SSH MCP Server
Self-hosted MCP server for running commands on remote servers over SSH, with tokens and roles
Install
docker compose up -dUses docker-compose.yml from the repo.
This is third-party code. Review the repository files before installing.
What it does
Stores SSH server connections in PostgreSQL and lets an agent run commands on them. Passwords, keys and passphrases are stored encrypted. Access uses bearer tokens with permissions to edit connections, execute commands and manage tokens, and execution can be limited by server name patterns. Command history is recorded per sessionId.
Who it is for. DevOps engineers and teams who want to give agents controlled server access.
Good fit when
- Let an agent run diagnostic commands on your servers
- Split access: some tokens execute on a subset of servers, others manage connections
- Keep a history of commands the agent ran
Not a fit when
- You cannot host PostgreSQL and Docker
- Production servers where no agent command is acceptable without manual review
Example request
Check free disk space and memory usage on the staging-web serverLimitations
Requires deployment via Docker Compose with PostgreSQL. Transport is stateless Streamable HTTP only. The first admin token is printed to logs once at startup and must be saved immediately. The README is short and shows config only for OpenCode.
How to disable. Remove the ssh block from the client config, delete issued tokens with delete_access_token and stop the server with docker compose down.
MCP
- Transport
- http
- Authentication
- API key
| Environment variables | |
|---|---|
| BOOTSTRAP_ADMIN_TOKEN | false disables automatic creation of the first admin token |
Security check
- The agent runs arbitrary shell commands on remote servers
- Stores SSH passwords and private keys
- The admin token is printed to logs on first start
README in short
SSH MCP Server provides access to remote servers via password or private key. Secrets and tokens live in PostgreSQL, and commands have timeouts. The README covers server, execution and token tools, the permission model and the first admin token bootstrap. It runs via Docker Compose, with a connection example for OpenCode.
FAQ
How do I get the first admin token?
On startup, if no admin exists, the server generates a token and prints it once to logs at WARN level. Disable this with BOOTSTRAP_ADMIN_TOKEN=false.
Can a token delete itself?
No, a token cannot modify or delete itself.
Related
Kubernetes MCP
MCP Server Kubernetes
MCP server for managing a Kubernetes cluster through kubectl and Helm, with a non-destructive mode
HashiCorp's official MCP server for the Terraform Registry and HCP Terraform: providers, modules, policies and workspaces
CLI for full-cycle CI/CD to Kubernetes: image builds, Helm-based deploys and container registry cleanup
Terraform Skill
Terraform & OpenTofu Skill for AI Agents
A Terraform and OpenTofu best-practices skill: tests, modules, state, CI/CD and security scanning for AWS, Azure and GCP