters (port, identity_file, known_hosts_file). It adds some value beyond the schema but does not fully compensate for the missing parameter documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Start a dedicated SSH port forward (local or remote)', which is a specific verb+resource pairing. It explicitly distinguishes itself from ssh_exec/ssh_start_session by noting it enables permission-gating for port forwarding, clearly separating it from sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit context on when to use this tool via the permission-gating rationale, and gives concrete direction guidance ('Use direction 'local' to make a remote service reachable on a local port, or 'remote' to expose a local service on the remote host'). It doesn't explicitly mention exclusions relative to other forward-related tools like ssh_list_forwards/ssh_stop_forward, but the primary usage context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_globA
Find remote files by name pattern over SSH — the remote counterpart of the local filename-pattern tool. Supports '', '?', '[seq]'/'[!seq]', '{a,b}' alternation, and '' for matching across multiple path segments (e.g. 'src//.ts'). A path segment starting with '.' is only matched by a pattern segment that itself starts with '.'. Enumerates under 'path' via remote find, skipping .git/.hg/.svn; matching is done locally.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Remote base directory to search under. Default: '.' (the SSH login directory). | |
| port | No | ||
| target | Yes | OpenSSH target such as host, alias, or user@host. | |
| pattern | Yes | Glob pattern to match, relative to 'path', e.g. '**/*.ts' or '*.{ts,tsx}'. | |
| timeout | No | Local timeout in seconds. | |
| head_limit | No | Cap the number of returned matches. | |
| identity_file | No | ||
| extra_ssh_args | No | Additional ssh(1) flags passed verbatim, e.g. ["-J", "jumphost"]. Prefer the dedicated port, identity_file, and strict_host_key_checking parameters. | |
| known_hosts_file | No | ||
| strict_host_key_checking | No | Boolean or one of yes, no, ask, accept-new, off. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations present, the description carries the full burden of behavioral disclosure. It adds valuable details beyond the name: enumerates via remote find, skips .git/.hg/.svn directories, performs matching locally, and explains the dot-file matching rule. It does not mention potential performance implications or return format, but the disclosed behavior is substantial.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences and front-loads the primary purpose. Every sentence adds distinct value: purpose, pattern syntax, and behavioral details (VCS skipping, local matching, dot rule). There is no filler or redundant repetition of schema fields.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 10 parameters, no annotations, and no output schema, the description covers the key behavioral aspects: matching semantics, base directory, and VCS exclusion. It does not explicitly state the return format, but that is inferred from 'Find'. The description is largely sufficient for an agent to decide when to invoke it and how to construct patterns.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 70%, and the description adds significant meaning beyond the schema. It explains the glob pattern syntax ('*', '?', '[seq]', '{a,b}', '**'), the special dot-segment matching rule, and clarifies that enumeration happens under 'path'. This goes well beyond the schema's simple 'Glob pattern to match' and 'Remote base directory to search under.'
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Find remote files by name pattern over SSH' with the specific verb 'Find' and resource 'remote files'. It also differentiates itself by calling itself 'the remote counterpart of the local filename-pattern tool,' distinguishing it from other SSH operations like exec or scp.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context that this is the remote counterpart to a local filename-pattern tool, implying it should be used when you need to find files by name pattern over SSH. However, it does not explicitly mention when not to use it or name alternative sibling tools (e.g., ssh_grep), so it stops short of full when/when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_grepA
Search remote file contents over SSH — the remote counterpart of the local content-search tool. Backed by remote grep (PCRE-like -P when available, otherwise POSIX extended regex), recursing under 'path' while skipping .git/.hg/.svn. Defaults to 'files_with_matches' mode for efficiency; use 'content' mode for matching lines with line numbers and optional context.
