pod
Other formats agents might prefer:
markdownjsonllms.txt

Agent? You probably want markdown or json, or Pod over MCP.

Reported issues for SSH — policy-gated remote access

Pod holds 19 of 25 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to SSH — policy-gated remote access.

Most discussed

Timed-out exec can leave the remote process running after stdin EOF

Summary

In ssh-mcp 2.3.1, SSHConnection.exec() can report Command timed out after ... while the remote process continues running.

I reproduced this against a normal OpenSSH target using a 1 second timeout and a 30 second uniquely named sleep process:

  • ssh-mcp returned the timeout error after about 1.26s;
  • the remote process was still alive at +3s;
  • it was still alive at +8s.

Root cause

connection.ts calls stream.end() immediately after dispatching the exec command, which

Read the thread · 2026-08-20 · closed · external user · 2 comments

Config doesn't seems to work on Windows

Installed ssh-mcp and created a config.toml at %AppData%\ssh-mcp\config.toml as described on README.

But when i try to run ssh-mcp: 

Fatal error: Error: No config file found and missing required --host/--user.
Either create a config file at ~/.config/ssh-mcp/config.toml or pass --config <path>.
For quick start: --host=<host> --user=<user> (credentials via env vars).
    at buildAppConfig (file:///C:/Users/<my_user>/AppData/Roaming/npm/node_modules/ssh-mcp/build/index.js:127:15)
    at 

[Read the thread](https://github.com/tufantunc/ssh-mcp/issues/138) · 2026-08-19 · open · external user · 5 comments

### sudo doesnt work in v2 anymore

Since V2 I get the error "POLICY_DENIED: Role "admin" cannot run "privileged" commands" for any sudo commands, Claude wants to execute. I cant find any flags that would elevate the connections role, except through a toml file. This would be a dealbreaker for me. I just want three lines in a simple .mcp.json file, just as it was the whole time :/

[Read the thread](https://github.com/tufantunc/ssh-mcp/issues/91) · 2026-08-10 · closed · external user · 12 comments

### Security Concerns : The Lethal Trifecta

Have you considered how this might pose a significant security risk?

Like I think this MCP server is begging to be abused in some way as it would give an LLM access to arbitrary user data on the system.. be able to communicate out to the internet.. and who knows what else.

If you aren't already aware, there is this idea called the Lethal Trifecta that I think this type of MCP server exposes user to.
- https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/
- https://simonwillison.net/2025/M

[Read the thread](https://github.com/tufantunc/ssh-mcp/issues/33) · 2026-01-28 · closed · external user · 4 comments

### no output since the description update

Since the description update, the exec tool does not return any output anymore. I am using the su shell (--suPassword).

Example:

• Called ssh.exec({"command":"echo test","description":"Verify SSH command output."}) └


Also, this was a minor issue even before this update:
When the ssh command is too long (and since this update, if the description is too long), the tail of the command/description is returned as output.

Example:

• Called └ ssh.exec({"command":"docker ps --forma

Read the thread · 2026-01-05 · closed · outside contributor · 2 comments

Feature Request: su

My server does not expose the root user directly, I need to su from a different user after connecting, and I would not like to expose that command to the LLM.

So I would propose a setting for su directly like

{
    "mcpServers": {
        "ssh-mcp": {
            "command": "npx",
            "args": [
                "ssh-mcp",
                "-y",
                "--",
                "--host=1.2.3.4",
                "--port=22",
                "--user=root",
                "--pa

[Read the thread](https://github.com/tufantunc/ssh-mcp/issues/19) · 2025-10-31 · closed · outside contributor · 3 comments

### Ability to customise max characters

Hello!

I'd like to be able to configure the max characters, because I use Claude Code to write a large file and it has worked fine until the MCP started blocking it. :-)

Thanks for a great project.

[Read the thread](https://github.com/tufantunc/ssh-mcp/issues/12) · 2025-10-03 · closed · external user · 3 comments

### Bug Report - SSH MCP Server

## Problem Information

**Package:** ssh-mcp  
**Version:** 1.0.8 (latest)  
**Repository:** https://github.com/tufantunc/ssh-mcp  
**Report Date:** January 2025

## Error Description

The SSH MCP Server is throwing the error `keyValidator._parse is not a function` when trying to execute commands via MCP, even with correct configuration and working SSH connectivity.

## Environment

- **Operating System:** Windows 10 (10.0.19045)
- **Node.js:** v20.15.0
- **NPM:** 10.7.0
- **MCP Client:** Cursor

[Read the thread](https://github.com/tufantunc/ssh-mcp/issues/10) · 2025-09-29 · closed · external user · 3 comments

## Most recent

### Static audit of ssh-mcp: 1 hardening suggestion, nothing exploitable

Hi — this is not a vulnerability report, so I'm opening it in the open
rather than privately.

I wrote an open-source static scanner for MCP servers
([mcpaudit](https://github.com/allenwu-blip/mcpaudit)), ran it against this repo,
then read the source behind every hit. Full write-up below.

Happy to be told I got any of it wrong.

---

**TL;DR:** I scanned the repository with my open-source static analyzer, `mcpaudit`. I found **one minor hardening opportunity** in the policy engine and **no exp

[Read the thread](https://github.com/tufantunc/ssh-mcp/issues/172) · 2026-08-28 · open · external user · 0 comments

### MCP spec conformance: 6 requirement(s) violated (via @hasmcp/mcp-spec-test) — spec 2026-07-28

When `ssh-mcp` (via `npx -y ssh-mcp`, no SSH backend or config needed to reproduce) is tested against the newest MCP spec revision (2026-07-28) with `@hasmcp/mcp-spec-test`, the server responds to `server/discover` with a JSON-RPC `-32601 Method not found` error, which cascades into 22 further checks being unverifiable. The same server tests fully clean (0 failures) against the older 2025-11-25 revision it also advertises support for in its handshake — so this looks like `server/discover` (a met

[Read the thread](https://github.com/tufantunc/ssh-mcp/issues/161) · 2026-08-24 · closed · external user · 1 comment

### Possible by not specifying a USER, a program in the container may run as 'root' in Dockerfile

Came across something in `docker/alpine-sshd/Dockerfile` around line 20 that looked worth flagging.

