Python Ssh MCP Server

Python Ssh MCP MCP server exists for a simple reason — assistants are far more useful when they can act on Python Ssh MCP directly instead of describing what you should do. An SSH MCP server built in Python on top of FastMCP. The goal: give an LLM real SSH access to many hosts while keeping fine-grained control over what it can and can't do. The configuration surface is deliberately broad — probably overkill.

What you get

• MCP-compliant server — exposing SSH over stdio (or HTTP if you prefer); transport speaks MCP directly, no shim
• Four-tier access model — — read / low-access / dangerous / sudo. Each tier is toggled with its own env flag and enforced via FastMCP Visibility transforms. Default: read-only
• Ten tool groups — orthogonal to tiers (host, session, sftp-read, file-ops, exec, sudo, shell, docker, systemctl, pkg). SSH_ENABLED_GROUPS trims the catalog to what a given assistant actually needs
• 100 tools — see TOOLS.md for the complete per-tool reference. Highlights:
• Read-only probes (ping, host info, disk usage, processes, alerts, known-hosts verify, user info, host notes, server-info)
• SFTP reads (list, stat, download, find, file_hash) with remote-realpath confinement

What the assistant can call

Once Python Ssh MCP is connected, these are the calls the assistant has available:

• Cursor — Same mcpServers shape as the base snippet. Cursor picks up config changes on the next chat session — no full restart needed
• Kilocode — Config file: ~/.kilocode/mcp.json (or the equivalent in your Kilocode install — the extension docs list the exact path). Same mcpServers shape as the
• HostNotAllowed — The host isn't in hosts.toml and isn't in SSH_HOSTS_ALLOWLIST. Resolution tries the input first as a hosts. key, then against
• HostBlocked — Deny wins — check SSH_HOSTS_BLOCKLIST. This is intentional; remove the entry if the block was a mistake, but first confirm with the operator who
• PathNotAllowed — The resolved (canonicalized) path is outside every root in path_allowlist. Check:

Setting it up

Setup follows the usual MCP pattern — install or clone the server, register it in your client's configuration file, restart the client. The configuration blocks on this page cover the common clients.

Configuration and credentials

You will need 5 environment variables: LOG_LEVEL, ALLOW_LOW_ACCESS_TOOLS, ALLOW_DANGEROUS_TOOLS, ALLOW_SUDO, FASTMCP_DOCKET_URL. The server will not start without them, which is usually why the tools fail to appear on a first run. Keep credentials in your client's env block or a secrets manager rather than in a file you might commit.

Choosing this one

This sits in the cloud and infrastructure group, where several servers overlap in what they claim to do but differ sharply once you actually set them up. Python Ssh MCP's toolset — Cursor, Kilocode, HostNotAllowed and 2 more — is a fair guide to whether it matches your workflow. It is maintained by nightreaver; worth a glance at recent repository activity before you build anything load-bearing on it.

This entry was verified against Python Ssh MCP's own documentation before publication; SyncDev keeps the directory reviewed rather than auto-generated.

Before you rely on it

• It runs with your machine's permissions. That is convenient and also the reason to think about what you point it at before you approve a tool call.
• Missing credentials fail quietly in some clients — if no tools show up, check the environment block first.
• MCP clients confirm each tool call by default. Leave that on until you have watched what the python ssh mcp mcp server does with a few real requests.