SSH MCP Server
Self-hosted MCP server for running commands on remote servers over SSH, with tokens and roles
- 2 ★ on the repository
- Last commit
Broad access
Why this level
- The agent runs arbitrary shell commands on remote servers
- Stores SSH passwords and private keys
- The admin token is printed to logs on first start
Install
- Works in
Manual install
docker compose up -dUses docker-compose.yml from the repo.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The agent runs arbitrary shell commands on remote servers
- Stores SSH passwords and private keys
- The admin token is printed to logs on first start
This is third-party code. Review the repository files before installing.
What it does
Stores SSH server connections in PostgreSQL and lets an agent run commands on them. Passwords, keys and passphrases are stored encrypted. Access uses bearer tokens with permissions to edit connections, execute commands and manage tokens, and execution can be limited by server name patterns. Command history is recorded per sessionId.
Who it is for. DevOps engineers and teams who want to give agents controlled server access.
Good fit when
- Let an agent run diagnostic commands on your servers
- Split access: some tokens execute on a subset of servers, others manage connections
- Keep a history of commands the agent ran
Not a fit when
- You cannot host PostgreSQL and Docker
- Production servers where no agent command is acceptable without manual review
Example request
Check free disk space and memory usage on the staging-web serverMCP
- Transport
- http
- Authentication
- API key
Environment variables
BOOTSTRAP_ADMIN_TOKEN- false disables automatic creation of the first admin token
Limitations
Requires deployment via Docker Compose with PostgreSQL. Transport is stateless Streamable HTTP only. The first admin token is printed to logs once at startup and must be saved immediately. The README is short and shows config only for OpenCode.
How to disable. Remove the ssh block from the client config, delete issued tokens with delete_access_token and stop the server with docker compose down.
FAQ
How do I get the first admin token?
On startup, if no admin exists, the server generates a token and prints it once to logs at WARN level. Disable this with BOOTSTRAP_ADMIN_TOKEN=false.
Can a token delete itself?
No, a token cannot modify or delete itself.
Discussion
No questions or reviews yet.
Related
MCP serversMCP SSH Manager
mcp-ssh-manager
Managing several SSH connections from Claude Code and Codex: commands, file transfer, databases and backups
SSH MCP
ssh-mcp
A security-first SSH server: command classification, policy authorization and several sign-in methods. It runs commands on remote servers
SSH MCP Server (classfang): remote commands over SSH
SSH MCP Server (classfang)
An SSH MCP server: the agent runs commands, reads and writes files over SFTP, transfers files and starts long jobs while credentials stay with you
A self-hosted gateway that merges several MCP servers into one endpoint with auth and tool selection
An MCP server for Linux diagnostics: an AI client reads services, logs and network on local and remote hosts, read-only
A Node.js manager for MCP servers: it starts local servers, connects remote ones and gives a client one address, with a REST API for control
README in short
SSH MCP Server provides access to remote servers via password or private key. Secrets and tokens live in PostgreSQL, and commands have timeouts. The README covers server, execution and token tools, the permission model and the first admin token bootstrap. It runs via Docker Compose, with a connection example for OpenCode.