SSH Fleet MCP server
Curated ssh_probe diagnostics and single-host ssh_exec over an allowlisted SSH fleet.
0 stars
Reviews
Write oneNobody has reviewed SSH Fleet yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
SSH Fleet tools
No tool declarations could be read from the package source. They show once the server is installed.
Public scan report
scanner v0.1.9 · 2026-09-25 · same rubric, same numbers if you re-run it
- –Code scanpackage could not be scannedn/a
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitystatic API keys via environment variables6/15
- Maintenancelast push 67 days ago12/15
- Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
How SSH Fleet compares
Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 65/100
- higher than 20% of 48,273 servers
Install SSH Fleet in Claude Code, Cursor or VS Code
claude mcp add mcp-ssh-fleet -- docker run -i --rm ghcr.io/inhuman/mcp-ssh-fleet:0.1.5
What the publisher says
From the SSH Fleet repository's README, as published. We do not edit it. Read it on GitHub
mcp-ssh-fleet
English | Русский
MCP server that gives an agent two tools over SSH to a fleet of hosts outside Kubernetes. The SSH key is a mounted secret (never enters model context); the inventory is a fail-closed allowlist.
Tools
carrying the given tags (AND semantics, like GitLab runner tags). check is one of a built-in set: uptime, disk, mem, failed, logs. Arbitrary commands cannot be passed. Class: read-only.
- sshprobe(tags, check)** — curated read-only diagnostics on every host
inventory host (by name or address; hosts outside the inventory are refused). Class: write-external: the server executes the command, while access gating (approval/RBAC) belongs to the MCP client.
- sshexec(host, command)** — one arbitrary non-interactive command on ONE
Both: output size cap, per-host timeout, TOFU host-key check (fingerprint in logs), output as one section per host.
Configuration (env)
Inventory format — see deploy/inventory.example.yaml.
Quickstart (docker, stdio)
docker run -i --rm \
-v /path/to/inventory.yaml:/etc/ssh-fleet/inventory.yaml:ro \
-v /path/to/id_ed25519:/etc/ssh-fleet/id_ed25519:ro \
-e SSH_FLEET_TRANSPORT=stdio \
ghcr.io/inhuman/mcp-ssh-fleet:latestThis is the shape MCP clients use when installing from the MCP Registry (io.github.inhuman/mcp-ssh-fleet).
Connecting an MCP client (http/sse)
By default the server speaks StreamableHTTP; register it as a regular HTTP MCP server with endpoint /mcp (URL like http://:8080/mcp). Both tools become available to the client.
Client-side security recommendations:
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
SSH Fleet: common questions
- Is SSH Fleet MCP server safe?
- With care: it is graded C, so read the findings first (65/100). Read the SSH Fleet safety report
- How do I install SSH Fleet?
- It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
- Does SSH Fleet need an API key?
- Yes. The registry entry asks for
SSH_FLEET_AUTH_TOKEN. - Is SSH Fleet maintained?
- The last commit was 105 days ago (2026-07-20). The latest release is v0.1.5.
- What can I use instead of SSH Fleet?
- Servers from other publishers that do the same job: SSH — policy-gated remote access MCP server.
Alternatives to SSH Fleet
Same job from other publishers: the closest match first, then the best rated.
- SSH — policy-gated remote accessPolicy-gated, audited SSH for Linux and Windows hosts: roles, approvals, and an audit log.not reviewedEstablishedB
