SSH MCP Server (classfang): remote commands over SSH
SSH MCP Server (classfang)
An SSH MCP server: the agent runs commands, reads and writes files over SFTP, transfers files and starts long jobs while credentials stay with you
- 988 ★ on the repository
- Last commit
- ISC
Broad access
Why this level
- The agent runs commands on a remote server with the chosen user's rights and can change or delete files
- The login password or key sits in the client configuration, and the examples pass the password as a plain argument
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/ssh-mcp-server-classfangDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The agent runs commands on a remote server with the chosen user's rights and can change or delete files
- The login password or key sits in the client configuration, and the examples pass the password as a plain argument
This is third-party code. Review the repository files before installing.
What it does
The server gives an agent access to a remote machine over SSH through standard MCP tools. Login details live in local configuration and are not passed to the model. It supports passwords, private keys (including ones with a passphrase), reuse of ~/.ssh/config, SOCKS5, HTTP and HTTPS proxies, and two-factor login. Tools: execute-command runs a command, upload and download move files and whole directories, read-file and write-file handle text over SFTP, and list-servers shows the configured connections. For tasks that run past the command timeout there are job-start, job-status, job-kill and job-list. Commands can be limited with regular expressions: --whitelist allows only matching commands and --blacklist blocks dangerous ones. The exec transport mode suits ordinary servers, while shell mode is for bastion hosts and devices with an interactive shell only. The server runs over stdio by default and exposes a Streamable HTTP endpoint with --mcp-transport http. The skills folder holds an ssh-mcp-helper skill that builds the right mcp.json fragment through questions.
Who it is for. For developers and administrators who want an agent in Claude Code or Cursor to work on remote servers over SSH without receiving the password.
Good fit when
- The agent must check logs and service state on a remote machine and you allow only ls, cat and df through a whitelist
- You need to push a built directory to a server (upload) or fetch a result (download)
- The host is reached through a bastion or jump host and plain exec fails: transport shell fits
- A build or migration runs past the command timeout and is easier to start as job-start and poll with job-status
- Hosts are already described in ~/.ssh/config and you do not want to repeat them in mcp.json
Not a fit when
- You work on a production server without a command whitelist, which the README strongly recommends there
- You need upload and download in shell mode: SFTP is disabled in that mode, so they do not work
- SSH access is banned by company policy or the machine has no SSH
- You only need to log in to a server once yourself; an ordinary terminal is simpler
- You are tempted to put a password into the configuration in plain text on a shared computer: the examples pass it as a command-line argument
Example request
Connect to myserver, show free disk space and the last 50 lines of the nginx logMCP
- Transport
- stdio, http
- Authentication
- not required
Environment variables
SSH_MCP_2FA_CODEsecret- One-time two-factor code, used together with --try-keyboard.
Limitations
Node.js is required and the server starts through npx. The whitelist matches the whole command, and when it is on, commands with shell control characters such as semicolons, ampersands, pipes, command substitution, redirection or newlines are rejected. Blacklist patterns are case sensitive, and an invalid pattern stops the server from starting. In shell mode commands run one after another and upload and download are unavailable. The examples pass the password as arguments in mcp.json, so a key with a passphrase is safer. ISC licence, last commit on October 15, 2026. The example connection config sets commandTimeoutMs to 120000 and maxOutputBytes to 10485760, so command time and output size are capped.
How to disable. Delete the ssh-mcp-server block from mcpServers in the client configuration (in Claude Code with claude mcp remove if you added it that way) and restart the client. The server does not change SSH keys or ~/.ssh/config.
FAQ
How do I connect SSH to Claude Code over MCP?
Add an MCP configuration with the npx command and the arguments -y @fangjunjie/ssh-mcp-server --host --port --username plus --privateKey or --password. Each parameter and its value are separate elements of the args array and must not be joined with a space. The ssh-mcp-helper skill builds a ready fragment.
Will the model see my password or key?
No, login details stay in the server's local configuration and the model only receives command output. The author describes this as credential isolation.
How do I limit the commands the agent can run?
Use --whitelist and --blacklist: comma-separated lists of regular expressions. The whitelist matches the whole command and the blacklist blocks matches. A command must pass both checks.
What is the difference between exec and shell modes?
exec is the default and supports execute-command, upload and download. shell runs commands through a persistent session with a queue and suits bastion hosts, but SFTP is disabled there, so file transfer does not work.
How do I connect several servers at once?
Give each connection a name and pick it with the connectionName parameter in a call. The README describes four setup methods, and the recommended one is a JSON file where each connection has name, host, port, username and other fields. list-servers shows the configured servers.
Discussion
No questions or reviews yet.
Related
MCP serversSSH MCP
ssh-mcp
A security-first SSH server: command classification, policy authorization and several sign-in methods. It runs commands on remote servers
MCP SSH Manager
mcp-ssh-manager
Managing several SSH connections from Claude Code and Codex: commands, file transfer, databases and backups
Self-hosted MCP server for running commands on remote servers over SSH, with tokens and roles
A Node.js manager for MCP servers: it starts local servers, connects remote ones and gives a client one address, with a REST API for control
The MCP server of the purple SSH manager: an agent reads hosts from ~/.ssh/config and their containers, commands and container control are opt-in
Tmux MCP Server: agent access to tmux sessions
Tmux MCP Server
An MCP server that lets an agent read tmux panes, run commands in them and create sessions while you watch the output
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| SSH MCP Server (classfang): remote commands over SSH (this entry) | no | not required | 988 | |
| SSH MCP | no | API key | 840 | an SSH server with command classification and policy-based authorization |
| MCP SSH Manager | no | API key | 527 | a manager of several SSH connections with databases and backups |
| purple SSH | yes | not required | 761 | the MCP server of the purple SSH manager |
README in short
The README is in Chinese, with an English version in README_EN.md. It covers features, a tool table and ten setup scenarios of rising complexity, from a password to several connections, each with a ready mcp.json fragment. It also has a quick-start section through the ssh-mcp-helper skill and a note that arguments must be split into array elements.