Loading ToolBench
A secure SSH server for the Model Context Protocol (MCP), enabling LLMs to execute commands on remote hosts
ssh-mcp has well-structured tool definitions with clear names and descriptions. All four tools follow verb_noun naming (ssh_connect, ssh_execute, ssh_disconnect, ssh_list_sessions). Descriptions are present and substantive (100-150 chars each). Input schemas are visible and typed. However, parameter descriptions are sparse or missing for several fields, output schemas are not documented, and error handling lacks recovery guidance. The server accepts passwords as parameters (security risk) and does not validate command/arg constraints at the schema level.
Connect to a remote host via SSH. Supports ssh-agent, key file, and password authentication. Returns a session_id for subsequent commands.
Disconnect an SSH session and release its resources.
Execute a command on a connected SSH session. The command binary must be in the server's allowed list. Arguments are validated against a strict pattern. Returns stdout, stderr, exit code, and execution metadata.
List all active SSH sessions with their connection details.
Password parameter exposed in ssh_connect. Credentials must never appear as tool parameters; use server-side secret injection via environment variables or vault. Agent traces log every parameter, secrets in params leak into logs and prompt history.
Output schemas not documented. ssh_list_sessions returns JSON but structure is not specified. LLMs cannot plan downstream calls or extract fields without knowing the response schema. Document the structure of session objects and list responses.
Parameter descriptions incomplete. 'env' in ssh_execute lacks detail on allowed keys and format. 'timeout' has no range (min/max). 'auth_method' enum is documented but 'key_path' and 'password' descriptions do not explain when each is required or mutually exclusive.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 56 | <=2025-11-25 | v2 |
Error handling lacks recovery guidance. Errors like 'SSH connection failed' or 'Execution error' do not tell the LLM what to do next. Include actionable recovery steps: 'Check host/port/credentials and retry' or 'Session may have timed out, call ssh_connect again.'
No tool annotations. ssh_execute and ssh_disconnect are destructive (WRITE risk) but lack readOnlyHint/destructiveHint annotations. Agents cannot distinguish safe (read-only) from risky (destructive) tools without explicit hints.