| Name | Required | Description | Default |
|---|---|---|---|
| glob | No | Glob filter for which filenames to search, e.g. '*.py' or '*.{ts,tsx}'. | |
| path | No | Remote file or directory to search. Default: '.' (the SSH login directory). | |
| port | No | ||
| target | Yes | OpenSSH target such as host, alias, or user@host. | |
| context | No | Lines of context before and after each match. Only applies to output_mode='content'. | |
| pattern | Yes | Regular expression to search for. | |
| timeout | No | Local timeout in seconds. | |
| head_limit | No | Cap the number of returned matches/files. | |
| output_mode | No | 'content': matching lines with line numbers (supports context). 'files_with_matches': just the matching paths (default). 'count': per-file match counts (files with zero matches are omitted). | |
| context_after | No | Lines of context after each match. Overridden by 'context' if both are given. | |
| identity_file | No | ||
| context_before | No | Lines of context before each match. Overridden by 'context' if both are given. | |
| extra_ssh_args | No | Additional ssh(1) flags passed verbatim, e.g. ["-J", "jumphost"]. Prefer the dedicated port, identity_file, and strict_host_key_checking parameters. | |
| case_insensitive | No | Case-insensitive search. Default: false. | |
| known_hosts_file | No | ||
| strict_host_key_checking | No | Boolean or one of yes, no, ask, accept-new, off. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It reveals regex flavor (PCRE-like -P fallback to POSIX ERE), directory skipping (.git/.hg/.svn), and default output mode. This adds meaningful context beyond the schema, though it omits details like SSH authentication behavior or error handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, tightly packed with essential information. Front-loaded with purpose, then key behavioral traits. No filler or redundancy; every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 16-parameter tool with no output schema and no annotations, the description covers the core behavior well: purpose, regex variant, recursion behavior, and output modes. It does not elaborate on SSH-specific parameters like identity_file or strict_host_key_checking, but those are adequately described in the schema and are secondary to the tool's core function.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 81%, so the baseline is 3. The description goes beyond the schema by explaining regex semantics (PCRE vs POSIX), the meaning of 'path' recursion and skipped directories, and the default output mode. These details help the agent understand parameter behavior more deeply.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Search remote file contents over SSH'. It distinguishes itself as 'the remote counterpart of the local content-search tool', making its role unambiguous and differentiating it from sibling tools like ssh_glob.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context that this is the remote search counterpart, implying use when remote content search is needed. Offers in-tool guidance about defaulting to files_with_matches for efficiency and using content mode for line details. However, it does not explicitly exclude alternatives or mention when not to use this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_list_forwardsA
List tracked SSH port forwards with their forward_id, direction, ports, target, and running status.
| Name | Required | Description | Default |
|---|---|---|---|
| target | No | Filter by SSH target. | |
| include_stopped | No | Include forwards that have exited. Default: false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It notes that only 'tracked' forwards are listed and includes 'running status', which conveys state reporting. However, it does not explicitly state that this is a non-mutating read operation or disclose any prerequisites or side effects, which would strengthen transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence of 16 words, efficiently front-loaded with the verb and resource, and then listing the key output fields. Every word contributes value with no fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the absence of an output schema, the description compensates by enumerating the returned fields. However, it does not specify the return format (e.g., array vs. object) or the exact behavior of include_stopped beyond the schema. For a simple list tool, this is adequate but has minor gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage for its two parameters (target and include_stopped), so the baseline is 3. The description does not add further parameter semantics; it merely lists 'target' as an output field, which could be slightly confusing but is not harmful.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'List tracked SSH port forwards', a clear verb+resource combination. It enumerates the specific output fields (forward_id, direction, ports, target, running status), distinguishing it from sibling tools like ssh_forward and ssh_stop_forward.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly implies usage for listing forwards, but it does not explicitly state when to choose this tool over alternatives such as ssh_forward or ssh_stop_forward. There is no mention of when not to use it or any exclusions, leaving usage as implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_list_sessionsA
List tracked SSH sessions with their session_id, session_name, target, state, uptime, and observer details (including tmux_session_name for cross-referencing with tmux ls). Use session_name filter to find a specific named session.
