SSH — policy-gated remote access
tufantunc/ssh-mcp
The SSH MCP Server enables LLMs and MCP clients to securely execute shell commands on remote Linux and Windows systems via SSH, providing both standard command execution and sudo-elevated commands with configurable timeout protection. It exposes two primary tools—`exec` for standard remote command execution and `sudo-exec` for privileged operations—supporting secure authentication through passwords or SSH keys. This server solves the problem of allowing AI models to interact with and control remote systems through a standardized, secure protocol interface.
- GitHub stars
- 875
- tools
- 15
- auth
- Secret needed
- transport
- STDIO
- env vars
- 4
- last updated
- Nov 12, 2026
Tools
15 toolsPublic tool metadata for what this MCP can expose to an agent.
list-connectionsDiscover available hosts and connection status
Discover available hosts and connection status
No parameter schema in public metadata yet.
list-sessionsList active sessions per host
List active sessions per host
No parameter schema in public metadata yet.
open-sessionCreate a named interactive (stateful) or background session
Create a named interactive (stateful) or background session
No parameter schema in public metadata yet.
close-sessionClose a session. A background session's command is signalled (INT/TERM/KILL) before its channel is dropped
Close a session. A background session's command is signalled (INT/TERM/KILL) before its channel is dropped
No parameter schema in public metadata yet.
read-session-outputRead output from background sessions (e.g., `tail -f`)
Read output from background sessions (e.g., `tail -f`)
No parameter schema in public metadata yet.
read-commandExecute allowlisted read-only commands (`ls`, `cat`, `grep`, ...)
Execute allowlisted read-only commands (`ls`, `cat`, `grep`, ...)
No parameter schema in public metadata yet.
run-commandExecute arbitrary commands (destructive/privileged need approval, unless `approvalPolicy = "auto"`)
Execute arbitrary commands (destructive/privileged need approval, unless `approvalPolicy = "auto"`)
No parameter schema in public metadata yet.
privileged-commandExecute with sudo (needs approval, unless `approvalPolicy = "auto"`)
Execute with sudo (needs approval, unless `approvalPolicy = "auto"`)
No parameter schema in public metadata yet.
sftp-uploadUpload a file via SFTP (replaces the destination unconditionally)
Upload a file via SFTP (replaces the destination unconditionally)
No parameter schema in public metadata yet.
sftp-downloadDownload a file via SFTP
Download a file via SFTP
No parameter schema in public metadata yet.
sftp-listList a remote directory, bounded in entries and bytes
List a remote directory, bounded in entries and bytes
No parameter schema in public metadata yet.
sftp-upload-fileStream a local file to the remote host, never through model context
Stream a local file to the remote host, never through model context
No parameter schema in public metadata yet.
sftp-download-fileStream a remote file to local disk, never through model context
Stream a remote file to local disk, never through model context
No parameter schema in public metadata yet.
signal-processSend INT/TERM/KILL to a remote PID
Send INT/TERM/KILL to a remote PID
No parameter schema in public metadata yet.
reload-configShow the config file's status, or re-read and apply it without a restart
Show the config file's status, or re-read and apply it without a restart
No parameter schema in public metadata yet.
Sponsors
Promote your product hereReach 125k+ visitors monthlyPromote your product hereReach 125k+ visitors monthly
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any language
Agent CaffeineSponsoredClose your lid, come back to finished workSnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthlyWaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthlyknobsSponsoredSee your site on any phone, any day, in any languageConfiguration
SSH_MCP_PASSWORDsecretPassword for the configured profile; a per-profile SSH_MCP_<PROFILE>_PASSWORD takes precedence. Credentials are never accepted as CLI arguments.
SSH_MCP_KEYPath to the private key file to authenticate with — the path, not the key material. A per-profile SSH_MCP_<PROFILE>_KEY takes precedence.
SSH_MCP_PASSPHRASEsecretPassphrase for an encrypted private key.
SSH_MCP_SUDO_PASSWORDsecretPassword the sudo tool escalates with, when the policy in force allows the privileged class.
Readme
Details
- Repository
- github.com/tufantunc/ssh-mcp
- Website
- github.com/tufantunc/ssh-mcp#readme
- Category
- Monitoring & Observability
- Package
ssh-mcp- Transport
- STDIO
- Auth
- Required
- Registry
- MCP registry, active
