bvisible/mcp-ssh-manager

A Model Context Protocol (MCP) server that enables **Claude Code** and **OpenAI Codex** to manage multiple SSH connections. Execute commands, transfer files, manage databases, create backups, monitor health, and automate DevOps tasks across your servers — directly from your AI assistant.
---
🎉 What's New in v3.8.6
**🔒 Security release — six advisories fixed. Upgrade.** (Released: October 8, 2026)
- **🔴 Command injection on your own machine through the default on-error hook** (GHSA-759m-wfpq-xmx3) — the connection error, whose text a server chooses, was pasted into a shell command. Any SSH server you connected to could run a command on the machine running mcp-ssh-manager. Hook values now reach commands as shell variables, never as command text, and the default hook writes its log without a shell.
- **🔴 restricted mode only checked how a line started** (GHSA-rfxw-26h6-7w42) — ^echo let echo hi; id through. Every command in a list or pipeline must now match your allowlist; command substitution and writes to files are refused.
- **🔴 cwd reached the shell unquoted** (GHSA-37fv-fcpc-j236), past the security policy.
- **🔴 ssh_db_query could write** (GHSA-9w6j-vg8f-hp8g, GHSA-q37w-vhpx-q5q9) — SELECT … INTO OUTFILE, SELECT … INTO a new table, and JavaScript in MongoDB queries. Queries now run in a read-only transaction, and a MongoDB query must be a filter document.
- **🟠 Host keys were never compared** (GHSA-cwg3-pfmm-w8rm) — **a changed host key is now refused**, as OpenSSH does. A server reinstalled since its key was recorded needs ssh-keygen -R once.
- ssh_deploy and ssh_backup_schedule quote every value, and a cron schedule must be a schedule.
Hook settings, aliases, the active profile and the logs now live in ~/.ssh-manager/, readable by you alone, instead of inside the installed package, where every upgrade lost them.
Read full changelog → · Previous: v3.8.5, three command-injection advisories.
---
🔐 Giving an agent SSH access, safely
An MCP SSH server is the most dangerous tool you can hand an AI agent: a shell on
machines that matter. This one is built so you decide how far the agent can go —
**per server**, not globally.
| Mode | What the agent can do |
|---|---|
| unrestricted *(default)* | Everything. Same behaviour as any other SSH MCP server. |
| readonly | Mutating tools are refused outright — no deploy, no upload, no sudo, no database import. Read commands still work. |
| restricted | Every command must match an allow pattern **and** no deny pattern. Anything else is refused before it reaches the host. |
Alongside that:
- **The sudo password never reaches the remote command line.** It travels on the
SSH channel's stdin, so it is not visible in ps, in /proc/ /cmdline, or
in an auditd trail — unlike the echo "$pass" | sudo -S pattern common in
this category (#34).
- **Every database argument is shell-quoted** through one centralised helper,
guarded by a 648-combination injection test.
- **Read-only SQL is enforced**, not suggested: ssh_db_query refuses anything
that is not a SELECT.
- **Vulnerabilities are published, not buried.** See SECURITY.md
for the reporting process and the advisories already fixed.
- **Reproducible installs**: the lockfile is committed, CI installs with
npm ci, and a test enforces that every dependency resolves to
registry.npmjs.org with an integrity hash and no unreviewed install scripts.
---
Previous Releases
📜 Release history — v3.8.4 down to v1.0.0 (click to expand)
v3.8.4 - Secrets stop reaching the log, CodeQL on every commit (August 28, 2026)
- **🔒 The logger no longer writes secrets in clear text** — it writes to ~/.ssh-manager.log and stderr (which your MCP host captures), so one call site handing it a server config would have persisted a production password. Redaction now happens inside the logger. Also: CodeQL on every push, every action pinned by SHA, and a broken example that never parsed. Full changelog →
v3.8.2 / v3.8.3 - Sudo password leak fixed, MCP Registry, signed releases (August 28, 2026)
- **🔒 The sudo password no longer reaches the remote command line** (#34) — it travelled through echo " " | sudo -S, readable in ps and /proc/ /cmdline by every account on the host. It now goes over the SSH channel's stdin. Also: listed in the **official MCP Registry** as io.github.bvisible/mcp-ssh-manager, releases published from CI with **SLSA provenance** and a CycloneDX SBOM, and the per-server security modes documented at last. Full changelog →
v3.8.1 - Reproducible installs and blocking quality gates (August 28, 2026)