| Name | Required | Description | Default |
|---|---|---|---|
| target | No | Filter by SSH target. | |
| session_name | No | Filter by session name. | |
| include_exited | No | Include sessions that have exited. Default: true. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden. The verb 'List' implies a read-only operation, and the description details the return fields, including 'tmux_session_name for cross-referencing with tmux ls,' which is a useful behavioral hint. It does not mention default values like include_exited=true, but the schema covers that.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with the verb and resource front-loaded. Every clause adds value: the list of return fields and the cross-referencing hint. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is a simple list operation with three optional parameters fully described in the schema. The description explicitly enumerates the output fields, compensating for the lack of an output schema, and adds a practical cross-referencing note. This is complete for the tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all three parameters. The description's only added semantic value is the tip about using session_name to find a specific named session, which is a minor usage nuance rather than a meaningful semantic expansion.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's verb ('List') and resource ('tracked SSH sessions'), specifies the exact fields returned, and distinguishes it from sibling tools that operate on sessions (stop, exec, read, edit, etc.). The mention of 'session_id, session_name, target, state, uptime' adds specificity that makes the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides a clear usage tip: 'Use session_name filter to find a specific named session.' This gives practical guidance on when to use the filter. However, it does not explicitly contrast with sibling tools or state when not to use this tool, so it stops short of full usage differentiation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_read_sessionA
Read unread output from a tracked SSH session. Set wait_seconds (e.g. 1-10) to block until new output arrives; 0 returns immediately with whatever is buffered right now. Default: 1.0. If 'truncated' is true or 'pending_output_chars' > 0, call again to drain remaining output. Check 'running' to know whether the session is still alive.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | ||
| wait_seconds | No | Seconds to wait for new output. Default: 1.0. Set higher (5-10) for slow commands. Set 0 for instant polling. | |
| max_output_chars | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description discloses blocking behavior, default wait time, and the meaning of output flags. It also mentions the 'running' status check. It stops short of explicitly stating whether reading drains the buffer, though 'drain remaining output' implies it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each with a specific purpose: state the function, explain the wait_seconds behavior, and flag additional signals. No redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the key operational facets: wait behavior, default, return signals, and session liveness. Since there is no output schema, these return-related details are essential. It doesn't cover error cases or exact return shape, but for a read tool it is adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is only 33%, so the description must compensate. It does explain wait_seconds in detail (blocking, default, examples) but max_output_chars is only implied through 'truncated' and 'pending_output_chars'. session_id is left to context, but its purpose is understandable from the overall description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the exact operation: 'Read unread output from a tracked SSH session.' This is a specific verb+resource pairing that clearly distinguishes it from sibling tools like ssh_exec or ssh_write_session. The scope is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit guidance on wait_seconds for blocking vs immediate returns, and instructs to call again if 'truncated' or 'pending_output_chars' indicates more output. It doesn't explicitly name alternative tools, but the usage context is clear enough for an agent to select it appropriately.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_scpB
Copy files or directories between the local machine and one remote target via the local scp client.
| Name | Required | Description | Default |
|---|---|---|---|
| port | No | ||
| target | Yes | OpenSSH target (host alias or user@host). Specifies the remote host — do not include the host in sources or destination. | |
| sources | Yes | For upload: local file or directory paths. For download: remote paths (without host prefix — the host is set by 'target'). | |
| timeout | No | Local timeout in seconds. | |
| direction | Yes | ||
| recursive | No | Copy directories recursively. Required when any source is a directory. | |
| destination | Yes | For upload: remote directory path. For download: local directory or file path. | |
| identity_file | No | ||
| extra_ssh_args | No | Additional ssh(1) flags passed verbatim, e.g. ["-J", "jumphost"]. Prefer the dedicated port, identity_file, and strict_host_key_checking parameters. | |
| preserve_times | No | Preserve modification times and modes. | |
| known_hosts_file | No | ||
