ssh-mcp-server — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Track SSH auth and command-scope documentation due high-impact remote actions

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Controlled AI-assisted operations on remote servers

What we know

MCP bridge for remote SSH commands, file upload/download and server listing with allow/deny controls.

Maintenance / activity evidence

Observed Sep 9, 2026 (UTC)chore(package): 更新版本号至1.9.2

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Configured remote account privileges + local transfer paths. Writes: Remote command execution; Bidirectional file transfer.
SSH password/key.
Sensitive access: Remote hosts, Files, Command output

Use dedicated least-privilege SSH accounts and allowlists because the server can execute commands and transfer files.

Security source · repository notice ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

923 repository stars

Stars observed Oct 6, 2026.

30-day package downloads intentionally left null because the package-stats provider ran out of credits during Batch 3 QA.

All limitations / Review context

Which remote commands, authentication methods, and scope limits are documented?

The bounded assessment reviewed the official README, repository notices, security policy path, and security page for known material public-tracking blockers. No such blocker was identified. This is a public-tracking assessment, not an installation safety certification.

Use dedicated least-privilege SSH accounts and allowlists because the server can execute commands and transfer files.
Configured remote account privileges + local transfer paths.
SSH password/key.
Command output/files pass through MCP; credentials stay locally managed.
Reviewed write actions: Remote command execution; Bidirectional file transfer
Sensitive access: Remote hosts, Files, Command output
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
A project-specific SECURITY.md policy was not available at the fetched official path; the review remains limited to published repository notices.
No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
The fetched official SECURITY.md path returned HTTP 404; it was not treated as positive evidence.
Remote command/file capabilities are high authority.
Safety depends on SSH account and command rules.

Original activity observations

2026-09-09T05:53:30Z: chore(package): 更新版本号至1.9.2

Technical identity

github.com/classfang/ssh-mcp-server

Exact implementation source: https://github.com/classfang/ssh-mcp-server ↗
Reviewed resource type: MCP Server
Repository identity: classfang/ssh-mcp-server
Package identity: npm:@fangjunjie/ssh-mcp-server

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 6, 2026

GitHub repository ↗
classfang/ssh-mcp-server
Recorded repository material and project history.

Setup · Watchlist

Install & Agents

Publisher instructions.

Source evidence observed Oct 13, 2026.

Additional setup details required — see the specific gaps below.

Warning

Remote shell execution grants highly sensitive access; never point to an unknown host.
Replace the supplied illustrative path/credential placeholders with your own settings.
Do not copy passwords or private keys into JSON; SSH agent/key files may be used per vendor docs.
do NOT delete or overwrite the shared `~/.ssh/config`, private keys, agent or remote hosts.
Exact vendor-specific credential revoke procedure not established from checked official Setup documentation; may be external or not applicable. Do not invent.
Replace the supplied credential/path placeholders privately; use only the named configuration schema.
MCP100 client-scope note: this Claude Code CLI example applies only to that client and the exact registered name in the command. Desktop, Cursor and other clients use their own configuration; do not run it for a differently named entry.

Install / connect
Publisher instructions
Publisher-specific setup path. Follow prerequisites, then register or connect to your MCP host.
publisher documented install or connect · Publisher instructions
npx -y @fangjunjie/ssh-mcp-server
Configure / authenticate
Publisher instructions
Publisher npm package `@fangjunjie/ssh-mcp-server`; configure authorized SSH endpoints/keys and allow/deny lists using README format.
Advanced configuration · claude desktop json · Publisher instructions
claude desktop json · Publisher instructions
{ "mcpServers": { "ssh-mcp-server": { "args": [ "-y", "@fangjunjie/ssh-mcp-server", "--host", "myserver" ], "command": "npx" } } }
Check connection
Suggested check
Use the `list-servers` MCP tool to validate configuration; do not execute remote shell commands just to verify.
Remove / uninstall / revoke
MCP100 setup guide
Remove the SSH MCP registration and stop its stdio process; do not delete existing SSH keys or remote servers.
MCP100 client-scope guidance: each CLI removal example targets only its named client and exact registered entry. Package names, Desktop/Cursor configuration keys and Codex/Claude registration names may differ; use the entry you actually registered. Client removal does not revoke provider credentials.
claude mcp remove ssh-mcp-server

Official Documentation & Sources

What it does

MCP bridge for remote SSH commands, file upload/download and server listing with allow/deny controls.

Capability: Cloud & DevOps
Resource type: MCP Server
Industry: Software & Technology
Best fit: Controlled AI-assisted operations on remote servers

Representative uses

Execute remote commands
Upload/download files
Manage configured servers
Apply command allow/deny rules

Limitations

Remote command/file capabilities are high authority.
Safety depends on SSH account and command rules.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: SSH password/key.
Permissions: Configured remote account privileges + local transfer paths.
Data handling: Command output/files pass through MCP; credentials stay locally managed.
Cost: unknown
Risk and cautions: Use dedicated least-privilege SSH accounts and allowlists because the server can execute commands and transfer files.

Access scope and cautions

Write actions: Remote command execution Bidirectional file transfer
Sensitive access: Remote hosts Files Command output
Risk level: high

FAQ

Based on reviewed evidence as of 2026-10-06. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Execute remote commands; Upload/download files; Manage configured servers; Apply command allow/deny rules.

What setup and authentication are documented?

Recorded installation/entrypoint step: npx -y @fangjunjie/ssh-mcp-server. Recorded transport: stdio. Prerequisites: Node.js; SSH access. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: SSH password or private key.

Can it modify data or perform write operations?

Documented write actions include: Remote command execution; Bidirectional file transfer. Recorded permission boundary: Configured remote account privileges + local transfer paths.

What data-handling boundary should I consider?

Command output/files pass through MCP; credentials stay locally managed. Recorded sensitive-access context: Remote hosts; Files; Command output.

What limitations and risks should I check before use?

Use dedicated least-privilege SSH accounts and allowlists because the server can execute commands and transfer files. Remote command/file capabilities are high authority. Safety depends on SSH account and command rules. A project-specific SECURITY.md policy was not available at the fetched official path; the review remains limited to published repository notices.

Is this an official MCP?

classfang is listed as Community implementation in MCP100’s current evidence.