mcp-ssh-manager — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Recheck a specific changing behavior of github.com/bvisible/mcp-ssh-manager: Is v3.8.5 or later securely enforced and is the v4 host-key trust behavior stable?

Reviewed Oct 9, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Remote server administration and DevOps

What we know

MCP SSH Manager exposes remote SSH and file-sync operations.

Maintenance / activity evidence

Security release v3.8.5 on 2026-08-28 patched three command-injection advisories, including readonly/restricted bypass.

Tracking evidence observed Oct 9, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
HIGH RISK: arbitrary remote shell/SSH and file operations. Versions before v3.8.5 have reported command injection, including readonly policy bypass. Require v3.8.5+ (and fresh advisory check). Default unrestricted. Recommend restricted mode, low-privilege SSH identity, no broad autoApprove. Writes: Execute remote shell commands; Upload, modify or remove remote files; Deploy and manage remote services; Run database mutation/import/restore or backup operations.
Authentication not yet verified.
Direct arbitrary remote shell and file-transfer access. Default mode is unrestricted; configure readonly or restricted and avoid unconditional autoApprove.

Direct arbitrary remote shell and file-transfer access. Default mode is unrestricted; configure readonly or restricted and avoid unconditional autoApprove.
Advisory/security review not completed; no safety badge.
v3.8.5 security release addresses reported injection bypasses affecting readonly/restricted. Source: https://github.com/bvisible/mcp-ssh-manager/releases
Unknown vulnerabilities and provider data handling are not certified by this public tracking review.

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

502 repository stars

Stars observed Oct 9, 2026.

Repository total for bvisible/mcp-ssh-manager.

All limitations / Review context

Is v3.8.5 or later securely enforced and is the v4 host-key trust behavior stable?

No identified material blocker to an accurately qualified public tracking entry in the limited cited evidence. This is not an installation safety certification; product-specific cautions must remain visible.

Direct arbitrary remote shell and file-transfer access. Default mode is unrestricted; configure readonly or restricted and avoid unconditional autoApprove.
Advisory/security review not completed; no safety badge.
v3.8.5 security release addresses reported injection bypasses affecting readonly/restricted. Source: https://github.com/bvisible/mcp-ssh-manager/releases
HIGH RISK: arbitrary remote shell/SSH and file operations. Versions before v3.8.5 have reported command injection, including readonly policy bypass. Require v3.8.5+ (and fresh advisory check). Default unrestricted. Recommend restricted mode, low-privilege SSH identity, no broad autoApprove.
Reviewed write actions: Execute remote shell commands; Upload, modify or remove remote files; Deploy and manage remote services; Run database mutation/import/restore or backup operations
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Remote shell and SSH authority is high impact. Versions before security fix v3.8.5 have reported command injection, including bypass of readonly/restricted; deployment must upgrade and limit privileges.
Unknown vulnerabilities and provider data handling are not certified by this public tracking review.
Release evidence proves attributable activity, not entire installation or tool-level safety.
Current Discovery source binding and atomic apply must be generated using MCP100 existing pipeline.
exact authentication contract
first-party data processing and retention
data retention and permission scope
Extremely high permission scope; documentation recommends auto-approval. Needs risk/security review before publication.
Server-side readonly/restricted safeguards must be explicitly configured; default unrestricted permits arbitrary commands.
Radar public tracking editorial review completed in limited scope; not a security or installation certification. Verify setup according to deployment mode and do not invent unresolved facts.

Original activity observations

Security release v3.8.5 on 2026-08-28 patched three command-injection advisories, including readonly/restricted bypass.

Technical identity

github.com/bvisible/mcp-ssh-manager

Exact implementation source: https://github.com/bvisible/mcp-ssh-manager ↗
Reviewed resource type: MCP Server
Repository identity: bvisible/mcp-ssh-manager

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 9, 2026 · Latest source observation Oct 9, 2026

GitHub repository ↗
bvisible/mcp-ssh-manager
Recorded repository material and project history.
Includes references whose attribution is not established.

Setup · Watchlist

Install & Agents

Publisher instructions.