| strict_host_key_checking | No | Boolean or one of yes, no, ask, accept-new, off. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It mentions copying but does not disclose behaviors like recursive handling, authentication requirements, or side effects such as overwriting. The schema reveals parameters like timeout and strict_host_key_checking, but the description adds no context about these behaviors.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence, front-loaded with the core action and scope. Every word earns its place without unnecessary elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 12 parameters, no output schema, and no annotations, a one-sentence description is inadequate. It neither explains return values, error handling, nor usage scenarios. The tool is more complex than the description suggests, and the lack of context around security, recursion, or path handling leaves significant gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 67%, so the baseline is 3. The description adds minimal parameter semantics beyond the schema; it does not explain the unannotated parameters (port, direction, identity_file, known_hosts_file). The schema itself provides descriptions for most parameters, but the tool description does not compensate for the gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Copy') and clearly identifies the resource (files or directories) and the direction (between local machine and remote target). It also names the underlying mechanism ('local scp client'), distinguishing it from sibling tools like ssh_exec or ssh_sync.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for file transfer but does not explicitly state when to prefer scp over sync (ssh_sync) or other transfer tools. No exclusions or alternatives are mentioned, though the purpose itself gives a clear context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_start_sessionA
Start a new persistent interactive SSH session backed by a local PTY. Returns the session id, initial output, and observer metadata. If 'truncated' is true or 'pending_output_chars' > 0 in the response, call ssh_read_session to retrieve the remaining buffered output. For most agent workflows, prefer ssh_ensure_session instead — it reuses existing sessions and avoids accidental duplicates.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Remote directory to cd into at session start. | |
| env | No | Remote environment variables to export at session start. | |
| port | No | ||
| shell | No | Remote shell executable to launch. | |
| target | Yes | OpenSSH target such as host, alias, or user@host. | |
| auto_close | No | When true, the session is automatically cleaned up after the remote shell or command exits. Use for one-shot long-running commands where you want session-style output streaming but don't need the shell afterwards. Default: false. | |
| session_name | No | Stable name for this session, used for recovery and reuse across tool calls. Choose a short, descriptive kebab-case name reflecting the task, e.g. 'deploy-staging', 'tail-api-logs', 'debug-worker-3'. This name also appears in tmux session listings for human observers. Strongly recommended for any multi-step workflow. | |
| wait_seconds | No | Seconds to wait for initial output. Default: 1.0. | |
| identity_file | No | ||
| observer_mode | No | Passive observer mode. Defaults to 'tmux' and falls back to transcript-only observation if tmux is unavailable. 'transcript' always records a transcript and returns a local follow command. | |
| extra_ssh_args | No | Additional ssh(1) flags passed verbatim, e.g. ["-J", "jumphost"]. Prefer the dedicated port, identity_file, and strict_host_key_checking parameters. | |
| known_hosts_file | No | ||
| max_output_chars | No | ||
| strict_host_key_checking | No | Boolean or one of yes, no, ask, accept-new, off. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It reveals that the session is persistent, interactive, backed by a local PTY, and that output may be buffered (truncated/pending_output_chars) requiring a follow-up call. It does not describe cleanup, side effects, or failure modes, but the persistence and buffered-output behavior are meaningfully disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is four sentences and front-loads the core purpose. It efficiently covers the tool's function, return values, follow-up handling, and alternative tool recommendation without redundancy or unnecessary detail. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Considering the complexity (14 parameters, no output schema, no annotations), the description provides a clear operational flow: start session, check truncated/pending_output_chars, read remaining output, and prefer ssh_ensure_session. It covers the primary invocation patterns adequately, though it could benefit from more on session lifecycle (e.g., cleanup, auto_close behavior) which is only partially covered in the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 71%, and most parameters already have descriptions in the schema. The description adds operational context (e.g., reading remaining output via ssh_read_session) but does not elaborate on individual parameter usage beyond what the schema provides. Since the schema does most of the heavy lifting, the description's contribution is marginal.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Start a new persistent interactive SSH session backed by a local PTY.' It specifies the resource (SSH session) and the action (start), and distinguishes it from sibling tools by explicitly recommending ssh_ensure_session for most workflows. The description also notes the return values (session id, initial output, observer metadata), making the purpose concrete.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit usage guidance: it explains when to call ssh_read_session (if truncated or pending_output_chars > 0), and when to prefer ssh_ensure_session instead ('For most agent workflows, prefer ssh_ensure_session instead — it reuses existing sessions and avoids accidental duplicates'). This directly addresses the when-to-use vs alternatives criterion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_stop_forwardC
Stop a tracked SSH port forward and return its final status.
