muchiny/mcp-ssh-bridge

**A Rust MCP server for secure remote infrastructure management — 476 tools, 9 protocols.**
---
Table of Contents
- Features
- Hero Workflows
- Quick Start
- Architecture
- Configuration
- Tool Groups
- MCP Prompts & Resources
- CLI Usage
- Daemon Mode
- Protocol Support
- Troubleshooting
- Development
- License
---
Features
- **476 tools, 77 groups** — manage Linux, Windows, Docker, Kubernetes, Podman, AWX, databases, LDAP, network equipment, certificates, and more
- **9 protocol adapters** — SSH, WinRM, PSRP (PowerShell Remoting), Telnet, K8s Exec, Serial, AWS SSM, Azure, GCP
- **Security-first** — command whitelist/blacklist, 63 secret-redaction patterns + entropy detection, tamper-proof session recording, MCP confirmation before destructive operations (on by default)
- **Auto-discovery** — reads ~/.ssh/config automatically, merges with YAML config
- **Smart output** — server-side jq_filter / yq_filter / columns / limit, TSV mode (60-80% token savings), pagination via ssh_output_fetch, per-client size limits (see Token-efficient output)
- **Progressive MCP discovery** — tools/list returns four meta-tools (mcp_list_tool_groups, mcp_search_tools, mcp_describe_tool to browse the registry on demand, mcp_call_tool to invoke what you found) instead of loading all 476 schemas up front
- **MCP 2026-07-28 (Modern) only** — server/discover opens the connection, per-request _meta carries the revision and client capabilities, notifications are opt-in via subscriptions/listen. A pre-Modern client sending initialize gets -32022 and cannot fall forward — see Protocol Support
- **MCP Tasks extension** — declared under capabilities.extensions as io.modelcontextprotocol/tasks, enabling polled async execution, cancellation and progress notifications for long-running operations. The SERVER decides which calls become tasks (see task_policy::LONG_RUNNING_TOOLS); 2026-07-28 removed per-tool execution.taskSupport entirely, and no tool advertises it
- **CLI + MCP** — all tools available as CLI commands (10-32x token savings) or via MCP JSON-RPC
- **Daemon mode** — Unix-socket transport for multi-client local usage; built-in WinRmPool (120 s TTL) and K8sExecPool (300 s TTL) amortize TLS handshakes across calls
- **9500+ tests** — #![forbid(unsafe_code)], Rust 2024 edition, strict clippy
---
Hero Workflows
Four end-to-end recipes that show why this exists. Every command runs through one CLI binary; all 476 tools sit behind the same flag conventions (--jq, --columns, --limit, --output-format).
1. Diagnose a Linux service in 4 commands
Built-in validation rejects unknown hosts before any SSH bytes leave your machine; outputs are sanitized through 63 secret-redaction patterns + entropy detection.
2. Inspect Kubernetes with 80% fewer tokens
Filtering happens **server-side, before truncation** — you never lose data to the output cap. Same pattern works for ssh_docker_inspect, ssh_helm_status, ssh_awx_*, etc.
3. Cross-platform: Windows + Linux from one CLI
13 Windows tool groups (services, events, AD, IIS, scheduled tasks, registry, Hyper-V, …) map cleanly onto the same ssh_* namespace, no protocol switch in your prompts.
4. Audited destructive ops with confirmation
Session recording (tamper-proof asciinema/JSON) is driven at runtime by the
ssh_recording_* tools plus the MCP_RECORDING_KEY env var — not a config
section.
The server answers resultType: "input_required" carrying an
elicitation/create request and a signed requestState; the client gathers the
confirmation and RETRIES the same call under a new id with the answer attached.
Nothing runs until then, and the audit log records the args, sanitized stdout,
exit code and duration of the call that finally executes.
> **The CLI is not covered by this gate.** bridge-mcp tool ssh_helm_rollback …
> has no client to ask and never prompts. Confirmation is an MCP-mode control;
> the CLI's protection is the blacklist and the audit log.
The dispatcher distinguishes read_only vs mutating vs mutating_idempotent vs destructive per tool (audited via tests/annotation_audit.rs), so confirmations only fire when state actually changes.
---
Quick Start
1. Install
Other platforms & methods
**Claude Desktop (DXT):** download the .dxt file from Releases and drag-and-drop into Claude Desktop.
> **Claude Code plugin (one command).** Install the plugin from the marketplace — it registers the /bridge-mcp:bridge and /bridge-mcp:discover skills, the MCP server, and a binary-bootstrap hook:
>
>
>
> The skills auto-trigger when you mention a remote host, Docker, Kubernetes, services, logs, ports, etc.