MCP SSH Manager - SSH Remote Server Management via Model Context Protocol 🚀

A Model Context Protocol (MCP) server that enables Claude Code and OpenAI Codex to manage multiple SSH connections. Execute commands, transfer files, manage databases, create backups, monitor health, and automate DevOps tasks across your servers — directly from your AI assistant.

🎉 What's New in v3.8.5

🔒 Security release — three command-injection advisories fixed, one of which defeated readonly mode (Released: August 28, 2026)

Upgrade if you use ssh_backup_*, ssh_db_dump, ssh_service_status or ssh_tail — and especially if you rely on the readonly / restricted security modes.

• 🔴 RCE bypassing readonly / restricted (GHSA-m793-whw6-f537) — ssh_service_status and ssh_tail are read-only, so they stay enabled on servers you locked down, and neither quoted its arguments nor consulted the policy layer. A service name like nginx; id > /tmp/pwned executed. This defeated the exact control those modes exist to provide.
• 🔴 RCE through ssh_db_dump (GHSA-796j-h5q5-jx6p) — the stat command run after the dump interpolated the output path raw. The v3.6.7 patch had stopped one line short.
• 🟠 RCE through every ssh_backup_* tool (GHSA-qwwm-vrm9-4mw8) — backup-manager.js had zero shell escaping across its 9 builders, while database-manager.js had 95. The v3.6.7 fix was never extended to it.

The quoting helper now lives in one module (src/shell-quote.js) so "did this builder quote its inputs?" has a single answer, and a new test drives 340 builder × argument × payload combinations through a real shell to prove none of them execute.

Read full changelog →

🔐 Giving an agent SSH access, safely

An MCP SSH server is the most dangerous tool you can hand an AI agent: a shell on machines that matter. This one is built so you decide how far the agent can go — per server, not globally.

SSH_SERVER_PROD_MODE=readonly
SSH_SERVER_STAGING_MODE=restricted
SSH_SERVER_STAGING_ALLOW_PATTERNS=^systemctl (status|restart) myapp$;^tail -n \d+ /var/log/

Alongside that:

• The sudo password never reaches the remote command line. It travels on the SSH channel's stdin, so it is not visible in ps, in /proc/<pid>/cmdline, or in an auditd trail — unlike the echo "$pass" | sudo -S pattern common in this category (#34).
• Every database argument is shell-quoted through one centralised helper, guarded by a 648-combination injection test.
• Read-only SQL is enforced, not suggested: ssh_db_query refuses anything that is not a SELECT.
• Vulnerabilities are published, not buried. See SECURITY.md for the reporting process and the advisories already fixed.
• Reproducible installs: the lockfile is committed, CI installs with npm ci, and a test enforces that every dependency resolves to registry.npmjs.org with an integrity hash and no unreviewed install scripts.

Previous Releases

v3.8.4 - Secrets stop reaching the log, CodeQL on every commit (August 28, 2026)

• 🔒 The logger no longer writes secrets in clear text — it writes to ~/.ssh-manager.log and stderr (which your MCP host captures), so one call site handing it a server config would have persisted a production password. Redaction now happens inside the logger. Also: CodeQL on every push, every action pinned by SHA, and a broken example that never parsed. Full changelog →

v3.8.2 / v3.8.3 - Sudo password leak fixed, MCP Registry, signed releases (August 28, 2026)

• 🔒 The sudo password no longer reaches the remote command line (#34) — it travelled through echo "<password>" | sudo -S, readable in ps and /proc/<pid>/cmdline by every account on the host. It now goes over the SSH channel's stdin. Also: listed in the official MCP Registry as io.github.bvisible/mcp-ssh-manager, releases published from CI with SLSA provenance and a CycloneDX SBOM, and the per-server security modes documented at last. Full changelog →

v3.8.1 - Reproducible installs and blocking quality gates (August 28, 2026)

• Committed lockfile (#60 — contributed by @cudatuda) plus npm run test:lockfile guarding it against drift and tampering. CI installs with npm ci; ESLint and the JSDoc typecheck became blocking gates after being purely decorative. Full changelog →

v3.8.0 - Groups in your config, ssh_sync on Windows, tunnel crash fix (August 14, 2026)

• 👥 New optional group field per server (#56 — contributed by @ice616, requested in #55) — tag a server with group = "production" and it is in that group: ssh_execute_group resolves members straight from your .env/TOML, union'd with any .server-groups.json you already keep. Also: ssh_sync fixed from a Windows host (#59 — contributed by @2836603852), a tunnel on a busy port no longer takes the whole MCP server down, the @modelcontextprotocol/sdk floor raised to ^1.30.0 over three advisories, and JSDoc type-checking added to CI. Full changelog →

v3.7.0 - Per-server SSH agent forwarding (July 13, 2026)

• 🔗 New opt-in FORWARD_AGENT / forward_agent option (#53 — requested by @raphaelbahat in #52) — the equivalent of OpenSSH's ForwardAgent yes, per server: processes on the remote host authenticate to other SSH hosts with the keys in your local ssh-agent, without copying any private key. Requires a running agent and defaults to false. Full changelog →

v3.6.7 - Security: command injection fix in the database helpers (July 11, 2026)

• 🔒 Every ssh_db_* argument is now shell-quoted (#51 — responsibly disclosed by Ugur Ozer, Aeon AI Risk Management (http://airiskmanagement.ca), see #48) — caller-controlled values (ssh_db_list most notably, which stayed allowed in readonly/restricted modes) were interpolated into shell-evaluated strings, allowing arbitrary command execution on the SSH target. A centralized shellQuote() now wraps every value across all 15 builders, guarded by a 648-combination injection test. Full changelog →

v3.6.6 - SUDO_PASSWORD / DEFAULT_DIR / ssh_sync key auth work again (July 11, 2026)

• 🔑 camelCase config field reads (#50 — thanks @egoan82) — since the v3.0.0 ConfigLoader refactor, ssh_execute_sudo ignored SUDO_PASSWORD, DEFAULT_DIR was ignored by ssh_execute/ssh_group_execute/ssh_list_servers, and ssh_sync never passed the configured SSH key to rsync. All aligned with the loader's camelCase fields, with a regression test locking the loader output shape. Full changelog →

v3.6.5 - ssh_db_query shell-injection security fix + real row_count (June 30, 2026)

• 🔒 Queries are delivered on stdin via a single-quoted heredoc (#44, #45 — thanks @technophile77) — the remote shell no longer parses backticks/$(…) ins