SSH MCP Server (tufantunc): Setup for Claude, Cursor and Other Apps

• Shows the servers you set up and which are connected

  Lists the SSH profiles from your config file and whether each one is connected. The assistant uses it to learn which hosts it may use.

  Try: “Which servers can you reach?”

  Read · list-connections

• Runs a safe, read-only command on a server

  Runs one command from a fixed allowlist, such as ls, cat, grep, find or df. It cannot change the server, and it refuses commands with line breaks.

  Try: “Show the last 50 lines of /var/log/nginx/error.log on web-1.”

  Network · read-command

• Runs any shell command on a server

  Runs one command on the remote host. Risky commands go through the approval step you set for that profile, but ordinary changes such as editing files or restarting services do not.

  Try: “Restart the app service on staging and tell me if it comes back up.”

  Delete · run-command

• Runs a command with sudo

  Runs a command with sudo. It always goes through the approval step for the profile, and the sudo password is passed over stdin and not on the command line.

  Try: “Use sudo to install the security updates on build-box.”

  Delete · privileged-command

• Lists files in a remote folder

  Lists a folder over SFTP. The number of entries and the size of the answer are capped.

  Try: “List the files in /var/www/releases on web-1.”

  Network · sftp-list

• Reads a remote file into the chat

  Downloads one file over SFTP and hands its contents to the assistant.

  Try: “Fetch /etc/nginx/nginx.conf and explain the proxy rules.”

  Network · sftp-download

• Writes text to a file on a server

  Uploads content to a path over SFTP. It overwrites an existing file with no warning and has no option to refuse that.

  Try: “Upload this config to /etc/myapp/config.yml on staging.”

  Write · sftp-upload

• Sends a local file to a server

  Streams a file from your computer to the server without passing it through the model. It only works inside the transfer folder you set in config, and refuses if none is set.

  Try: “Upload build.tar.gz from my transfer folder to /opt/releases on web-1.”

  Write · sftp-upload-file

• Saves a remote file to your computer

  Streams a file from the server to your disk without passing it through the model. It only writes inside the transfer folder you set in config, and refuses if none is set.

  Try: “Download the 2 GB database dump from backup-1 to my transfer folder.”

  Write · sftp-download-file

• Starts a named shell or background job

  Opens a named session on a host. An interactive one keeps its folder and variables between commands, and a background one runs a long job such as a log tail.

  Try: “Open a background session that follows /var/log/syslog on web-1.”

  Runs code · open-session

• Lists open sessions on a server

  Shows the sessions that are currently open for one host.

  Try: “What sessions are open on web-1?”

  Read · list-sessions

• Reads output from a background job

  Returns the most recent lines from a background session, for example a log you are following.

  Try: “Show the latest 20 lines from the logs session.”

  Read · read-session-output

• Ends a session

  Closes a named session. For a background job it first signals the command (INT, then TERM, then KILL) so it stops.

  Try: “Close the logs session.”

  Runs code · close-session

• Stops or interrupts a remote process

  Sends INT, TERM or KILL to a process ID on the server.

  Try: “Kill process 4821 on web-1, it is stuck.”

  Runs code · signal-process

• Checks or reloads the config file

  Shows the config file path and last load result, or re-reads the file and applies it if it passes validation. It never shows the file contents.

  Try: “Reload the SSH config and tell me if it was accepted.”

  Files · reload-config

Watch out for

• It runs arbitrary commands on your servers

  run-command and privileged-command can change or delete anything the SSH user can. Use a dedicated low-privilege account and a restrictive role. github.com

• The default approval step is narrow

  The default ask-destructive mode prompts only for patterns such as rm -rf, interpreter one-liners, uploads and sudo. Ordinary writes, service control and signals run without a prompt, so use ask-all on production. github.com

• sftp-upload overwrites files without warning

  It replaces an existing file at the path and has no overwrite flag. Use profiles without write roles on hosts where that matters. github.com

• It tells your hosts an AI agent connected

  Each command sends AI_AGENT=ssh-mcp to the host by default. Clear announceAgent on a profile for a host you do not control. github.com

• The HTTP mode needs a bearer token

  If you start it with --transport=http it requires --bearerToken and listens on 127.0.0.1 by default. Put TLS in front of it before exposing it. github.com

Security advisories