[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_127":128},"routes/modules.$creator.$moduleId",{"_14":15,"_16":17,"_18":19,"_20":21},"routes/modules.$creator.$moduleId.endpoints",{"_11":12,"_13":-5},"error","Module not found","tools","module",{"_20":22,"_23":24,"_25":26,"_27":28,"_29":30,"_31":32,"_33":26,"_34":35,"_36":-5,"_37":-5,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":44,"_46":47,"_48":49,"_50":51,"_52":-5,"_53":44,"_54":55,"_56":57,"_58":-5,"_59":-5,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_72":-5,"_73":-5,"_74":-5,"_75":44,"_76":-5,"_77":78,"_79":80,"_81":82,"_83":84,"_85":86,"_87":88},"apiUrl","https://odel.app/api","creator","klnuno","moduleId","fast-mcp-ssh","@klnuno/fast-mcp-ssh","displayName","fast mcp ssh","tagline","SSH, SFTP and persistent PTY shells for AI agents. One Rust binary, no runtime.","iconKey","https://avatars.githubusercontent.com/u/96637888?v=4","category","local","status","published","metaDescription","deploymentType","external","workerName","bindingName","mcpConfig","pricingModel","free","creatorUserId","system:external-import","createdAt",1785390470000,"updatedAt","sourceRegistry","official-mcp-registry","sourceUrl","https://registry.modelcontextprotocol.io/v0/servers?search=io.github.klNuno%2Ffast-mcp-ssh","sourceVerified",true,"sourceMissingSince","importedAt","upstreamStars",1,"upstreamUpdatedAt",1785338612000,"detectedTransport","detectedAuthType","probeStatus","lastProbedAt","githubRepoUrl","https://github.com/klNuno/fast-mcp-ssh","githubRepoFullName","klNuno/fast-mcp-ssh","releaseId","ext-klnuno-fast-mcp-ssh","version","0.4.2","descriptionMarkdown","

fast-mcp-ssh

SSH, SFTP and persistent shells for AI agents. One Rust binary, no runtime.

