SSH
STDIOSSH command execution server for AI assistants via MCP protocol
SSH command execution server for AI assistants via MCP protocol
SSH-based MCP (Model Context Protocol) server that allows remote execution of SSH commands via the MCP protocol.
English Document | 中文文档
ssh-mcp-server is a bridging tool that enables AI assistants and other applications supporting the MCP protocol to execute remote SSH commands through a standardized interface. This allows AI assistants to safely operate remote servers, execute commands, and retrieve results without directly exposing SSH credentials to AI models.
GitHub: https://github.com/classfang/ssh-mcp-server
NPM: https://www.npmjs.com/package/@fangjunjie/ssh-mcp-server
| Tool | Name | Description |
|---|---|---|
| execute-command | Command Execution Tool | Execute SSH commands on remote servers and get results |
| upload | File Upload Tool | Upload local files to specified locations on remote servers |
| download | File Download Tool | Download files from remote servers to local specified locations |
| list-servers | List Servers Tool | List all available SSH server configurations |
⚠️ Important: In MCP configuration files, each command line argument and its value must be separate elements in the
argsarray. Do NOT combine them with spaces. For example, use"--host", "192.168.1.1"instead of"--host 192.168.1.1".
Options: -h, --host SSH server host address -p, --port SSH server port -u, --username SSH username -w, --password SSH password -k, --privateKey SSH private key file path -P, --passphrase Private key passphrase (if any) -W, --whitelist Command whitelist, comma-separated regular expressions -B, --blacklist Command blacklist, comma-separated regular expressions -s, --socksProxy SOCKS proxy server address (e.g., socks://user:password@host:port)
{ "mcpServers": { "ssh-mpc-server": { "command": "npx", "args": [ "-y", "@fangjunjie/ssh-mcp-server", "--host", "192.168.1.1", "--port", "22", "--username", "root", "--password", "pwd123456" ] } } }
{ "mcpServers": { "ssh-mpc-server": { "command": "npx", "args": [ "-y", "@fangjunjie/ssh-mcp-server", "--host", "192.168.1.1", "--port", "22", "--username", "root", "--privateKey", "~/.ssh/id_rsa" ] } } }
{ "mcpServers": { "ssh-mpc-server": { "command": "npx", "args": [ "-y", "@fangjunjie/ssh-mcp-server", "--host", "192.168.1.1", "--port", "22", "--username", "root", "--privateKey", "~/.ssh/id_rsa", "--passphrase", "pwd123456" ] } } }
{ "mcpServers": { "ssh-mpc-server": { "command": "npx", "args": [ "-y", "@fangjunjie/ssh-mcp-server", "--host", "192.168.1.1", "--port", "22", "--username", "root", "--password", "pwd123456", "--socksProxy", "socks://username:password@proxy-host:proxy-port" ] } } }
Use the --whitelist and --blacklist parameters to restrict the range of executable commands. Multiple patterns are separated by commas. Each pattern is a regular expression used to match commands.
Example: Using Command Whitelist
{ "mcpServers": { "ssh-mpc-server": { "command": "npx", "args": [ "-y", "@fangjunjie/ssh-mcp-server", "--host", "192.168.1.1", "--port", "22", "--username", "root", "--password", "pwd123456", "--whitelist", "^ls( .*)?,^cat .*,^df.*" ] } } }
Example: Using Command Blacklist
{ "mcpServers": { "ssh-mpc-server": { "command": "npx", "args": [ "-y", "@fangjunjie/ssh-mcp-server", "--host", "192.168.1.1", "--port", "22", "--username", "root", "--password", "pwd123456", "--blacklist", "^rm .*,^shutdown.*,^reboot.*" ] } } }
Note: If both whitelist and blacklist are specified, the system will first check whether the command is in the whitelist, and then check whether it is in the blacklist. The command must pass both checks to be executed.
You can specify multiple SSH connections by passing multiple --ssh parameters, each with a unique name:
npx @fangjunjie/ssh-mcp-server \ --ssh "name=dev,host=1.2.3.4,port=22,user=alice,password=xxx" \ --ssh "name=prod,host=5.6.7.8,port=22,user=bob,password=yyy"
In MCP tool calls, specify the connection name via the connectionName parameter. If omitted, the default connection is used.
Example (execute command on 'prod' connection):
{ "tool": "execute-command", "params": { "cmdString": "ls -al", "connectionName": "prod" } }
Example (execute command with timeout options):
{ "tool": "execute-command", "params": { "cmdString": "ping -c 10 127.0.0.1", "connectionName": "prod", "timeout": 5000 } }
The execute-command tool supports timeout options to prevent commands from hanging indefinitely:
This is particularly useful for commands like ping, tail -f, or other long-running processes that might block execution.
You can use the MCP tool list-servers to get all available SSH server configurations:
Example call:
{ "tool": "list-servers", "params": {} }
Example response:
[ { "name": "dev", "host": "1.2.3.4", "port": 22, "username": "alice" }, { "name": "prod", "host": "5.6.7.8", "port": 22, "username": "bob" } ]
This server provides powerful capabilities to execute commands and transfer files on remote servers. To ensure it is used securely, please consider the following:
--whitelist option to restrict the set of commands that can be executed. Without a whitelist, any command can be executed on the remote server, which can be a significant security risk.ssh-mcp-server is secure. Do not expose the server to untrusted networks.upload and download commands.