| Name | Required | Description | Default |
|---|---|---|---|
| forward_id | Yes | ID of the forward to stop. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It discloses that it stops and returns final status, but does not explain side effects (e.g., whether the session remains open, forward is removed from tracking, or if stopping is reversible). Insufficient for a mutation-like operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single concise sentence with the verb first, no filler. It efficiently states the action and result, though it lacks additional structural detail for edge cases.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter tool with no output schema, the description is minimally adequate—it states the action and that status is returned. However, it misses usage context and behavioral nuance (e.g., how final status is determined, what happens to the forward tracking), leaving clear gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the parameter forward_id is already documented. The description adds no extra meaning beyond the schema; 'tracked' is implied by the tool name. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Stop') and resource ('tracked SSH port forward') with a clear action. The word 'tracked' helps distinguish from generic stopping (e.g., ssh_stop_session), but it does not name alternative tools, so it is clear but not fully differentiating.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus siblings like ssh_stop_session or ssh_forward. It implies usage (stop a tracked forward) but offers no exclusions, prerequisites, or alternative recommendations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_stop_sessionA
Terminate a tracked SSH session, close any attached tmux observer, and return final unread output plus exit metadata. The transcript file is preserved on disk.
| Name | Required | Description | Default |
|---|---|---|---|
| force | No | Send SIGKILL instead of SIGTERM. Default: false. | |
| session_id | Yes | ||
| wait_seconds | No | Seconds to wait for process to exit. Default: 2.0. | |
| max_output_chars | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden. It discloses key side effects: session termination, tmux observer cleanup, return of unread output and exit metadata, and preservation of the transcript file. This is more transparent than typical. However, it omits details like default signal (SIGTERM vs SIGKILL) and potential blocking behavior, which are partially covered by the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence delivers all essential information without redundancy. Every clause adds value: termination, observer cleanup, return value, and file preservation. It is optimally concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The core behavior is described, but key operational details are missing: parameter semantics for max_output_chars and session_id, return format details, and error handling. Since there is no output schema, the description should provide more specifics. The tool is moderately complex (4 params, no annotations), and the description is adequate but not complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 50%, and the description does not compensate. It fails to explain the format or purpose of session_id and max_output_chars. The phrase 'final unread output' hints at max_output_chars but does not explicitly connect them. The description adds no meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Terminate'), the resource ('tracked SSH session'), and additional distinguishing behaviors ('close any attached tmux observer', 'return final unread output plus exit metadata'). This differentiates it from siblings like ssh_stop_forward and ssh_read_session.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The usage context is implied: it is the tool to stop an SSH session. However, there is no explicit 'when to use' vs alternatives or exclusions. Sibling tools are not mentioned, so the agent must infer when to choose this over similar tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_syncB
Incrementally sync files or directories between the local machine and one remote target via local rsync over SSH.
| Name | Required | Description | Default |
|---|---|---|---|
| port | No | ||
| delete | No | Delete files in the destination that are not in the source. | |
| source | Yes | For upload: local path. For download: remote path (without host prefix). | |
| target | Yes | OpenSSH target (host alias or user@host). Specifies the remote host — do not include the host in source or destination. | |
| dry_run | No | Show what would be transferred without actually doing it. | |
| exclude | No | Glob patterns to exclude from the sync. | |
| timeout | No | Local timeout in seconds. | |
| compress | No | Compress data during transfer. Default: true. | |
| direction | Yes | ||
| destination | Yes | For upload: remote path. For download: local path. | |
| identity_file | No | ||
| extra_ssh_args | No | Additional ssh(1) flags passed verbatim, e.g. ["-J", "jumphost"]. Prefer the dedicated port, identity_file, and strict_host_key_checking parameters. | |
| extra_rsync_args | No | Additional rsync flags passed verbatim. | |
| known_hosts_file | No | ||
