1Shell MCP
A WebSSH console for VPS with an MCP server: the agent works across several servers while ACL tokens limit tools and hosts.
- 133 ★ on the repository
- Last commit
Broad access
Why this level
- The agent runs commands and scripts on your servers, and a token without an ACL opens every host.
- Remote MCP exposed outward gives server access to anyone holding the token.
- Server logs and command output enter the model's context.
Install
- Works in
Manual install
curl -fsSL https://raw.githubusercontent.com/weidu12123/1Shell/main/install.sh | bashInstalls 1Shell on a local machine or server; `bash install.sh --docker` is also available.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The agent runs commands and scripts on your servers, and a token without an ACL opens every host.
- Remote MCP exposed outward gives server access to anyone holding the token.
- Server logs and command output enter the model's context.
This is third-party code. Review the repository files before installing.
What it does
1Shell is a local platform for managing several VPS: a WebSSH terminal for people and an MCP server for agents. Claude Code, Codex, OpenCode and Hermes connect at `http://localhost:3301/mcp/sse` with the `X-Bridge-Token` header or through `bin/1shell-mcp-stdio.js`. It includes its own 1Shell AI agent with an AgentRun loop, skills in `data/skills` and monitoring through SSH probes. Access is limited by ACL tokens covering tools, hosts, scripts and paths. Key commands and MCP calls go into an audit log. Remote MCP is off by default, enabled explicitly and exposed over HTTPS.
Who it is for. Administrators of several VPS and developers who hand routine server tasks to an agent under token and audit control.
Good fit when
- An agent checks several servers in one request.
- A maintenance script runs on selected hosts with an audit entry.
- An outside agent reaches servers through remote MCP with a token and ACL.
- A web terminal for people and an API for agents are needed at once.
Not a fit when
- Servers hold data where an agent must not run commands.
- Access cannot be protected with HTTPS and tokens.
- A single SSH server without a panel is enough.
Example request
Check load and free space on my VPS through 1Shell and list hosts with disks more than 80 percent full.MCP
- Transport
- sse, stdio
- Authentication
- key is optional
Environment variables
BRIDGE_TOKENsecret- Token for local agent access; an empty value generates it on first start.
Limitations
Documentation is in Chinese. The first install command runs `install.sh` from GitHub through `curl | bash`, so read the script before running it. A token without ACL limits opens every host to the agent, so configure them before connecting. Remote MCP is off by default and should be published over HTTPS only when enabled. In Docker mode host directories are mounted, read-only by default, so check the mount mode before launch.
How to disable. Remove the `1shell` entry from the agent configuration, revoke the Bridge Token and Remote MCP Token in the panel and stop the service.
FAQ
How do I connect an agent locally?
Use `http://localhost:3301/mcp/sse` with an `X-Bridge-Token` header holding your Bridge Token. There is also `bin/1shell-mcp-stdio.js` for stdio.
How do I restrict the agent?
Issue a token with an ACL: it defines the tools, hosts, scripts and paths the agent can reach.
Is remote MCP enabled?
No, it is off by default. Enable it explicitly, create a Remote MCP Token and publish it over HTTPS.
Where is the Bridge Token?
If `BRIDGE_TOKEN` is empty, the token is generated on first start and saved in `data/bridge-token.json`.
Is there an action log?
Yes. Key commands, script runs, Bridge and MCP calls and risky operations go into the audit.
Discussion
No questions or reviews yet.
Related
MCP serversMCP SSH Manager
mcp-ssh-manager
Managing several SSH connections from Claude Code and Codex: commands, file transfer, databases and backups
SSH MCP Server (classfang): remote commands over SSH
SSH MCP Server (classfang)
An SSH MCP server: the agent runs commands, reads and writes files over SFTP, transfers files and starts long jobs while credentials stay with you
Self-hosted MCP server for running commands on remote servers over SSH, with tokens and roles
SSH MCP
ssh-mcp
A security-first SSH server: command classification, policy authorization and several sign-in methods. It runs commands on remote servers
A secure MCP runtime through which an agent operates local machines, servers and containers
The MCP server of the purple SSH manager: an agent reads hosts from ~/.ssh/config and their containers, commands and container control are opt-in
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| 1Shell (this card) | no | key is optional | 133 | |
| SSH MCP Server | no | API key | 2 | gives an agent SSH access to machines; 1Shell adds a web console, monitoring and ACL tokens |
| MCP SSH Manager | no | API key | 532 | manages SSH connections through MCP; 1Shell combines them with a panel and an internal agent |
README in short
The platform combines WebSSH, monitoring, skills, the internal 1Shell AI agent and an MCP server. An audit log covers both human and agent actions.