ssh-mcp-serverBLOCK
基于 SSH 的 MCP 服务 🧙♀️。已被MCP官方收录 🎉。 SSH MCP Server 🧙♀️. It has been included in the community MCP repository 🎉.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
基于 SSH 的 MCP (Model Context Protocol) 服务器,允许通过 MCP 协议远程执行 SSH 命令。
English Document | 中文文档
📝 项目介绍
ssh-mcp-server 是一个桥接工具,可以让 AI 助手等支持 MCP 协议的应用通过标准化接口执行远程 SSH 命令。这使得 AI 助手能够安全地操作远程服务器,执行命令并获取结果,而无需直接暴露 SSH 凭据给 AI 模型。
💬 如有任何问题,欢迎加入微信群交流:
✨ 功能亮点
- 🔒 安全连接:支持多种安全的 SSH 连接方式,包括密码认证和私钥认证(支持带密码的私钥)
- 🛡️ 命令安全控制:通过灵活的黑白名单机制,精确控制允许执行的命令范围,防止危险操作
- 🔄 标准化接口:符合 MCP 协议规范,与支持该协议的 AI 助手无缝集成
- 🚇 双传输模式:同时支持
exec和shell两种 transport,兼容直连主机与堡垒机或跳板机场景 - 📂 文件传输:支持双向文件传输功能,可上传本地文件到服务器或从服务器下载文件
- 🔑 凭据隔离:SSH 凭据完全在本地管理,不会暴露给 AI 模型,增强安全性
- 🚀 即用即走:使用 NPX 可直接运行,无需全局安装,方便快捷
📦 开源仓库
GitHub:https://github.com/classfang/ssh-mcp-server
NPM: https://www.npmjs.com/package/@fangjunjie/ssh-mcp-server
🛠️ 工具列表
b4a6041f0078OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add ssh-mcp-server --env SSH_AUTH_SOCK=${SSH_AUTH_SOCK} --env SSH_MCP_PASSPHRASE=${SSH_MCP_PASSPHRASE} -- npx -y @fangjunjie/[email protected]{
"mcpServers": {
"ssh-mcp-server": {
"command": "npx",
"args": [
"-y",
"@fangjunjie/[email protected]"
],
"env": {
"SSH_AUTH_SOCK": "${SSH_AUTH_SOCK}",
"SSH_MCP_PASSPHRASE": "${SSH_MCP_PASSPHRASE}"
}
}
}
}Exposed tools (10)
5 read · 4 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
download | read | |
execute-command | write | |
job-kill | destructive | |
job-list | read | |
job-start | write | |
job-status | read | |
list-servers | read | |
read-file | read | |
upload | write | |
write-file | write |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (4 observation(s))
- Network
- none-observed
- Shell
- declared (3 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (12)
const defaultNames = ["id_rsa", "id_ecdsa", "id_ed25519", "id_xmss", "id_dsa"];
--ssh-config-file <path> Read host aliases from SSH config (default: ~/.ssh/config)
job-kill
exec(command, optionsOrCallback, maybeCallback) {privateKey: '~/.ssh/prod_key'
IdentityFile ~/.ssh/test_key
privateKey: '~/.ssh/key2'
readFileSync(new URL("../../package.json", import.meta.url), "utf8"),() => manager.validateRemotePath('/home/ops/inbox/../../../etc/passwd', 'dev'),() => manager.validateRemotePath('/home/ops/inbox/../../../etc/passwd', 'dev'),for (const bad of ['', 'nope', 'job-abcdefgh-0000; rm -rf /', '../../etc']) {@modelcontextprotocol/sdk, socks, ssh2, zod, @types/node, @types/ssh2, typescript
Gates applied: no_behavioural_pass.
b4a6041f0078full audit observations/trust-audit/mcp-server/classfang__ssh-mcp-server.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | b4a6041f0078 | BLOCK | D | 69 | first audit |
Questions
What is the @fangjunjie/ssh-mcp-server MCP server?
基于 SSH 的 MCP 服务 🧙♀️。已被MCP官方收录 🎉。 SSH MCP Server 🧙♀️. It has been included in the community MCP repository 🎉.
What tools does @fangjunjie/ssh-mcp-server expose?
10 in total: 5 read-only, 4 that write, and 1 that can delete or overwrite (job-kill). Every one is listed on this page with its risk.
Is @fangjunjie/ssh-mcp-server safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does @fangjunjie/ssh-mcp-server need?
It reads SSH_AUTH_SOCK and SSH_MCP_PASSPHRASE from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @fangjunjie/ssh-mcp-server run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @fangjunjie/ssh-mcp-server at 1.10.0.
How current is this page?
The grade is for one exact copy of the source (b4a6041f0078), read on 2026-10-12. The repository is watched and re-audited when it changes.