| strict_host_key_checking | No | Boolean or one of yes, no, ask, accept-new, off. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of disclosing behavioral traits. It says 'incrementally sync' and 'via rsync over SSH', which hints at the transfer mechanism, but it does not warn about potential destructive effects (e.g., overwriting files, deletion when delete=true), authentication requirements, or what happens on failure. The risk profile of a sync tool is significant, and this one-liner does not surface it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that packs a clear verb, resource, and mechanism into minimal words. There is no redundant language or repetition of the tool name. Every phrase earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having 15 parameters, 4 required, and no output schema, the description gives no information about return values, error handling, prerequisites (like an active SSH session), or when to prefer this over siblings. The complexity of the tool warrants more contextual detail than a single sentence. The description is not sufficient for an agent to confidently invoke this tool in all reasonable scenarios.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 73%, and most parameters have their own descriptions. The tool description adds no per-parameter information, but it does clarify the overall local-remote split (one local side, one remote target), which helps interpret source/destination. Since coverage is neither high nor low, a baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('sync'), a specific resource ('files or directories'), and a specific mechanism ('local rsync over SSH'). It also scopes the operation to one remote target, which distinguishes it from sibling tools like ssh_scp (one-off copy) and ssh_exec (command execution). The purpose is immediately clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. It does not mention that one-off copies should use ssh_scp, or that this tool is suited for incremental/backup scenarios. The description lacks any 'when to use' or 'when not to use' context, so the agent must infer usage from the name and schema.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_viewA
Read a remote file or list a remote directory over SSH — the remote counterpart of the local file-viewing tool. For a file, returns its content plus 'size_bytes' and 'total_lines'. Content is truncated at 20KB by default when 'view_range' isn't given and 'force_read_large_files' isn't set; use 'view_range' to page through large files instead. For a directory, returns non-hidden entries up to 2 levels deep.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Absolute (or login-directory-relative) remote path to a file or directory. | |
| port | No | ||
| target | Yes | OpenSSH target such as host, alias, or user@host. | |
| timeout | No | Local timeout in seconds. | |
| max_bytes | No | Truncation cutoff in bytes for the default (no view_range, no force) read. Default: 20480 (20KB). | |
| view_range | No | Optional [start_line, end_line] (1-based, inclusive). Use end_line -1 for 'to end of file'. Bypasses the 20KB truncation cutoff. | |
| identity_file | No | ||
| extra_ssh_args | No | Additional ssh(1) flags passed verbatim, e.g. ["-J", "jumphost"]. Prefer the dedicated port, identity_file, and strict_host_key_checking parameters. | |
| known_hosts_file | No | ||
| force_read_large_files | No | Read the full file even if it exceeds the truncation cutoff. Ignored when 'view_range' is given. Default: false. | |
| strict_host_key_checking | No | Boolean or one of yes, no, ask, accept-new, off. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses file return fields (size_bytes, total_lines), default 20KB truncation, view_range bypass, force_read_large_files behavior, and directory depth/visibility limits. It does not mention auth or error behavior, but the key behavioral traits are transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with purpose, and each subsequent sentence adds behavioral detail without fluff. Excellent conciseness and structure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 11-param tool with no output schema and no annotations, the description covers the primary use cases and important behavioral details: file output, directory listing, truncation, and paging. It omits the exact return format for directories and some edge cases, but it is adequate given standard SSH parameters are self-explanatory.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 73%, so the description adds meaning by explaining how max_bytes, view_range, and force_read_large_files interact with truncation. However, most parameters (port, identity_file, timeout, etc.) rely on the schema or are self-explanatory, and the description doesn't compensate for uncovered parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb-resource pair: 'Read a remote file or list a remote directory over SSH,' which immediately conveys purpose and scope. It also notes it is the 'remote counterpart of the local file-viewing tool,' distinguishing it from siblings like ssh_exec or ssh_grep.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Clear context is provided: use for reading files or listing directories, and use view_range to page through large files instead of reading the truncated default. It does not explicitly name alternative sibling tools or exclusion criteria, but the usage is well-scoped and practical.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_write_sessionA
Write text or a control sequence to a tracked SSH session PTY. Always terminate commands with a trailing newline (\n) to submit them. Control characters: \u0003 for Ctrl-C, \u0004 for Ctrl-D, \u001a for Ctrl-Z. Use wait_seconds (e.g. 1-5) to receive the command response in the same call. Check 'pending_output_chars' in the response; if non-zero, call ssh_read_session to drain.