Source evidence observed Oct 12, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
Use the publisher-documented command or connection method below; complete the prerequisites and client configuration before expecting a usable MCP connection.
npm install -g mcp-ssh-manager
Configure / authenticate
Publisher instructions
Use ssh-manager interactive Server Management > Add New Server to enter approved host, username, port and SSH key; the publisher recommends SSH keys. Then add the source checkout entry to Claude Code with the documented command. Confirm the stored target before any network test.
Check connection
MCP100 setup guide
Use ssh-manager server list to inspect configured host entries. ssh-manager server test attempts network access and must run only against a server you own/are authorized to access; never run write commands or broad scans to validate registration.
ssh-manager server list
Remove / uninstall / revoke
MCP100 setup guide
Remove the matching MCP host registration and stop `mcp-ssh-manager` if running; `npm uninstall -g mcp-ssh-manager` removes the globally installed package but not existing SSH credentials.
npm uninstall -g mcp-ssh-manager

Official Documentation & Sources

What it does

MCP SSH Manager exposes remote SSH and file-sync operations.

Capability: Cloud & DevOps
Resource type: MCP Server
Best fit: Remote server administration and DevOps

Representative uses

SSH command execution
upload/download
database
backups

Limitations

Extremely high permission scope; documentation recommends auto-approval. Needs risk/security review before publication.
Server-side readonly/restricted safeguards must be explicitly configured; default unrestricted permits arbitrary commands.
Radar public tracking editorial review completed in limited scope; not a security or installation certification. Verify setup according to deployment mode and do not invent unresolved facts.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Not documented in the reviewed sources
Permissions: HIGH RISK: arbitrary remote shell/SSH and file operations. Versions before v3.8.5 have reported command injection, including readonly policy bypass. Require v3.8.5+ (and fresh advisory check). Default unrestricted. Recommend restricted mode, low-privilege SSH identity, no broad autoApprove.
Data handling: Not documented in the reviewed sources
Cost: unknown
Risk and cautions: Direct arbitrary remote shell and file-transfer access. Default mode is unrestricted; configure readonly or restricted and avoid unconditional autoApprove.

Access scope and cautions

Write actions: Execute remote shell commands Upload, modify or remove remote files Deploy and manage remote services Run database mutation/import/restore or backup operations
Risk level: high
Security notes: Advisory/security review not completed; no safety badge. v3.8.5 security release addresses reported injection bypasses affecting readonly/restricted. Source: https://github.com/bvisible/mcp-ssh-manager/releases

FAQ

Based on reviewed evidence as of 2026-10-09. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: SSH command execution; upload/download; database; backups.

What setup and authentication are documented?

A complete connection procedure is not verified. Recorded transport: stdio. Client notes: Connect only to disposable least-privilege test host; verify configured restriction denies a destructive test action. Use >= v3.8.5 due to documented command injection advisories; unrestricted is default, explicitly configure readonly/restricted per server. These facts do not supply missing installation commands, credentials or a verified authentication procedure. Authentication: SSH key/host credentials per configured host; defaults to unrestricted command execution unless per-server mode is configured.

Can it modify data or perform write operations?

Documented write actions include: Execute remote shell commands; Upload, modify or remove remote files; Deploy and manage remote services; Run database mutation/import/restore or backup operations. Recorded permission boundary: HIGH RISK: arbitrary remote shell/SSH and file operations. Versions before v3.8.5 have reported command injection, including readonly policy bypass. Require v3.8.5+ (and fresh advisory check). Default unrestricted. Recommend restricted mode, low-privilege SSH identity, no broad autoApprove.

What limitations and risks should I check before use?

Direct arbitrary remote shell and file-transfer access. Default mode is unrestricted; configure readonly or restricted and avoid unconditional autoApprove. Extremely high permission scope; documentation recommends auto-approval. Risk/security review remains necessary. Server-side readonly/restricted safeguards must be explicitly configured; default unrestricted permits arbitrary commands. Radar public tracking editorial review completed in limited scope; not a security or installation certification. Verify setup according to deployment mode. Advisory/security review not completed; no safety badge. v3.8.5 security release addresses reported injection bypasses affecting readonly/restricted. Source: https://github.com/bvisible/mcp-ssh-manager/releases. Remote shell and SSH authority is high impact. Versions before security fix v3.8.5 have reported command injection, including bypass of readonly/restricted; deployment must upgrade and limit privileges. Unknown vulnerabilities and provider data handling are not certified by this public tracking review.