mcpField
S
SSH Fleet

SSH Fleet

Local
github.com/inhumanCloud & Infra0Updated 14w ago
Repository

About SSH Fleet

SSH Fleet is an MCP server for agents that need diagnostics or command execution across an allowlisted fleet of SSH hosts outside Kubernetes. It separates curated read-only checks from single-host arbitrary commands.

Key features

  1. 01Read-only checks across tagged hosts
  2. 02Single-host command execution
  3. 03Fail-closed host inventory allowlist
  4. 04SSH key kept outside model context
  5. 05Output caps and per-host timeouts

Use cases

  1. 01Inspect uptime, disk, memory, failures, or logs
  2. 02Run a command on an approved inventory host

MCP support

Exposes `ssh_probe` and `ssh_exec` tools to MCP clients over Streamable HTTP, SSE, or stdio. Access approval for arbitrary execution is left to the MCP client.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "inhuman-mcp-ssh-fleet": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "SSH_FLEET_TRANSPORT",
        "-e",
        "SSH_FLEET_CMD_TIMEOUT_SECONDS",
        "-e",
        "SSH_FLEET_OUTPUT_CAP_BYTES",
        "-e",
        "SSH_FLEET_PROBE_CONCURRENCY",
        "-e",
        "SSH_FLEET_PROBE_MAX_HOSTS",
        "-e",
        "SSH_FLEET_AUTH_TOKEN",
        "ghcr.io/inhuman/mcp-ssh-fleet:0.1.5"
      ],
      "env": {
        "SSH_FLEET_TRANSPORT": "<SSH_FLEET_TRANSPORT>",
        "SSH_FLEET_CMD_TIMEOUT_SECONDS": "<SSH_FLEET_CMD_TIMEOUT_SECONDS>",
        "SSH_FLEET_OUTPUT_CAP_BYTES": "<SSH_FLEET_OUTPUT_CAP_BYTES>",
        "SSH_FLEET_PROBE_CONCURRENCY": "<SSH_FLEET_PROBE_CONCURRENCY>",
        "SSH_FLEET_PROBE_MAX_HOSTS": "<SSH_FLEET_PROBE_MAX_HOSTS>",
        "SSH_FLEET_AUTH_TOKEN": "<SSH_FLEET_AUTH_TOKEN>"
      }
    }
  }
}
Run commanddocker run -i --rm -e SSH_FLEET_TRANSPORT -e SSH_FLEET_CMD_TIMEOUT_SECONDS -e SSH_FLEET_OUTPUT_CAP_BYTES -e SSH_FLEET_PROBE_CONCURRENCY -e SSH_FLEET_PROBE_MAX_HOSTS -e SSH_FLEET_AUTH_TOKEN ghcr.io/inhuman/mcp-ssh-fleet:0.1.5
Environment variables to set
SSH_FLEET_TRANSPORTMCP transport. Must be 'stdio' for direct docker/stdio use.
SSH_FLEET_CMD_TIMEOUT_SECONDSPer-host command timeout in seconds (1..600).
SSH_FLEET_OUTPUT_CAP_BYTESCap on output bytes per host section (>=256).
SSH_FLEET_PROBE_CONCURRENCYParallelism for ssh_probe.
SSH_FLEET_PROBE_MAX_HOSTSSafety cap on the number of hosts in one probe.
SSH_FLEET_AUTH_TOKENSecretOptional X-MCP-AUTH bearer token (only used by the http/sse transports).

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
ocighcr.io/inhuman/mcp-ssh-fleet:0.1.5

Tools

No tool list yet

Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.

Details

From the project README

mcp-ssh-fleet

English | Русский

Version MCP Registry Container Build Go Version Go Report Card License: MIT Issues Last Commit

MCP server that gives an agent two tools over SSH to a fleet of hosts outside Kubernetes. The SSH key is a mounted secret (never enters model context); the inventory is a fail-closed allowlist.

Tools

  • ssh_probe(tags, check) — curated read-only diagnostics on every host carrying the given tags (AND semantics, like GitLab runner tags). check is one of a built-in set: uptime, disk, mem, failed, logs. Arbitrary commands cannot be passed. Class: read-only.
  • ssh_exec(host, command) — one arbitrary non-interactive command on ONE inventory host (by name or address; hosts outside the inventory are refused). Class: write-external: the server executes the command, while access gating (approval/RBAC) belongs to the MCP client.

Both: output size cap, per-host timeout, TOFU host-key check (fingerprint in logs), output as one section per host.

Configuration (env)

VariableDefaultMeaning
SSH_FLEET_TRANSPORThttphttp (StreamableHTTP, endpoint /mcp) | sse | stdio
SSH_FLEET_ADDR:8080listen address for http/sse
SSH_FLEET_AUTH_TOKEN—optional X-MCP-AUTH token
SSH_FLEET_INVENTORY_PATH/etc/ssh-fleet/inventory.yamlpath to the inventory (configmap)
SSH_FLEET_KEY_PATH/etc/ssh-fleet/id_ed25519path to the private key (secret)
SSH_FLEET_OUTPUT_CAP_BYTES8192output cap per section
SSH_FLEET_CMD_TIMEOUT_SECONDS20per-host timeout
SSH_FLEET_PROBE_CONCURRENCY8probe parallelism pool
SSH_FLEET_PROBE_MAX_HOSTS50safety cap on hosts per probe

Inventory format — see deploy/inventory.example.yaml.

Quickstart (docker, stdio)

docker run -i --rm \
  -v /path/to/inventory.yaml:/etc/ssh-fleet/inventory.yaml:ro \
  -v /path/to/id_ed25519:/etc/ssh-fleet/id_ed25519:ro \
  -e SSH_FLEET_TRANSPORT=stdio \
  ghcr.io/inhuman/mcp-ssh-fleet:latest

This is the shape MCP clients use when installing from the MCP Registry (io.github.inhuman/mcp-ssh-fleet).

Connecting an MCP client (http/sse)

By default the server speaks StreamableHTTP; register it as a regular HTTP MCP server with endpoint /mcp (URL like http://<host>:8080/mcp). Both tools become available to the client.

Client-side security recommendations:

  • ssh_probe is read-only (curated checks only) and can be granted broadly.
  • ssh_exec is arbitrary execution (write-external). Gate its access on the client side (approval / RBAC / user allowlist) — the server merely executes a command on an inventory host; it does not decide access policy.

Development

make test        # unit tests + e2e against a real in-process SSH server
make vet
make vulncheck
make build
make docker

Release: tag vX.Y.Z → GitHub Actions builds and publishes a multi-arch image to ghcr.io/inhuman/mcp-ssh-fleet.

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.