| Name | Required | Description | Default |
|---|---|---|---|
| input | Yes | Raw text to write to the session PTY. Include '\n' to press Enter. Control characters work: '\u0003' for Ctrl-C, '\u0004' for Ctrl-D. Text is written exactly as provided. | |
| session_id | Yes | ||
| wait_seconds | No | Seconds to wait for output after writing. Default: 1.0. | |
| max_output_chars | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well by disclosing control-character encoding, newline behavior, and the response field pending_output_chars. It explains how writes should be submitted and how to drain output, but it does not mention error cases or invalid session handling, leaving some gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each earning its place: the write action, newline/control characters, and the wait/drain workflow. There is no redundancy with the schema, and the information is front-loaded and directly actionable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a four-parameter tool with no output schema and no annotations, the description covers the essential workflow: how to write, what to expect (pending_output_chars), and when to call ssh_read_session. It omits max_output_chars semantics, but the operational flow is adequately specified for effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers only 50% of parameters (input and wait_seconds), and the description significantly enriches those: control codes, newline requirement, and wait_seconds usage. However, max_output_chars is never mentioned in the description, so one parameter remains underdocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Write' and the resource 'tracked SSH session PTY', clearly distinguishing it from siblings like ssh_read_session and ssh_exec. It also states the exact scope (text or control sequence), making the tool's function immediately obvious.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives concrete usage rules: trailing newline to submit, control character mappings, wait_seconds recommendation (1-5), and when to follow up with ssh_read_session based on pending_output_chars. It does not explicitly contrast with ssh_exec, but the interactive PTY context implies the appropriate use case.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
17 tool updates
v0.2.0- First observed
ssh_create - First observed
ssh_edit - First observed
ssh_ensure_session - First observed
ssh_exec - First observed
ssh_forward - First observed
ssh_glob - First observed
ssh_grep - First observed
ssh_list_forwards - First observed
ssh_list_sessions - First observed
ssh_read_session - First observed
ssh_scp - First observed
ssh_start_session - First observed
ssh_stop_forward - First observed
ssh_stop_session - First observed
ssh_sync - First observed
ssh_view - First observed
ssh_write_session
TDQS
Most tools have clearly distinct purposes: sessions, files, exec, transfer, and forwards are separate categories. However, ssh_start_session and ssh_ensure_session overlap significantly, and ssh_exec vs ssh_write_session could be confused without careful reading.
All tools follow the 'ssh_<verb>[_<noun>]' pattern, using consistent snake_case. The verb comes first in every case, and nouns are attached for specific resources (sessions, forwards), while generic operations like exec, view, create, edit, grep, glob, forward stand alone. This is highly predictable.
17 tools is well-scoped for an SSH server, covering sessions (6), file operations (5), transfer (2), port forwarding (3), and one-off exec (1). It is comprehensive without feeling bloated, and each tool serves a distinct need.
Core SSH workflows are covered: session CRUD, file read/create/edit/search, command execution, file transfer, and port forwarding. The main gap is a missing remote file delete operation, and there is no explicit tool to copy a remote file to another remote location, but these can be worked around with exec.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Remote MCP server for supportsheep: run AI interviews and manage support content for your blog.
Hosted MCP server connecting claude.ai, ChatGPT and other AI apps to your own computer
Remote MCP server for AI.TV creators — delegate account operations to your AI agent over MCP.
MCP server connecting AI agents to 100+ apps (Gmail, Slack, Notion, GitHub) via one-click OAuth.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceAn MCP server that gives AI assistants full SSH/SFTP remote operations — session management, command execution, interactive shells, file transfers, port forwarding, and system diagnostics.2MIT
- AlicenseAqualityAmaintenanceMCP server giving AI agents full SSH access with persistent sessions, structured command output, SFTP file transfer, and port forwarding.1810MIT
- AlicenseAqualityAmaintenanceAn open MCP server that gives any AI agent SSH access to remote Linux/Unix machines — shell commands, file read/write, and SFTP transfers.11MIT
- AlicenseNot gradedqualityDmaintenanceAn MCP server that gives AI agents SSH capabilities to execute commands, transfer files, and inspect remote systems through a preconfigured host list.84MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/slepp/ssh-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server