SSH MCP Server (classfang): Setup for Claude Code, Cursor and Other Apps

• Runs a shell command on your SSH server

  Runs the command you give it on the remote server and returns the output. A non-zero exit code comes back as text after the output, not as an error. Without a whitelist, any command is allowed.

  Try: “Run df -h on the dev server and tell me which disk is fullest.”

  Delete · execute-command

• Copies a local file or folder to the server

  Sends a local file, or a whole folder (up to 2000 files, symlinks skipped), to a path on the remote server. Existing files there can be replaced.

  Try: “Upload ./dist to /var/www/app on the staging server.”

  Write · upload

• Copies a file or folder from the server to your machine

  Pulls a remote file or folder (up to 2000 files, symlinks skipped) down to a local path you name.

  Try: “Download /var/log/app.log from prod to ./logs.”

  Files · download

• Reads a text file on the server

  Reads a remote text file over SFTP in chunks of 64 KB by default and names the next offset so long files can be paged. It refuses binary files.

  Try: “Show me the first part of /etc/nginx/nginx.conf on the web server.”

  Network · read-file

• Writes text to a file on the server

  Writes text to a remote file over SFTP, replacing it or appending to it. It avoids shell quoting problems for multi-line content.

  Try: “Create /etc/myapp/config.yml on the dev server with these settings.”

  Write · write-file

• Lists the SSH servers you configured

  Shows the SSH connection names set up for this server, so the assistant can pick one with the connection name.

  Try: “Which servers can you connect to?”

  Read · list-servers

• Starts a long command in the background

  Starts a command on the remote server in the background and returns a job id right away. It goes through the same whitelist and blacklist as execute-command.

  Try: “Start the build script on the build server and keep going.”

  Delete · job-start

• Checks a background job

  Reads the output and exit code of a job started with job-start.

  Try: “What is the status of that build job?”

  Network · job-status

• Stops a background job

  Stops a running job (SIGTERM, then SIGKILL after 5 seconds), including its child processes.

  Try: “Stop the build job, it is stuck.”

  Runs code · job-kill

• Lists recent background jobs

  Lists recent jobs on the server with their state. Finished jobs are pruned after 7 days.

  Try: “List the jobs I have running on the build server.”

  Network · job-list

Watch out for

• It can run any command on your server

  execute-command and job-start run whatever the assistant sends, with the rights of the SSH account. That includes deleting files and stopping services. Use a low-privilege account and a --whitelist. github.com

• It can overwrite files on the server

  write-file replaces or appends to any file the account can write, and upload can replace existing files. Without --allowed-remote-paths the server accepts any remote path and prints a startup warning. github.com

• Passwords sit in plain text in your config

  The password option puts your SSH password in the MCP config file. Use a private key or the SSH agent instead. github.com

• Whitelists block chaining but are easy to get wrong

  With a whitelist on, commands with ;, &, |, redirects or substitutions are rejected, and patterns must match the whole command. A loose pattern still allows too much, so test it. github.com

• Pages or files can steer the assistant into SSH

  The README warns that prompt injection can drive reads or writes of files such as authorized_keys. Do not point the assistant at untrusted content while connected to production. github.com

Security advisories