ssh-mcp

A community MCP server that gives agents SSH access to remote Linux and Windows hosts, wrapped in policy machinery: commands are classified, profiles carry a role of viewer, operator or admin against prod, staging and dev tiers, and destructive or privileged commands require approval. It exposes eleven tools including run-command, which executes arbitrary commands, and privileged-command, which runs them under sudo.

The approval path is built on MCP elicitation: the server raises an elicitation request and the client renders the prompt. The README is explicit that this fails closed, so a client with no elicitation support has every destructive and privileged command refused rather than waved through.

The security record is material to anyone deploying it. Six advisories were published between 2026-08-09 and 2026-09-02, and five describe the same class of defect: the classifier that decides whether a command is read-only, destructive or privileged can be made to read something different from what the remote shell actually executes, which defeats both read-only mode and the approval gate. The most recent, GHSA-qvx5-rxrj-9vfh, is rated critical, affects versions up to and including 2.5.1, and is fixed in 2.6.0; the registry currently points at 2.7.0. The project's own changelog for 2.7.0 states that some classifier-evasion spellings remain unaddressed by design.

Spec-revision support is unverified: no surface names a revision, and the @modelcontextprotocol/sdk ^1.30.0 dependency is a range rather than evidence of what the server implements.