safe-ssh-mcp — Claude Code MCP server
This MCP server connects to remote hosts over SSH and exposes scoped read-only diagnostics. Use it to inspect disks, systemd, cron, and system state.
claude mcp add safe-ssh-mcp -- uvx safe-ssh-mcpWhat safe-ssh-mcp does
safe-ssh-mcp gives an agent a curated set of SSH tools rather than an unrestricted shell. Available checks cover disk capacity and usage, dmesg, uptime, time, /etc/os-release, systemd units and timers, crontab, and a one-shot top view.
The server accepts an SSH account password or a private key. Passphrase handling is configured in mcp_config.ini: ENV_VAR reads SSH_KEY_PASSPHRASE, while KEYCHAIN uses signatures from ssh-agent. The project is tested with Python 3.11, 3.12, 3.13, and 3.14, including a remote Ubuntu server.
Its safety boundary is host-side: the exposed commands are intended to avoid remote modifications. It does not ensure that an external agent will use command output safely, so sensitive diagnostics still need care.
What it helps with
- inspect free space on a remote host
- locate directories consuming disk space
- find failed
systemdunits - review timers and
cronjobs - capture a one-shot system load snapshot
Example prompts for the agent
- Check disk space on
myserver.mydomain.prothroughsafe-ssh-mcpand report the largest paths. - List failed
systemdunits on the remote host and show their statuses. - Inspect
/root/usage over SSH with the key at~/.ssh/id_rsa.
How to install safe-ssh-mcp
Platform CLI
claude mcp add safe-ssh-mcp -- uvx safe-ssh-mcpuvx runs the command named after the package; if the README names another one, use uvx --from safe-ssh-mcp <command>
Platform CLI
codex mcp add safe-ssh-mcp -- uvx safe-ssh-mcpuvx runs the command named after the package; if the README names another one, use uvx --from safe-ssh-mcp <command>
Config file
{
"mcpServers": {
"safe-ssh-mcp": {
"command": "uvx",
"args": [
"safe-ssh-mcp"
]
}
}
}uvx runs the command named after the package; if the README names another one, use uvx --from safe-ssh-mcp <command>
Config file
{
"servers": {
"safe-ssh-mcp": {
"type": "stdio",
"command": "uvx",
"args": [
"safe-ssh-mcp"
]
}
}
}uvx runs the command named after the package; if the README names another one, use uvx --from safe-ssh-mcp <command>
Platform CLI
gemini mcp add safe-ssh-mcp uvx safe-ssh-mcpuvx runs the command named after the package; if the README names another one, use uvx --from safe-ssh-mcp <command>
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about safe-ssh-mcp
How do I install safe-ssh-mcp in Claude Code?
Run claude mcp add safe-ssh-mcp -- uvx safe-ssh-mcp.
What does safe-ssh-mcp do?
It connects to a remote host over SSH and exposes selected read-only commands for inspecting storage, services, system load, and scheduled tasks.
Which SSH authentication methods does it support?
It supports an account password and private-key authentication. A key passphrase can come from SSH_KEY_PASSPHRASE with ENV_VAR or from ssh-agent with KEYCHAIN.
