Loading ToolBench
MCP server giving Claude Code 13 typed SSH tools across your server fleet. Pooled connections, per-user gated, context-lean output.
13 tools with strong naming (verb_noun pattern) and comprehensive descriptions (avg 180 chars, well above 10-char minimum). All tools have input schemas with typed parameters and enums for constrained inputs. However, output schemas are not documented in the provided source, critical for LLM planning. Parameter descriptions are present but inconsistent in depth; some lack format/range guidance. Error handling and recovery guidance are absent from tool definitions. Tool composition is sound (each does one thing), but no evidence of pagination support, result limits, or chaining IDs in responses. Security annotations (readOnlyHint/destructiveHint) are declared in metadata but not integrated into schema definitions.
Create, list, and restore backups on a configured server. Use instead of hand-rolled `ssh host "tar czf ..."` or `mysqldump` one-liners -- content-addressed with sha256 verification, a metadata sidecar, and a high-risk preview with structured result before any restore. Actions: create, list, restore, schedule.
Query and manage databases on a configured server. Use instead of `ssh host "mysql -e ..."` -- credentials go through env not argv, SELECT queries pass a token-level safety check, and rows render as a bounded aligned table. Actions: query, list, dump, import.
Drive Docker on a configured server. Use instead of `ssh host "docker ps"` / `docker logs` / `docker exec` -- container and image names are validated, mutations show a preview, and `ps` / `logs` output is capped so a busy host will not flood context. Actions: ps, logs, exec, restart, inspect.
Move and edit files on a configured server. Use instead of `scp local host:remote` or `ssh host "cat > f <<EOF ..."` -- SFTP transfer with sha256 verification, write/edit with no heredoc or shell-quoting hazard, deploy with structured before/after results. Actions: upload, download, sync, read, write, edit, diff, deploy, deploy-artifact.
Search files on a configured server. Use instead of a blind `ssh host "grep -rn PATTERN /"` -- a server-side timeout and match cap stop the walk early, /proc /sys /dev and .git are pruned, and hits come back as structured file/line/text rows instead of an unbounded dump. Actions: grep, locate, ls.
Output schemas not documented. Tool descriptions explain what they do but not what fields/structure they return. LLMs cannot plan downstream tool calls or extract chaining IDs without knowing response structure.
Parameter descriptions lack format/range guidance. E.g., 'timeout in milliseconds' does not specify min/max bounds. 'command to execute' does not warn about injection risks or length limits. LLMs cannot validate inputs without explicit constraints.
Inferred effective spec: 2026-07-28+.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 61 | 2026-07-28+ | v2 |
Inspect fleet and connection metadata. Use instead of `ssh -G hostname` or hand-grepping ~/.ssh/config -- lists configured servers, groups, aliases, profiles, hooks, keys, history, and live pooled connections as structured tables. Actions: servers, groups, aliases, command_alias, profiles, hooks, keys, history, connections.
Inspect server health. Use instead of stitching `ssh host top`, `ssh host df -h`, and `ssh host free -m` together -- one call returns a structured cpu/memory/disk/process snapshot, with at-capacity rows sorted to the top so the incident is visible first. Actions: check, watch, procs, alerts.
Read remote logs. Use instead of `ssh host journalctl` or `ssh host tail -f file` -- output is capped and grep-filtered so it will not flood context, and follow sessions resume from a cursor instead of re-streaming. Actions: tail, follow-start, follow-read, follow-stop, journal.
Manage SSH tunnels and probe ports on a configured server. Use instead of `ssh -L`, `ssh -R`, or `ssh -D` plus a manual `nc -z` reachability check -- tunnels are tracked with typed state and port-test runs a structured DNS to TCP to TLS chain. Actions: tunnel-open, tunnel-list, tunnel-close, port-test.
Run a declarative multi-step plan across configured servers. Use instead of a hand-sequenced batch of `ssh host cmd` calls -- steps dispatch to the other v4 tools, high-risk steps gate behind an approve token, and each step returns a structured result. Actions: run, approve.
Run commands on a configured server. Use instead of `ssh host "cmd"` -- a `script` action chains `cmd1; cmd2; cmd3` in one round trip with per-segment exit codes, the pooled connection skips the per-call SSH handshake, and output is capped so a noisy command will not flood context. Actions: exec, sudo, script, fleet, detach, job-status, job-kill.
Manage systemd services on a configured server. Use instead of `ssh host systemctl status nginx` -- returns a structured snapshot (ActiveState, SubState, recent log lines) over the pooled connection rather than a raw terminal page. Actions: status, start, stop, restart, enable, disable.
Drive a persistent shell on a configured server. Use instead of repeated `ssh host "cmd"` calls when shell state must persist -- one pooled session keeps cwd, env, and exit code across commands, with replay and an inferred-state snapshot. Actions: start, send, list, close, replay, memory.
No error handling or recovery guidance in tool definitions. Descriptions do not explain what errors are retryable, what user-fixable errors look like, or how to recover from failures. Agents will not know whether to retry, ask the user, or abort.
No pagination or result-limit documentation. Tools like ssh_find (grep), ssh_logs (tail), and ssh_fleet (list servers) may return unbounded results. Descriptions do not mention caps, pagination tokens, or how to handle large result sets.
Tool composition: ssh_plan accepts a 'plan' object but no schema is provided for its structure. LLMs cannot construct valid plans without knowing required/optional fields, step format, or approval token semantics.