MCP SSH Manager

MCP SSH Manager is an open-source Model Context Protocol (MCP) server published by GitHub user bvisible that lets AI coding assistants like Claude Code and OpenAI Codex control remote servers over SSH. It is available on npm as mcp-ssh-manager under the MIT license and is installed globally or via npx. The project has accumulated 434 stars and 52 forks on GitHub since its creation in August 2025.

What It Is

MCP SSH Manager bridges AI assistants and remote infrastructure by exposing 37 MCP tools that cover the full DevOps lifecycle: executing shell commands, uploading and downloading files, syncing directories with rsync, managing persistent SSH sessions, running database operations, creating and restoring backups, monitoring server health, managing SSH tunnels, and executing commands across server groups. It supports .env and TOML configuration formats, making it compatible with both Claude Code and OpenAI Codex workflows simultaneously.

Tool Architecture and Groups

The 37 tools are organized into six groups that can be enabled or disabled independently to reduce AI context consumption:

• Core (5 tools) — always-on: list servers, execute, upload, download, sync
• Sessions (4 tools) — persistent SSH sessions that maintain shell context across calls
• Monitoring (6 tools) — health checks (CPU, RAM, disk, network), service status, process management, configurable alert thresholds
• Backup (4 tools) — automated backups for MySQL, PostgreSQL, MongoDB, and file systems with cron scheduling and retention policies
• Database (4 tools) — dump, import, schema exploration, and SELECT-only query execution with SQL injection prevention
• Advanced (14 tools) — deployment, sudo execution, SSH tunnels, server groups, aliases, hooks, and profiles

The README states that enabling only the Core group reduces context usage by approximately 92% (from ~43.5k tokens to ~3.5k tokens), which matters for AI assistants with limited context windows.

Security Model

The server implements a layered security approach. Starting with v3.5.0, each server can be assigned one of three per-server security modes: unrestricted (default, zero overhead), readonly (blocks mutating tools and a built-in denylist of destructive shell commands), or restricted (every command must match at least one ALLOW_PATTERNS regex and no DENY_PATTERNS regex, with DENY winning). An opt-in JSONL audit log records tool invocations, arguments, policy decisions, and exit codes, with sensitive fields automatically redacted. Command aliases are expanded before policy evaluation to prevent bypass.

Connectivity and Platform Support

The server handles complex network topologies through ProxyJump (bastion/jump host chaining with circular-reference detection), ProxyCommand (SOCKS5 and custom proxy commands), and per-server SSH agent forwarding. Authentication supports passwords, SSH keys, passphrase-protected keys via ssh-agent or inline configuration, and OpenSSH 9.x algorithm negotiation (curve25519-sha256, aes128/256-gcm, hmac-sha2-256/512-etm). Windows OpenSSH hosts are supported via a per-server platform=windows flag that bypasses Linux-specific command wrappers. The tool runs on Linux, macOS, and Windows and requires Node.js v18 or higher.

Update: v3.8.0 (August 14, 2026)

The current release is v3.8.0, published August 14, 2026. Key changes include a new optional group field per server in .env/TOML that eliminates the need for a separate .server-groups.json file, a Windows ssh_sync path-conversion fix for MSYS2 rsync, a crash fix for ssh_tunnel_create on already-bound ports (previously took down the entire MCP server process), a security floor raise for @modelcontextprotocol/sdk to ^1.30.0 to clear three published advisories, and the addition of JSDoc type-checking in CI. The project has published 24 versions since launch, with active community contributions across security disclosures, Windows compatibility, and cross-platform fixes.