The Dockerfile lacks a USER directive, causing the sshd process to run as root. Running with unnecessary root privileges (CWE‑250) means any compromise of the SSH daemon gives an attacker full control over the container. This is a high‑risk issue that should be mitigated by ensuring the final USER is a non‑root user.

<details>
<summary>The code in question</summary>

CMD ["/usr/sbin/sshd", "

Read the thread · 2026-08-20 · closed · external user · 1 comment

maxChars: the config file cannot express the "no limit" the CLI flag documents

Summary

--maxChars=none disables the command-length cap. There is no way to express that in the config file, so a migration from flags to a TOML config silently tightens the limit unless you notice.

This is much smaller than #95: the flag route works, so nothing is unreachable. It is a parity gap between the two ways of setting the same value.

The flag accepts three spellings of "no limit"

src/index.ts:56-62:

function parseMaxChars(raw: string | null | undefined): number {
 

[Read the thread](https://github.com/tufantunc/ssh-mcp/issues/123) · 2026-08-12 · closed · outside contributor · 2 comments

### roleBindings documented as configurable, but PolicyEngine always uses compiled-in DEFAULT_RULES

## Summary

The README tells operators to grant a command class by editing `roleBindings` in the config file, but `roleBindings` is not read from config. `PolicyEngine` is always constructed with the compiled-in `DEFAULT_RULES`, so on a host correctly labelled `group = "prod"` there is no supported way to allow `privileged-command`, short of running an OPA sidecar.

## The documented instruction

README, "Roles":

> Leaving a real production host on `prod` and granting sudo there is a policy cha

[Read the thread](https://github.com/tufantunc/ssh-mcp/issues/95) · 2026-08-10 · closed · outside contributor · 2 comments

### ssh-mcp@1.5.0 fails to load: zod-to-json-schema imports zod/v3 but pinned zod@3.23.8 doesn't export it

## Symptom

Fresh install (`npx -y ssh-mcp --help` on a machine without a warm cache) throws on startup:

node:internal/modules/esm/resolve:310 return new ERR_PACKAGE_PATH_NOT_EXPORTED( ^

Error [ERR_PACKAGE_PATH_NOT_EXPORTED]: Package subpath './v3' is not defined by "exports" in /Users/.../node_modules/zod/package.json imported from /Users/.../node_modules/zod-to-json-schema/dist/esm/selectParser.js


## Root cause

`ssh-mcp@1.5.0` has two conflicting dependency declarations:

[Read the thread](https://github.com/tufantunc/ssh-mcp/issues/47) · 2026-05-14 · closed · outside contributor · 1 comment

### VULN: Command Injection

tufantunc ssh-mcp 1.5 Command Injection

A command injection flaw exists in ssh-mcp when su mode is active and the description field is appended into shell input. description only escapes # but not line breaks, so a value like foo\nuseradd hacker is written into the root shell session (shell.write()), causing attacker-controlled commands to execute as root. This gives an adversary arbitrary root command execution through a seemingly innocuous metadata field and is a critical privilege escalation

[Read the thread](https://github.com/tufantunc/ssh-mcp/issues/44) · 2026-04-07 · closed · external user · 1 comment

### VULN: Information Exposure Through Server Log Files

tufantunc ssh-mcp 1.5 Information Exposure Through Server Log Files
A command injection flaw exists in `ssh-mcp` when `su` mode is active and the `description` field is appended into shell input. `description` only escapes `#` but not line breaks, so a value like `foo\nuseradd hacker` is written into the root shell session (`shell.write()`), causing attacker-controlled commands to execute as root. This gives an adversary arbitrary root command execution through a seemingly innocuous metadata fie

[Read the thread](https://github.com/tufantunc/ssh-mcp/issues/43) · 2026-04-07 · closed · external user · 1 comment

### Add readOnlyHint annotation to enable parallel tool calls in Claude Code

## Problem

Claude Code serializes MCP tool calls that don't declare `readOnlyHint: true` in their tool annotations. This means when using multiple ssh-mcp server instances (one per host), all commands run sequentially rather than in parallel — even though they target independent machines.

## Background

Per [anthropics/claude-code#14353 (comment)](https://github.com/anthropics/claude-code/issues/14353#issuecomment-3893110487), Claude Code uses the MCP `readOnlyHint` annotation to determine whe

[Read the thread](https://github.com/tufantunc/ssh-mcp/issues/36) · 2026-02-12 · closed · external user · 2 comments

### Allow setting parameters using environment variables.

I don't want to hard code paths to the key file, so it would be awesome if it would look for things like `SSH_MCP_KEY` in environment in addition to cmd arguments.

[Read the thread](https://github.com/tufantunc/ssh-mcp/issues/32) · 2026-01-27 · closed · external user · 1 comment

### An error occurred when using the MCP tool to execute the script: {"exec": "MCP error -32603: Error (code 1):/nthe input device is not a TTY/n"}

Can the -t parameter be added to the SSH command in the source code to resolve this issue?

[Read the thread](https://github.com/tufantunc/ssh-mcp/issues/31) · 2026-01-23 · closed · external user · 1 comment

The remaining reports are on [the project's issue tracker](https://github.com/tufantunc/ssh-mcp/issues).