Securely Execute Remote SSH Commands

ssh-mcp-server (fangjunjie/classfang) is a bridging tool that lets AI assistants execute remote SSH commands and transfer files through the MCP protocol, without ever exposing SSH credentials to the AI model itself - credentials are managed entirely locally in the server process. Every executed command can optionally be wrapped in a commandTemplate - useful for switching user via su root -c <quotedCommand>, running inside a container (docker exec -i mycontainer sh -c <quotedCommand>), or jumping through another host (ssh jumphost <quotedCommand>) - applied after the working-directory cd is already prepended, so the whole cd ... && <command> chain gets wrapped together.

Use it when you want Claude to run commands or move files on a remote server, including through a bastion/jump-host setup, using either password or private-key (with passphrase) authentication. It supports two transport modes - exec for direct SSH hosts (supports execute-command, upload, and download) and shell for bastion/jump-host scenarios (runs through a persistent shell session but does NOT support upload/download since SFTP is unavailable in that mode) - and can manage multiple named server configurations at once. For multi-factor authentication, enabling tryKeyboard runs private-key auth, then password auth, then a keyboard-interactive prompt for the 2FA code supplied via the SSH_MCP_2FA_CODE environment variable. If your MCP client (like Claude Code) supports skills, use the built-in ssh-mcp-helper skill for interactive setup instead of hand-editing JSON. Do not combine command-line flags and values into a single array element in your MCP config - each flag and its value must be separate array elements (e.g. "--host", "192.168.1.1", not "--host 192.168.1.1").

• execute-command: execute SSH commands on a remote server and retrieve results.
• upload: upload a local file to a specified location on a remote server.
• download: download a file from a remote server to a local location.
• list-servers: list all available configured SSH server connections.

Security features include flexible command blacklist/whitelist mechanisms to restrict which commands can run, support for SOCKS proxies, 2FA, and reuse of an existing ~/.ssh/config.

Run directly with npx, no global install:

{
  "mcpServers": {
    "ssh-mcp-server": {
      "command": "npx",
      "args": ["-y", "@fangjunjie/ssh-mcp-server", "--host", "192.168.1.1", "--port", "22", "--username", "root", "--password", "pwd123456"]
    }
  }
}

Private-key authentication and other scenarios (SOCKS proxy, bastion hosts, multi-connection, command restrictions) follow the same --host, 192.168.1.1 array-element pattern with additional arguments. Multiple named connections can be registered via a JSON config file (--config-file) or repeated --ssh JSON arguments, then selected per tool call with the connectionName parameter. For interactive setup, use the bundled ssh-mcp-helper skill if your client supports Claude Code-style skills.

DevOps and infrastructure teams who want an AI assistant to safely execute remote commands and transfer files - including through bastion hosts - without ever handing SSH credentials to the model.