Log inSubmit server
Ssh MCP logo

Ssh MCP

by tufantunc

Control remote Linux and Windows hosts over SSH with MCP tools for commands, sessions, approvals, auditing, and SFTP transfers.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Ssh MCP

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "tufantunc-ssh-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "ssh-mcp"
      ],
      "env": {
        "SSH_MCP_PASSWORD": "YOUR_VALUE_HERE",
        "SSH_AUTH_SOCK": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

Install not yet sandbox-tested— we haven't run this command through our automated sandbox yet. Not a red flag; we're working through the catalog.

Overview

tufantunc/ssh-mcp provides MCP-based SSH access to configured Linux and Windows hosts, including shell commands, stateful sessions, process signals, and SFTP transfers. It supports password or SSH key authentication and applies command classification, host and role policies, approval gates, and audit logging before execution. Use it when an agent needs controlled remote administration rather than unrestricted local shell access. Configuration is stored in a platform-specific TOML file and can be reloaded without restarting the server.

Use cases

  • Inspect configured remote hosts and active SSH sessions
  • Run approved read-only diagnostics on Linux or Windows servers
  • Manage long-running remote commands through background sessions
  • Transfer configuration files and binaries over SFTP
  • Apply controlled sudo operations with approval gates

Key features

  • SSH key or password authentication
  • Interactive and background remote sessions
  • Allowlisted read-only commands
  • Approval policies for destructive and privileged actions
  • SFTP transfers with streamed file handling
  • Runtime configuration reloads

Tools15

What Ssh MCP lets your agent do. Expand a tool for its parameters.

Self-reported~286 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked Today

Recent health check succeeded.

19/20 checks healthy over the last 79d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 10d ago via OSV.dev · ssh-mcp (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars840Stargazers on the source repository.
npm downloads34kPackage downloads in the last 30 days.
Last commit2d agoMost recent push to the default branch.
Tools exposed15Callable tools this server registers over MCP.
Directory activity9 viewsConfig copies, upvotes, and views on AllMCPs.

How Ssh MCP works

What tufantunc/ssh-mcp does

SSH access is exposed as MCP tools for remote Linux and Windows administration. Agents can discover configured hosts, inspect active sessions, run read-only or arbitrary commands, use sudo through a separate privileged operation, signal remote processes, and transfer files over SFTP.

The server separates lower-risk inspection from operations that can change a system. Read-only commands are restricted to an allowlist, while arbitrary, privileged, destructive, and file-writing actions can require human approval. Configuration determines the hosts, roles, and approval behavior available to the MCP client.

How it works

Install the package globally with npm install -g ssh-mcp, then start the ssh-mcp command through an MCP client. The server communicates over the standard MCP stdio transport in the documented client examples. Claude Code uses claude mcp add --transport stdio ssh-mcp -- ssh-mcp; Claude Desktop, Cursor, and Windsurf can invoke the command from an MCP server configuration.

A TOML configuration defines named profiles with a host, port, user, authentication method, key reference, role, and approval policy. Profiles can use password authentication through SSH_MCP_PASSWORD or an SSH agent through SSH_AUTH_SOCK. The server can start before configuration exists so clients can complete discovery, but tool calls are refused until a valid configuration is available. The reload-config tool can apply a newly written file without a restart.

Setup and configuration

Configuration paths are platform-specific:

  • Linux: ~/.config/ssh-mcp/config.toml, or the equivalent under $XDG_CONFIG_HOME
  • macOS: ~/Library/Application Support/ssh-mcp/config.toml
  • Windows: %APPDATA%\\ssh-mcp\\config.toml

A profile includes values such as host, port, user, auth, keyRef, role, and approvalPolicy. The example configuration uses a non-root deployment account and a key at ~/.ssh/id_ed25519. Do not point the server at a root account, and do not use automatic approval for production profiles.

On Linux and macOS, the server checks permissions on both the configuration file and its directory. Windows uses ACL checks: write access from another account is refused, while read exposure is reported unless stricter ACL handling is enabled. The --strictConfigAcl and --allowUncheckedConfigAcl flags change how ACL findings are handled.

Store passwords in SSH_MCP_PASSWORD, not command-line arguments. SSH agent authentication uses SSH_AUTH_SOCK. The documented permission commands set the configuration directory to mode 700 and the file to mode 600 on POSIX systems.

Tools and capabilities

  • list-connections discovers configured hosts and their connection status.
  • list-sessions shows active sessions for each host.
  • open-session creates a named interactive stateful session or a background session.
  • close-session closes a session and signals a background command before dropping its channel.
  • read-session-output reads output from background work such as tail -f.
  • read-command runs allowlisted read-only commands including ls, cat, and grep.
  • run-command runs arbitrary commands subject to approval rules.
  • privileged-command runs commands with sudo.
  • sftp-upload, sftp-download, and sftp-list handle content transfers and remote directory listing.
  • sftp-upload-file and sftp-download-file stream files between disk and the remote host without passing file contents through model context.
  • signal-process sends INT, TERM, or KILL to a remote process ID.
  • reload-config reports configuration status or reloads the file.

The regular SFTP upload replaces its destination unconditionally. The file-streaming upload instead requires an explicit overwrite option before replacing an existing destination.

Limitations and notes

SSH access still exposes private data, untrusted input, and network egress to agent-driven operations; approval and audit controls reduce exposure but do not eliminate that risk. Destructive or privileged actions need approval unless a profile sets approvalPolicy = "auto". Configuration and credentials must be protected because they determine which hosts and policies the server can use.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Ssh MCP

tufantunc/ssh-mcp is an MCP server that connects AI clients to configured Linux and Windows hosts over SSH. Its main tools discover hosts, manage interactive or background sessions, run read-only or arbitrary commands, execute approved sudo commands, signal processes, and transfer files through SFTP.

Install it globally with `npm install -g ssh-mcp`, create the platform-specific TOML configuration, set the needed credentials, and register the `ssh-mcp` command with your MCP client.

Use a configured SSH key or password authentication. Set `SSH_AUTH_SOCK` when using an SSH agent, or set `SSH_MCP_PASSWORD` for password authentication; do not pass passwords as command-line arguments.

Yes, Cursor is shown as a supported MCP client. Add an `ssh-mcp` server entry using the `ssh-mcp` command and provide `SSH_MCP_PASSWORD` in the client environment when password authentication is configured.

Call `reload-config` with `action: "reload"` after writing the TOML file. The tool can also report the configuration file status.

Related MCP servers

All in Command Line All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewSsh MCP AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/tufantunc-ssh-mcp?style=directory)](https://allmcps.com/mcp/tufantunc-ssh-mcp)
HTML Embed
<a href="https://allmcps.com/mcp/tufantunc-ssh-mcp"><img src="https://allmcps.com/api/badge/tufantunc-ssh-mcp?style=directory" alt="Ssh MCP on AllMCPs" /></a>