SSH - policy-gated remote access MCP Server

SSH MCP Server is a security-first Model Context Protocol server that gives LLM agents controlled SSH access to remote hosts - with command classification, policy-based authorization, human-in-the-loop approval, and full audit logging. Its 11 documented tools cover session, command, sftp. It runs locally over stdio via the published package.

People connecting this server to Claude, Cursor, VS Code, or another MCP client. The project is written in TypeScript.

VERIFIED ACTIVE

LAST COMMIT 2026-08-24 · ★ 655 · #530 OF 848 MAINTAINED OTHER · VERIFIED 2026-08-25

MIT · TypeScript servers · how we verify → /methodology

01 · Install SSH - policy-gated remote access

before you install - you'll need

Set SSH_MCP_PASSWORD, SSH_AUTH_SOCK before connecting.

Claude Code

claude mcp add tufantunc-ssh-mcp -- npx -y ssh-mcp

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "tufantunc-ssh-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "ssh-mcp"
      ]
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as local process (stdio) - runs on your machine with your user's permissions

license MIT - declared in the repository

npm package ssh-mcp - unscoped; check the name against the project README before installing

registry namespace io.github.tufantunc is GitHub-verified and matches the repo owner

03 · What SSH - policy-gated remote access can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

What you can build

With this server connected, an agent can discover available hosts and connection status, list active sessions per host, create a named interactive (stateful) or background session, and close a session. A background session's command is signalled (INT/TERM/KILL) before its channel is dropped.

Capability map

Tools grouped from the project's README - what SSH - policy-gated remote access lets an agent do.

read & search

3 tools - e.g. Discover available hosts and connection status; List active sessions per host; Read output from background sessions (e.g., tail -f)

list-connections · list-sessions · read-session-output

Command

3 tools - e.g. Execute allowlisted read-only commands (ls, cat, grep, ...); Execute arbitrary commands (destructive ones need approval); Execute with sudo (always requires approval)

read-command · run-command · privileged-command

Sftp

2 tools - e.g. Upload a file via SFTP; Download a file via SFTP

sftp-upload · sftp-download

Open

1 tool - e.g. Create a named interactive (stateful) or background session

open-session

1 tool - e.g. Close a session. A background session's command is signalled (INT/TERM/KILL) before its channel is dropped

close-session

Signal

1 tool - e.g. Send INT/TERM/KILL to a remote PID

signal-process

Latest releases

v2.4.0 · 2026-08-24

Thanks @tufantunc! - Start without a config, so the server can be introspected before it is configured. · Starting with nothing configured used to be fatal. Measured against the published image, initialize and…

v2.3.4 · 2026-08-24

Thanks @tufantunc! - List ssh-mcp on the official MCP registry, and keep the listing current from the release that produces it. · registry.modelcontextprotocol.io verifies that whoever registers…

v2.3.3 · 2026-08-20

Thanks @tufantunc! - Verify the stop instead of assuming it - and audit the one path that signals a host without a record. · Follow-up to the #146 fix, from two review rounds on it. Every item is the same shape as the…

04 · Who maintains SSH - policy-gated remote access

SSH - policy-gated remote access is maintained by tufantunc. We track 2 MCP servers from tufantunc - 2 actively maintained, 656 combined GitHub stars, oldest repo from Apr 2025.

05 · Facts

repository: github.com/tufantunc/ssh-mcp
website: https://github.com/tufantunc/ssh-mcp#readme
category: other - ranked #530 of 848 actively-maintained other servers as of 2026-08-25.
release cadence: 10+ releases in the last 90 days (latest 2026-08-24)
registry: io.github.tufantunc/ssh-mcp (active, first published 2026-08-24 · 2 versions)
packages: npm:ssh-mcp

06 · SSH - policy-gated remote access FAQ

Is SSH - policy-gated remote access still maintained?

Yes - as of 2026-08-25, its last commit was 2026-08-24 and it shipped 10+ releases in the last 90 days. We re-verify nightly.

What can SSH - policy-gated remote access do?

How do I install SSH - policy-gated remote access?

Run `npx -y ssh-mcp`. The README documents 2 environment variables (SSH_MCP_PASSWORD, SSH_AUTH_SOCK) to set first. Set SSH_MCP_PASSWORD, SSH_AUTH_SOCK before connecting. You can also paste the ready-made client config above.

Does SSH - policy-gated remote access run locally?

Yes - it's a stdio server: it runs on your machine (via npx) with your user's permissions. Your data stays local unless the server itself calls external APIs.

07 · Alternatives to SSH - policy-gated remote access

Alternatives to SSH - policy-gated remote access

Maintained other servers if SSH - policy-gated remote access isn't the fit.

More MCP servers to compare · Ook Cite · Mkdocs MCP · Hilan MCP · Ui5 MCP Server · Webcomponents MCP Server

More TypeScript MCP servers · Partner Center MCP · Tuteliq MCP Server · Tychi MCP · Type Atlas · Testrail MCP Server · see all