\n\n

\n $\"crates.io\"$ \n $\"CI\"$ \n $\"License\"$ \n $\"Rust$ \n $\"Platform\"$ \n

\n\nAn MCP server that gives a model real SSH access: one connection per host kept\nalive across calls, a PTY shell that remembers `cd` and `export`, SFTP instead\nof `cat > file`, host-to-host copies that never touch your disk, a screenshot\nof the remote desktop, regex guards before anything leaves your machine, and an\nappend-only audit log. Answers come back as TOON, roughly 40 percent fewer\ntokens than JSON on tabular data.\n\n## Install\n\n```bash\ncargo install fast-mcp-ssh\n```\n\nOr take a prebuilt binary from the\n[latest release](https://github.com/klNuno/fast-mcp-ssh/releases/latest) and\ncheck it against the matching `.sha256`. Linux and macOS ship x86_64 and\naarch64, Windows ships x86_64.\n\nCopy [`hosts.example.toml`](https://github.com/klNuno/fast-mcp-ssh/blob/main/hosts.example.toml) to `~/.fast-mcp-ssh/hosts.toml`\nand fill in your hosts. Keys go in `~/.fast-mcp-ssh/keys/`; `auth` is\n`key`, `agent` or `password`.\n\n## Wire it up\n\n`.mcp.json`, or `claude_desktop_config.json` for Claude Desktop:\n\n```json\n{\n \"mcpServers\": {\n \"ssh\": {\n \"type\": \"stdio\",\n \"command\": \"fast-mcp-ssh\"\n }\n }\n}\n```\n\nIn the [MCP registry](https://registry.modelcontextprotocol.io) it is\n`mcp-name: io.github.klNuno/fast-mcp-ssh`.\n\n## Tools\n\n`host` is optional on every tool once `[defaults] default_host` is set.\n\n| Group | Tools | |\n|---|---|---|\n| Run | `exec` `exec_batch` `sh` `interrupt` | One-shot, parallel fan-out, persistent PTY, Ctrl-C |\n| Files | `ls` `stat` `dn` `up` `cp` `wr` `mkdir` `rm` `tail` | SFTP, plus `tail -n` / `tail -F` in a bounded window |\n| Visual | `shot` | Screenshots the remote desktop, downscaled before it reaches the model |\n| Ops | `facts` `sys` `svc` | Cached host profile, parsed `ps`/`df`/`mem`/`net`, systemd units |\n| Session | `hosts` `ping` `disconnect` `disconnect_all` `reload` | Discovery and lifecycle; `reload` swaps config without a restart |\n| Network | `forward` `unforward` `forwards` | Local TCP forwards over the same connection |\n\nEvery tool carries MCP annotations (`readOnlyHint`, `destructiveHint`,\n`idempotentHint`, `openWorldHint`) so a client can gate destructive calls.\n\n## Security\n\n- **Guards run before any SSH packet.** `deny_patterns` refuse outright,\n `confirm_patterns` trigger an MCP elicitation, and a client that cannot\n elicit is denied. `read_only = true` blocks anything that looks like a write.\n- **Paths are checked on both sides.** Remote reads of keys, shadow files and\n cloud credentials are refused, and so are local writes that would land in\n your `~/.bashrc` or an autostart folder. Paths are re-checked after the\n server resolves them, so a symlink cannot launder a blocked target.\n- **Host keys are pinned** (TOFU by default, `strict` and per-host fingerprints\n available). Every call is appended to `~/.fast-mcp-ssh/audit.log` as NDJSON,\n with credentials scrubbed.\n\nGuards are a speed bump against accidents, not a boundary against an adversary\nwho controls the model. Scope the remote account accordingly: full threat model\nin [SECURITY.md](https://github.com/klNuno/fast-mcp-ssh/blob/main/SECURITY.md).\n\n## Benchmark\n\n50 iterations per scenario against the same Linux host over the same LAN, same\nSSH key, bench client on Windows 11. Medians, lower is better. Reproduce with\n[`benchmark/`](https://github.com/klNuno/fast-mcp-ssh/blob/main/benchmark); raw runs in\n[`benchmark/results/`](https://github.com/klNuno/fast-mcp-ssh/blob/main/benchmark/results).\n\n| | `fast-mcp-ssh` | [`mcp-ssh-manager`][mgr] | [`ssh-mcp-server`][fj] |\n|---|---:|---:|---:|\n| Cold start | **41 ms** | 289 ms | 279 ms |\n| `exec echo ok` | **1.5 ms** | 89.9 ms | 45.1 ms |\n| `exec uname -a; whoami; pwd` | **2.4 ms** | 89.0 ms | 46.1 ms |\n| `exec seq 1 5000` (~29 KB) | **18.7 ms** | 90.5 ms [^1] | 46.3 ms |\n| Write a 1 KB file | **1.4 ms** | 90.9 ms | 45.7 ms |\n| Read a 1 KB file | **2.1 ms** | 90.8 ms | 45.8 ms |\n| Tool surface, sent every session | 23 tools, 17.6 KB | 37 tools, 39.9 KB | **4 tools, 1.7 KB** |\n\nBoth alternatives are Node processes, so ~250 ms of their cold start is the\nruntime booting. The steady-state gap is the connection: `fast-mcp-ssh` keeps\none SSH session per host and spawns a channel per call, while the other two\nreconnect. Writes go over SFTP here and through a `cat > file` heredoc there.\n\n[^1]: `mcp-ssh-manager` truncates that response to 12 KB, so it is not\nreturning the same output. `ssh-mcp-server` returns raw stdout with no exit\ncode, which is why its replies are the shortest and why a failed command looks\nlike a successful one.\n\n[mgr]: https://www.npmjs.com/package/mcp-ssh-manager\n[fj]: https://www.npmjs.com/package/@fangjunjie/ssh-mcp-server\n\n## Development\n\n```bash\ncargo install --path . # build and install from a clone\ncargo test # unit tests\ncargo clippy --all-targets # no warnings allowed in CI\n./scripts/test-sh.ps1 # end-to-end against a real host (Windows)\n```\n\nNever write to stdout outside the MCP transport: a stray `println!` corrupts\nthe JSON-RPC stream and the client disconnects without an error. `tracing`\nmacros go to stderr and are safe.\n\n## License\n\nMIT.\n","changelogMarkdown","videoKey","requiredSecretsJson","publishedAt","priceCents","trialDays",0,"upstream",{"_106":107,"_108":109,"_110":111,"_112":113,"_114":115,"_116":117},"requiredSecrets",[],"tags",[91,92,93,94,95,96,97,98,99,100,101,102,103,104,105],"assets",[],"stats",{"_89":78,"_90":78},"ratingAvg","reviewCount","agentic-ai","ai","ai-agents","anthropic","automation","claude","claude-code","cursor","devops","file-transfer","pty","remote-access","rust","screenshot","sftp","topics",[91,92,93,94,95,96,97,98,99,100,122,123,124,101,102,103,104,105,125,126],"license","MIT","language","Rust","registryName","io.github.klNuno/fast-mcp-ssh","homepage","https://crates.io/crates/fast-mcp-ssh","packages",[118],{"_119":120,"_121":21,"_68":69},"registryType","cargo","identifier","mcp","mcp-server","model-context-protocol","ssh","sysadmin","ENV",{"_129":130,"_131":132,"_133":134},"ENVIRONMENT","production","TURNSTILE_SITE_KEY","0x4AAAAAAB8-rEI2gNDf_QhU","SENTRY_DSN","https://45fd1229f78089d5c3ee78be128030e1@o4510583261757440.ingest.de.sentry.io/4510584253448272"]