MCP SSH Manager - SSH Remote Server Management via Model Context Protocol 🚀

A Model Context Protocol (MCP) server that enables Claude Code and OpenAI Codex to manage multiple SSH connections. Execute commands, transfer files, manage databases, create backups, monitor health, and automate DevOps tasks across your servers — directly from your AI assistant.

---

🎉 What's New in v3.8.6

🔒 Security release — six advisories fixed. Upgrade. (Released: October 8, 2026)

• 🔴 Command injection on your own machine through the default on-error hook (GHSA-759m-wfpq-xmx3) — the connection error, whose text a server chooses, was pasted into a shell command. Any SSH server you connected to could run a command on the machine running mcp-ssh-manager. Hook values now reach commands as shell variables, never as command text, and the default hook writes its log without a shell.
• 🔴 restricted mode only checked how a line started (GHSA-rfxw-26h6-7w42) — ^echo let echo hi; id through. Every command in a list or pipeline must now match your allowlist; command substitution and writes to files are refused.
• 🔴 cwd reached the shell unquoted (GHSA-37fv-fcpc-j236), past the security policy.
• 🔴 ssh_db_query could write (GHSA-9w6j-vg8f-hp8g, GHSA-q37w-vhpx-q5q9) — SELECT … INTO OUTFILE, SELECT … INTO a new table, and JavaScript in MongoDB queries. Queries now run in a read-only transaction, and a MongoDB query must be a filter document.
• 🟠 Host keys were never compared (GHSA-cwg3-pfmm-w8rm) — a changed host key is now refused, as OpenSSH does. A server reinstalled since its key was recorded needs ssh-keygen -R <host> once.
• ssh_deploy and ssh_backup_schedule quote every value, and a cron schedule must be a schedule.

Hook settings, aliases, the active profile and the logs now live in ~/.ssh-manager/, readable by you alone, instead of inside the installed package, where every upgrade lost them.

Read full changelog → · Previous: v3.8.5, three command-injection advisories.

---

🔐 Giving an agent SSH access, safely

An MCP SSH server is the most dangerous tool you can hand an AI agent: a shell on machines that matter. This one is built so you decide how far the agent can go — per server, not globally.

Mode	What the agent can do
unrestricted (default)	Everything. Same behaviour as any other SSH MCP server.
readonly	Mutating tools are refused outright — no deploy, no upload, no sudo, no database import. Read commands still work.
restricted	Every command must match an allow pattern and no deny pattern. Anything else is refused before it reaches the host.

SSH_SERVER_PROD_MODE=readonly
SSH_SERVER_STAGING_MODE=restricted
SSH_SERVER_STAGING_ALLOW_PATTERNS=^systemctl (status|restart) myapp$;^tail -n \d+ /var/log/

Alongside that: