MCP server · Audited from source

mcp-ssh-manager

by bvisible/mcp-ssh-managerMIT licenceAudited 25 Oct 2026 · source 32144cfc32e5

npm mcp-ssh-manager 3.8.7stdio★ 519

✕BLOCKGrade D · 69/100 · 25 Oct 2026 · 32144cf

Safer alternatives View source on GitHub ↗

Is it safe? No — BLOCK, grade D (69/100). It exposes 1 tool: 1 read, 0 write and 0 destructive. The audit recorded 26 findings (0 critical, 5 high, 2 medium, 16 low). Maintainer's description: MCP SSH Server: 37 tools for remote SSH management | Claude Code & OpenAI Codex | DevOps automation, backups, database operations, health monitoring

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “mcp-ssh-manager (bvisible/mcp-ssh-manager)”. Retrieved 25 Oct 2026. https://modelsatlas.com/mcp/bvisible/mcp-ssh-manager

Why this is BLOCK. The audit found 0 critical and 5 high findings; the most severe is Filesystem / path at cli/commands/server.sh:43. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

Trust audit

Audit 0.4.1 · full source read 25 Oct 2026

Trust score69/100✕BLOCK D

0 critical5 high2 medium16 low3 info

26 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemDeclared15 observations
NetworkNone observedNothing seen in the source
ShellDeclared5 observations
DependenciesNot pinnedSome ranges float
SecretsFoundSee the findings

Findings (26)

Sorted by severity · the 25 most severe of 26 are listed

HIGHFilesystem / pathfs.credential_store · cli/commands/server.sh:43

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

prompt_input "SSH key path" "$HOME/.ssh/id_rsa" "auth_value"

Why: touches a credential store
Fix: —

HIGHFilesystem / pathfs.credential_store · cli/install.sh:98

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

echo "  ~/.ssh-manager/              # Config directory"

Why: touches a credential store
Fix: —

HIGHFilesystem / pathfs.credential_store · cli/lib/menu.sh:150

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

echo "  • ~/.ssh/id_rsa (default RSA key)"

Why: touches a credential store
Fix: —

HIGHFilesystem / pathfs.credential_store · cli/lib/menu.sh:151

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

echo "  • ~/.ssh/id_ed25519 (modern ED25519 key)"

Why: touches a credential store
Fix: —

HIGHFilesystem / pathfs.credential_store · cli/lib/menu.sh:152

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

echo "  • ~/.ssh/custom_key (custom key)"

Why: touches a credential store
Fix: —

MEDIUMHard-coded secretssecret.generic · tests/test-logger-redaction.js:28

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.generic · tests/test-sudo-stdin.js:23

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

LOWInventory / provenanceinv.hidden_file · .flake8

F-13 Inventory / provenanceCWE-1104Layer L0

.flake8

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInventory / provenanceinv.hidden_file · .pre-commit-config.yaml

F-13 Inventory / provenanceCWE-1104Layer L0

.pre-commit-config.yaml

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWCode injectioncode.eval_exec · tests/test-sudo-stdin.js:50

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

exec(cmd, cb) {

Why: evaluates text as code
Fix: remove; use a parser or a dispatch table

LOWFilesystem / pathfs.traversal · cli/migrate.sh:20

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

"../../mcp-ssh-manager/.env"

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · tests/test-backup-monitor-injection.js:257

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

for (const bad of ['', '..', '.', '../../etc/passwd', 'a/b', 'a\\b', 'x\ntouch CANARY', 'x\u0000y', null, undefined]) {

Why: No further detail recorded for this rule.
Fix: —

LOWSupply chainsupply.unpinned · package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

@iarna/toml, @modelcontextprotocol/sdk, dotenv, ssh2, zod, eslint, knip, prettier

Why: 9 dependency range(s) float
Fix: pin exact versions or ship a lockfile

LOWPrompt injectionprompt.credential_read · CLAUDE.md:223

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

5. **Environment Loading**: Uses dotenv to load configuration from `.env` file in project root

Why: asks the agent to read credentials
Fix: —

LOWPrompt injectionprompt.credential_read · mcp-ssh-manager-setup.md:93

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

// Load environment variables

Why: asks the agent to read credentials
Fix: —

LOWPrompt injectionprompt.credential_read · mcp-ssh-manager-setup.md:99

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

// Load server configuration from .env

Why: asks the agent to read credentials
Fix: —

LOWPrompt injectionprompt.persistence · INSTALLATION.md:108

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

# Add to your PATH

Why: instructs the agent to persist itself in the user's environment
Fix: —

LOWPrompt injectionprompt.persistence · cli/README.md:218

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

# Add to ~/.bashrc or ~/.zshrc

Why: instructs the agent to persist itself in the user's environment
Fix: —

LOWPrompt injectionprompt.persistence · cli/README.md:247

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

# Add to PATH if needed

Why: instructs the agent to persist itself in the user's environment
Fix: —

LOWSupply chainprompt.pipe_to_shell · CHANGELOG.md:94

F-08 Supply chainCWE-829 · CWE-1357Layer L2

fifth field, so a schedule such as `* * * * * curl ... | sh #` installed a job of

