MCP SSH Proxy - Electron App for manual SSH command approval
Four tools with complete schemas and descriptions. Naming follows verb_noun pattern (ssh_list_hosts, ssh_exec, ssh_upload, ssh_download). Descriptions are clear and contextual (avg ~180 chars), explaining WHAT, WHEN, and prerequisites. All parameters have type definitions and descriptions. However, output schemas are not formally documented, responses are returned as text blobs rather than structured objects. Error handling is minimal (generic 'Error: {message}' responses). No input validation guidance or recovery hints. Missing tool annotations (readOnlyHint/destructiveHint). Parameter descriptions lack format constraints (e.g., no guidance on valid host names, command syntax, or file size limits).
Downloads a file from a configured SSH server via SFTP. Without `local_path` the content is returned inline (text when it is valid UTF-8, otherwise base64, capped at max_bytes). With `local_path` the file is saved on the proxy machine. The user approves the transfer in the desktop app before it runs.
Runs a shell command on one of the configured SSH servers. The user reviews and approves (or edits/rejects) the command in the SSH Proxy desktop app before it runs. Returns stdout, stderr and the exit code. Use ssh_list_hosts to discover valid host names.
Lists the SSH servers configured in the SSH Proxy desktop app. Returns each host name (the value to pass as `host` to ssh_exec) plus its address and user. No secrets are returned. Call this first to discover which servers you may reach.
Uploads a file to a configured SSH server via SFTP. Provide inline `content` (text, or base64 with content_encoding=base64) OR a `local_path` on the machine running the proxy. The user approves the transfer in the desktop app before it runs. Use ssh_list_hosts to discover host names.
Output schemas not documented. Tools return text blobs (JSON stringified or formatted text) rather than structured objects with typed fields. LLMs cannot reliably extract fields for downstream tool calls.
Missing tool annotations. ssh_exec and ssh_upload are destructive (WRITE risk) but lack destructiveHint annotation. ssh_list_hosts and ssh_download are read-only but lack readOnlyHint. Agents cannot distinguish safe from unsafe operations.
Error handling lacks recovery guidance. Errors return generic 'Error: {message}' text. No categorization (retryable vs fatal), no actionable next steps, no invalid-value feedback. LLMs cannot self-correct.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 60 | 2026-07-28+ | v2 |
Parameter descriptions lack format constraints. 'host' parameter has no guidance on valid host names (e.g., must match configured servers). 'command' has no syntax hints. 'remote_path' has no absolute-path requirement stated. Invites invalid input.
ssh_upload has mutually exclusive parameters (content vs local_path) but no explicit statement in descriptions. LLMs may pass both, causing ambiguous behavior.