# ssh-mcp

An intermediary gateway giving coding agents guarded remote SSH execution alongside per-token policies, request limits, and structured audit logs.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed · ★ 8
- Author: gelse
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/gelse/ssh-mcp
- Updated: 2026-09-16
- HTML: https://affpapa.org/en/nevibecode/mcp/ssh-mcp

## What it does

The gateway runs via Docker and accepts requests from AI clients over Streamable HTTP. Instead of distributing SSH keys across multiple workstations, administrators define remote targets and command allowlists inside `ssh-mcp-config.json`. The service handles connection pooling, sliding-window rate limiting, and circuit breaking automatically.

Clients interact through six dedicated tools under the `ssh_*` prefix. They can test connectivity, list targets, inspect allowed commands, execute individual actions, and transfer single files via SFTP. Interactive terminal sessions are not supported. File transfers operate on individual files without folder synchronization.

Without a reverse proxy like Traefik or nginx in front, traffic runs without TLS termination.

## Requirements
- Needs: Docker
- A remote (HTTP) option exists: the address is in the README
- Environment variables: `CONFIG_DIR`, `LOG_DIR`, `CONFIG_API_ENABLED`, `CONFIG_API_TOKEN` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Install**
- The MCP registry has no launch command for it: see the repository README

## When to use it
- manage agent SSH access from a single gateway
- enforce command allowlists on remote targets
- isolate failing hosts using circuit breakers
- track agent commands in structured JSONL audit logs
- transfer individual files to remote hosts over SFTP

## Example prompts
- Check connectivity to host `my-server` using `ssh_check_connection`
- Run `uptime` on `my-server` with `ssh_execute_command`
- Download `/var/log/app.log` from the remote server using `ssh_download_file`

## Similar
- [fast-mcp-ssh](https://affpapa.org/en/nevibecode/mcp/fast-mcp-ssh.md) — MCP server · ★ 5
- [ssh](https://affpapa.org/en/nevibecode/mcp/ssh.md) — MCP server · ★ 81
- [Replit SSH](https://affpapa.org/en/nevibecode/mcp/replit-ssh.md) — MCP server · ★ 13
- [SSH MCP Server](https://affpapa.org/en/nevibecode/mcp/ssh-mcp-server.md) — MCP server · ★ 6
- [SSH — policy-gated remote access](https://affpapa.org/en/nevibecode/mcp/ssh-policy-gated-remote-access.md) — MCP server · ★ 838
- [Agentic SSH](https://affpapa.org/en/nevibecode/mcp/agentic-ssh.md) — MCP server · ★ 5

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md