SSHSAFE
DEPRECATED — succeeded by SSH-Connect (Rust rewrite): https://github.com/mixelpixx/SSH-Connect
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A Model Context Protocol (MCP) server that provides comprehensive SSH and serial console access to remote servers and network devices. Enables AI tools like Claude Desktop to securely manage Linux servers, network switches, and infrastructure devices through both network SSH connections and direct USB-to-Serial console access.
Features
Core SSH Capabilities
- SSH connection management with password or key-based authentication
- Remote command execution with timeout handling
- File upload and download via SFTP
- Directory listing and file operations
- Secure connection handling
Network Device Management
- USB-to-Serial Console Access - Direct console connections via FTDI and other USB adapters
- Network Switch Management - Full support for Cisco IOS/IOS-XE and Aruba switches
- Device Discovery - Automatic detection of switch types and capabilities
- Configuration Management - Backup, restore, and automated configuration
- Network Diagnostics - Built-in ping, traceroute, and connectivity testing
- Console-to-SSH Transition - Automated SSH setup via console connection
- Firmware Management - Upload, verify, install, and rollback switch firmware
Server Management
- Ubuntu server management tools (Nginx, SSL, packages, firewall)
- Compatible with Claude Desktop, VS Code, and other MCP-compatible clients
Real-World Production Testing
This tool has been extensively tested in production network environments:
- Network Discovery - Successfully discovered previously unknown fluttering ports on production switches that were causing intermittent connectivity issues
- Zero Downtime - Managed multiple switches in live production networks without causing any network disruptions or outages
- Time Savings - Automated SSH configuration reduced switch setup time from 15-20 minutes to under 2 minutes
- Reliability - Zero incidents during production deployments across multiple network devices
- **USB-
da998c163264OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add mcp-ssh-server -- npx -y [email protected]
{
"mcpServers": {
"mcp-ssh-server": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (6)
4 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
ssh_connect | read | Connect to a remote server via SSH |
ssh_disconnect | read | Close an SSH connection |
ssh_download_file | read | Download a file from the remote server |
ssh_exec | write | Execute a command on the remote server |
ssh_list_files | read | List files in a directory on the remote server |
ssh_upload_file | write | Upload a file to the remote server |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (2)
@modelcontextprotocol/sdk, ssh2, serialport, @serialport/parser-readline, @types/node, @types/ssh2, typescript, ts-node
Gates applied: no_behavioural_pass, no_license.
da998c163264full audit observations/trust-audit/mcp-server/mixelpixx__ssh-4.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | da998c163264 | SAFE | B | 89 | first audit |
Questions
What is the SSH MCP server?
DEPRECATED — succeeded by SSH-Connect (Rust rewrite): https://github.com/mixelpixx/SSH-Connect
What tools does SSH expose?
6 in total: 4 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is SSH safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does SSH need?
No credential environment variables were found in its source, so it appears to need none.
How does SSH run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as mcp-ssh-server at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (da998c163264), read on 2026-10-08. The repository is watched and re-audited when it changes.