ssh

The ssh-mcp-server is an MCP (Model Context Protocol) server that enables AI assistants and other MCP-enabled clients to perform remote SSH operations through a standardized interface. It acts as a bridge between the MCP client and remote SSH servers, handling authentication locally and enforcing security controls such as command whitelists/blacklists, and optional SOCKS proxies. You can use the server to run SSH commands, transfer files, and list configured SSH servers without exposing credentials to the client.

To use it, start the server via the MCP command (typically using NPX so you don't need a global install) and provide SSH connection parameters for the target hosts. Once running, connect an MCP client to the server and issue commands through the available tools: execute-command to run SSH commands, upload to transfer files to the remote server, download to bring files back, and list-servers to enumerate configured SSH endpoints. You can control which commands are allowed with whitelist/blacklist patterns and optionally route traffic through a SOCKS proxy if needed.

Prerequisites:

• Node.js (16.x or newer) and npm/yarn installed
• Basic familiarity with running NPX commands

Installation steps:

1. Install Node.js from https://nodejs.org/ or use your system package manager.
2. Run the MCP server directly with NPX (no global install required):

# Example using NPX to run the ssh-mcp-server without installing globally
npx -y @fangjunjie/ssh-mcp-server --help

3. If you want a persistent setup, you can add an npm script in your project, e.g. in package.json:

"scripts": {
  "start-ssh-mcp": "npx -y @fangjunjie/ssh-mcp-server --host 0.0.0.0 --port 8080"
}

4. Alternatively, install locally and run via node_modules binary if needed (not required due to NPX):

npm install @fangjunjie/ssh-mcp-server
npx @fangjunjie/ssh-mcp-server --host 0.0.0.0 --port 8080

Tips and notes:

• The server supports password and private-key authentication; ensure credentials are kept local and not exposed to MCP clients.
• Use the whitelist/blacklist options to tightly control which SSH commands can be executed. If both are provided, a command must pass the whitelist first and then pass the blacklist to be executed.
• You can configure multiple SSH servers and reference them in MCP configurations or via a JSON config file using the --config-file option.
• If you deploy behind a SOCKS proxy, provide the appropriate --socksProxy parameter.
• For multi-server setups, consider using a dedicated JSON config file (as shown in the README) and load it via --config-file to simplify management.
• Ensure network access between the MCP server and the target SSH hosts (firewalls, port openings, and key permissions may affect connectivity).