Fast SSH MCP server

fast-mcp-ssh SSH, SFTP and persistent shells for AI agents. One Rust binary, no runtime.

An MCP server that gives a model real SSH access:

• One connection per host, held open across calls.
• A PTY shell that remembers cd and export.
• SFTP instead of cat > file, and host-to-host copies that skip your disk.
• A screenshot of the remote desktop.
• Regex guards before anything leaves your machine.
• An append-only audit log of every call.

Answers come back as TOON, roughly 40 percent fewer tokens than JSON on tabular data.

Install

cargo install fast-mcp-ssh

Or a prebuilt binary from the latest release, checked against SHA256SUMS.txt. Linux and macOS ship x8664 and aarch64, Windows x8664.

Copy hosts.example.toml to ~/.fast-mcp-ssh/hosts.toml and fill in your hosts. Keys go in ~/.fast-mcp-ssh/keys/; auth is key, agent or password.

Wire it up

.mcp.json, or claudedesktopconfig.json for Claude Desktop:

{
  "mcpServers": {
    "ssh": {
      "type": "stdio",
      "command": "fast-mcp-ssh"
    }
  }
}

Same block in Claude Code, Cursor, Windsurf, Zed, VS Code Copilot and anything else that speaks MCP over stdio.

In the MCP registry it is mcp-name: io.github.klNuno/fast-mcp-ssh.

Tools

host is optional on every tool once [defaults] default_host is set.

Every tool carries MCP annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) so a client can gate destructive calls.

Host-to-host copy

cp moves a file from one configured host to another. The bytes never land on your disk and never reach the model, and a sha256 is compared on both ends before success. Guards cover the destination too, so a read-only target still refuses the write.

Remote screenshots

shot hands the model an image instead of a wall of text. It uses whichever of grim, gnome-screenshot, spectacle, ImageMagick import or scrot the host has, covering X11 and wlroots Wayland, and downscales locally so a 4K screen is not a multi-megabyte payload.

Protocol

Speaks stateless MCP (2026-07-28) and every revision back to 2024-11-05, picked per peer. Stateless changes three things:

Shortened. The full README is on GitHub.