Why: No further detail recorded for this rule.
Fix: —

LOWSupply chainprompt.pipe_to_shell · README.md:147

F-08 Supply chainCWE-829 · CWE-1357Layer L2

- **`readonly`** — blocks mutating tools (`ssh_upload`, `ssh_deploy`, `ssh_sync`, `ssh_execute_sudo`, `ssh_backup_*`, `ssh_db_import/dump`, plus action-gated `ssh_key_manage accept|remove`, `ssh_alert

Why: No further detail recorded for this rule.
Fix: —

LOWSupply chainprompt.pipe_to_shell · README.md:449

F-08 Supply chainCWE-829 · CWE-1357Layer L2

- **`readonly`** — blocks `ssh_upload`, `ssh_deploy`, `ssh_sync`, `ssh_execute_sudo`, backup/db write tools, and built-in destructive commands (`rm`, `mv`, `sudo`, `systemctl restart`, redirects outsi

Why: No further detail recorded for this rule.
Fix: —

LOWPrompt injectionprompt.transfer_instruction · README.md:165

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

- **🎯 Marker-based SSH session sync** — UUID v4 protocol boundaries with `ECHO: 0` PTY, real `$?` exit codes, no more "Timeout waiting for shell prompt" on custom/slow/AIX shells ([#30](https://github

Why: an instruction to move sensitive data to an outside destination
Fix: remove; a skill never needs the user's secrets off the machine

INFOInventory / provenanceinv.oversize · docs/images/[email protected]

F-13 Inventory / provenanceCWE-1104Layer L0

docs/images/[email protected]

Why: 1641240 bytes not read
Fix: —

INFOInventory / provenanceinv.oversize · docs/images/ssh-manager-cli-menu.png

F-13 Inventory / provenanceCWE-1104Layer L0

docs/images/ssh-manager-cli-menu.png

Why: 1559581 bytes not read
Fix: —

Tools it exposes

1 declared in source · 0 destructive

1 read0 write0 destructive

Tool	What it does	Risk
`minimal`	Minimal profile	read

Safer alternatives

All cloud & infra servers →

SpotDB✓SAFE

aliengiraffe/spotdb

Give your agents a secure, containerized SQL sandbox with MCP or API access enabled with DuckDB. No infra required, quick spin-up cycle. Push any CSV — query, analyze, and move on.

Grade B

Pullmd✓SAFE

aeternalabshq/pullmd

Self-hosted URL- and file-to-Markdown service for humans and AI agents - web pages, documents, images, audio, YouTube. PWA + REST + MCP + Claude Code skill, Reddit-aware, refreshable share links.

3 readGrade B

BigQuery✓SAFE

ergut/mcp-bigquery-server

A Model Context Protocol (MCP) server that provides secure, read-only access to BigQuery datasets. Enables Large Language Models (LLMs) to safely query and analyze data through a standardized interface.

1 writeGrade B

Audit history

2026-10-25
✕BLOCK D 69 / 100
First audit · 32144cfc32e5

README badge

Badges show the current verdict, BLOCK included

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about mcp-ssh-manager

What is the mcp-ssh-manager MCP server?

MCP SSH Server: 37 tools for remote SSH management | Claude Code & OpenAI Codex | DevOps automation, backups, database operations, health monitoring

What tools does mcp-ssh-manager expose?

1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is mcp-ssh-manager safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does mcp-ssh-manager need?

It reads SSH_AUTH_SOCK, SSH_E2E_KEYPATH, SSH_E2E_PASSPHRASE and SSH_E2E_PASSWORD from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does mcp-ssh-manager run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as mcp-ssh-manager at 3.8.7.

How current is this page?

The grade is for one exact copy of the source (32144cfc32e5), read on 2026-10-25. The repository is watched and re-audited when it changes.

I already installed mcp-ssh-manager. What should I do?

Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.

Can the verdict change?

Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

bvisible/mcp-ssh-manager on GitHub — the source we read, its licence, stars and activityObserved · 25 Oct 2026
ModelsAtlas trust audit — BLOCK verdict for commit 32144cfc32e5Observed · 25 Oct 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the mcp-ssh-manager MCP server?
GChatGPT CClaude PPerplexity
What tools does mcp-ssh-manager expose?
GChatGPT CClaude PPerplexity
Is mcp-ssh-manager safe to connect to an agent?
GChatGPT CClaude PPerplexity