ssh-mcp
io.github.tufantunc/ssh-mcp · version 2.22.2 · 8,785 weekly npm downloads · audited 2026-11-03
Notes
Findings
No hidden-instruction or invisible-character findings in any tool, prompt, or resource description.
Claude Connectors Directory readiness
- ❌ Every tool has a title Missing on 15 of 15: list-connections, list-sessions, open-session, close-session and 11 more
- ❌ Every tool declares readOnlyHint or destructiveHint Missing on 1 of 15: open-session
- ✅ Tool names are 64 characters or fewer All within limit
- ❌ Descriptions avoid instructions about model behavior or other tools 5 of 15 descriptions reference other tools or tell the model what it must do: read-command, run-command, privileged-command, sftp-upload-file and 1 more
- ✅ No hidden instructions or invisible characters in tool metadata None found
Checks the directory's published tool requirements that are visible from tools/list. Passing them does not guarantee acceptance.
Supply chain
- Install scripts: none
- npm provenance: yes
- Source repository linked: yes
- License: MIT
- Direct dependencies: 9
Tools (15)
| Name | Title | Hint | Description |
|---|---|---|---|
list-connections | read-only | List all configured SSH profiles and their connection status. Use this to discover available hosts before running commands. | |
list-sessions | read-only | List active sessions for a given SSH profile. | |
open-session | none | Open a named session on a remote host. Use type="interactive" for stateful shell (CWD/env persists between commands) or type="background" for long-running processes. | |
close-session | destructive | Close a named session. A background session's command is signalled on the host (INT, then TERM, then KILL) before its channel is dropped; an interactive session's shell is ended. The response says so if the command could… | |
read-session-output | read-only | Read recent output from a background session (e.g., tail -f logs). | |
read-command | read-only | Execute a READ-ONLY command from an allowlist (ls, cat, grep, find, stat, df, etc.). This tool does NOT modify the system. Prefer this tool for all read operations. Single-line only: a command containing a line break is … | |
run-command | destructive | Execute an arbitrary shell command on the remote server. May modify the system. Commands classified destructive or privileged go through the approval gate; approvalPolicy on the profile decides whether that is a prompt, … | |
privileged-command | destructive | Execute a command with sudo elevation. Goes through the approval gate; approvalPolicy on the profile decides whether that is a prompt, an automatic allow, or a refusal. The sudo password is piped via stdin for the prompt… | |
signal-process | destructive | Send a signal (INT, TERM, KILL) to a remote process by PID. | |
sftp-upload | destructive | Upload a file to the remote server via SFTP (secure file transfer, not shell-based). Replaces an existing file at that path unconditionally — there is no overwrite flag and no way to require a new destination. | |
sftp-download | read-only | Download a file from the remote server via SFTP. | |
sftp-list | read-only | List a remote directory over SFTP, with a bounded number of entries and a bounded response size. Read-only. | |
sftp-upload-file | destructive | Upload a local file to the remote host over SFTP, streaming it without passing the contents through model context. The local file must be inside the transferRoot directory the operator configured; without that setting th… | |
sftp-download-file | destructive | Download a remote file to local disk over SFTP, streaming it without passing the contents through model context. The destination must be inside the transferRoot directory the operator configured; without that setting thi… | |
reload-config | destructive | Report or reload the server's config file. action="status" (the default) shows the config path, when it was loaded, the sha256 of its bytes and the result of the last reload; never the contents. action="reload" re-reads … |
Check your own setup
npx mcpvetter scan --liveBadge
Add this to a README:
[](https://mcpvetter.com/servers/ssh-mcp)Publish this server?
Get the MCPVetter verified badge, a re-audit within 24 hours of every npm release, and an email whenever tools, findings, or Claude directory readiness change. $29 per server per month. You prove ownership first, free.