tufantunc/ssh-mcp

SSH MCP Server — Controlled SSH Access for AI Agents

What it is: A security-focused Model Context Protocol (MCP) server that lets AI assistants (like Claude) run commands on remote computers via SSH — but with strict guardrails. It's a bridge between an LLM and a shell, designed to prevent the "lethal trifecta" of private data, untrusted input, and network access in one place.

Why it exists: Giving an AI direct shell access is risky — prompt injection could make it run malicious commands. This server adds layers of control: it classifies every command, checks it against a policy, requires human approval for dangerous actions, and logs everything.

Key features:

• 14 tools for remote operations: read-only commands (ls, cat), arbitrary commands, sudo commands, SFTP file transfer (both through model context and streaming directly to disk), interactive/background sessions, and process signaling.
• Policy engine: Commands are classified as read-only, safe, destructive, or privileged. A role × host-group matrix decides what's allowed. You can define denylist patterns (e.g., terraform destroy).
• Human-in-the-loop approval: Destructive commands require approval unless you set approvalPolicy = "auto" (discouraged for production). Approval grants can be time-limited.
• Audit logging: Every command, approval, and transfer is recorded.
• Security hardening: Config file permissions are enforced (Linux/macOS require 0600/0700; Windows checks ACLs). Host keys can be pinned. ProxyJump (bastion) support. SSH CA certificates. No root accounts recommended.
• Sessions: Interactive sessions preserve state (CWD, env vars) across commands; background sessions run long processes (e.g., tail -f) that you can poll.
• Streaming file transfer: Large/binary files bypass the model context entirely, going directly between local disk and remote host, with atomic writes and size/time limits.
• Host-side identification: Sets AI_AGENT=ssh-mcp env var so operators can distinguish agent sessions (requires AcceptEnv on the host).

How it works: You configure profiles (host, user, auth method, role, approval policy) in a TOML file. The server connects via SSH (key, password, agent, or keychain). When an agent calls a tool, the server classifies the command, checks it against the policy matrix and denylist, possibly asks a human for approval, then executes it. All decisions are logged.

Use cases: Safe remote administration by AI assistants, automated deployments with oversight, monitoring and log inspection, and any scenario where you want an LLM to interact with servers without giving it unrestricted shell access.

Important caveats: The README stresses that this reduces risk but doesn't eliminate it. Never point it at a root account, and never use auto approval on production profiles. It's tested on Linux, macOS, and Windows (with some limitations on Windows for interactive sessions and streaming transfers).