tufantunc/ssh-mcp

What it solves

ssh-mcp is a security-focused Model Context Protocol (MCP) server that allows LLM agents to execute commands on remote hosts via SSH. It addresses the "lethal trifecta" risk—where an agent has access to private data, untrusted input, and network egress—by implementing a strict authorization and approval layer between the LLM and the remote shell.

How it works

The server acts as a gateway that classifies every command before it is executed. It uses a role-based access control (RBAC) matrix (viewer, operator, admin) mapped against environment tiers (dev, staging, prod) to determine if a command is permitted.

Key security mechanisms include:

• Command Classification: Commands are categorized as read-only, safe, destructive, or privileged (sudo).
• Approval Gates: Depending on the configuration, destructive or privileged commands can be set to auto, ask-destructive, ask-all, or deny, requiring human-in-the-loop approval via the MCP client.
• Strict Configuration: The server enforces strict file permissions on its configuration file to prevent unauthorized modification.
• Session Management: It supports both interactive sessions (maintaining state like CWD) and background sessions for long-running processes.

Who it’s for

Developers and system administrators who want to give AI agents the ability to manage remote infrastructure while maintaining strict security boundaries and audit logs to prevent accidental or malicious destructive actions.

Highlights

• Security-First Design: Includes a built-in "never-allowed" list for dangerous commands (e.g., rm -rf /) and supports custom denylists.
• Role-Based Access: A flexible policy engine that allows fine-grained control over what roles can do in different environments.
• Bastion Support: Ability to route connections through a jump server using the via configuration.
• Enterprise Ready: Supports SSH CA certificates and multiple credential resolution methods (SSH agent, OS keychain, env vars).
• Stateful Interaction: Supports interactive POSIX sessions and background process polling.