mcp-ssh-manager

Overview

mcp-ssh-manager is a standard stdio MCP server for SSH. It lets Claude Code, Claude Desktop, OpenAI Codex, or any MCP client run commands, move files, query databases, create backups, check health, open tunnels, and manage servers, while a control plane can show live output and hold requests for approval.

Key Features

• Runs as an MCP server for SSH, usable by Claude Code, Claude Desktop, OpenAI Codex, and other MCP clients.
• Provides 37 SSH tools for command execution, file upload/download and rsync sync, database dumps/import/query, backups, health checks, service and process management, deployments, sessions, tunnels, groups, aliases, hooks, and profiles.
• Offers per-server modes: unrestricted, readonly, and restricted with allow/deny command patterns.
• Includes an encrypted vault using AES-256-GCM, with the master key in the OS keychain where available, and a local audit trail.
• Adds an opt-in control plane and desktop application for approval, live terminal output, file browsing, health checks, shells, saved commands, groups, and host keys.
• Supports approval per server for never, destructive, or always, stored in the vault; approval timeouts or an unreachable control plane deny pending requests.

Use Cases

• Ask an MCP client to diagnose production load, memory, disk, or top processes.
• Create compressed, timestamped MySQL, PostgreSQL, MongoDB, or file backups with retention.
• Deploy files to a remote server with ownership, permissions, backup, and restart handled.
• Run a command across a group of tagged servers, or open a tunnel to a production database.

Getting Started

• npm install -g mcp-ssh-manager
• ssh-manager server add
• claude mcp add ssh-manager mcp-ssh-manager
• Restart Claude Code and ask it something.
• For OpenAI Codex, configure the MCP server in ~/.codex/config.toml and define servers in ~/.codex/ssh-config.toml.

Deployment & Requirements

• Node 18 or later for npm/CLI usage on Linux, macOS, or Windows.
• rsync is required for ssh_sync.
• sshpass is required only when syncing with password authentication.
• The desktop application carries its own runtime and engine, so it does not require Node.js or npm.
• To use ssh-manager control from a source checkout, build the interface once with npm run build:ui.

Before You Adopt

• License: MIT. Review its terms before using, modifying, or distributing the project.
• Windows desktop builds in 4.0.x are not code-signed, and signing is planned for a later release.
• Live command output streams can contain secrets, so they are kept in memory and disappear with the window rather than touching disk.
• If the control plane is unreachable or a request times out, approval-required requests are denied.
• npm/CLI deployment requires Node 18+ on Linux, macOS, or Windows.