SSH MCP
Executes shell commands securely over SSH on Linux and Windows with password or key-based authentication.
Delv Safety Grade: D
Score 42/100 · assessed 2026-04-28
SSH MCP grants Claude unrestricted shell execution on remote servers over SSH, which is an extremely high-risk capability. Whilst the tool itself appears straightforward and is distributed via npm, the maintainer is a solo developer with limited visibility. The core concern is that this gives an AI agent full remote shell access with whatever privileges the SSH user has, including potential root access. There's no sandboxing, command filtering, or audit trail beyond what SSH itself provides. The tool accepts passwords or SSH keys via configuration, creating credential exposure risk. For production systems, this represents a significant attack surface. The package is open source with basic documentation, but the permissions model is essentially 'full remote access', which scores very poorly on safety. Only appropriate for isolated development environments with non-privileged accounts.
Lethal Trifecta (prompt-injection exposure)
TWO OF THREERemote files private; commands outbound. Untrusted only if you `cat` adversarial files into the model.
Green flags
- Uses standard SSH protocol rather than custom remote execution mechanism
- Distributed via npm with standard installation process
- Open source implementation allows security review
- Supports both password and key-based authentication methods
Red flags
- Grants unrestricted remote shell execution with full SSH user privileges
- Solo maintainer with limited track record and community oversight
- No command filtering, sandboxing, or safety guardrails beyond SSH itself
- Requires SSH credentials (password or key) in configuration files
- Could enable lateral movement if SSH user has elevated privileges
Permissions requested
Install
npx ssh-mcp
Review
Install this if you regularly SSH into dev or staging boxes and want Claude to handle routine ops tasks. Skip it for production systems or if you're not confident auditing shell commands before they run. It's a practical tool for developers who live in terminals, not a replacement for proper infrastructure automation.
Good at
- Lets Claude execute shell commands on remote systems without you switching contexts to a terminal.
- Supports both password and SSH key authentication, so it fits most existing setups.
- Works on Linux and Windows (via OpenSSH), covering the common server OS landscape.
- Useful for debugging and log inspection where you want Claude to suggest and run diagnostic commands in the same conversation.
- Straightforward setup if you're already familiar with SSH configuration.
Watch out
- No sandboxing beyond the remote system's own permissions, so you're trusting Claude with full shell access.
- Can't handle interactive commands or sudo prompts that require user input.
- Not designed for file transfers, so you'll still need scp or rsync for moving files around.
- Community-maintained, so support for edge cases or unusual SSH configurations may be limited.
- Probably too risky for production environments without additional audit and access controls.
Use cases
- server ops
- deployment scripts
- log inspection
- remote debugging
Getting started
Works with
Similar MCPs
- GitHubFull GitHub API access - manage repos, issues, PRs, and code search. One of the most useful MCPs for any developer workflow.
- GrafanaGrafana Labs' official MCP. Read dashboards, datasources, alerts, and run Loki/Prometheus queries from inside your agent.
- SentryPull live errors, issues, and replays from Sentry into Claude. Great for debugging sessions where the model can see what actually broke in prod.
- MCP CLIInteractive CLI inspector for MCP servers supporting OAuth, tool calls, resource reads, and prompt runs.