bvisible/mcp-ssh-manager

MCP SSH Manager - SSH Remote Server Management via Model Context Protocol 🚀

A Model Context Protocol (MCP) server that enables Claude Code and OpenAI Codex to manage multiple SSH connections. Execute commands, transfer files, manage databases, create backups, monitor health, and automate DevOps tasks across your servers — directly from your AI assistant.

🎉 What's New in v3.8.6

🔒 Security release — six advisories fixed. Upgrade. (Released: October 8, 2026)

• 🔴 Command injection on your own machine through the default on-error hook (GHSA-759m-wfpq-xmx3) — the connection error, whose text a server chooses, was pasted into a shell command. Any SSH server you connected to could run a command on the machine running mcp-ssh-manager. Hook values now reach commands as shell variables, never as command text, and the default hook writes its log without a shell.
• 🔴 restricted mode only checked how a line started (GHSA-rfxw-26h6-7w42) — ^echo let echo hi; id through. Every command in a list or pipeline must now match your allowlist; command substitution and writes to files are refused.
• 🔴 cwd reached the shell unquoted (GHSA-37fv-fcpc-j236), past the security policy.
• 🔴 ssh_db_query could write (GHSA-9w6j-vg8f-hp8g, GHSA-q37w-vhpx-q5q9) — SELECT … INTO OUTFILE, SELECT … INTO a new table, and JavaScript in MongoDB queries. Queries now run in a read-only transaction, and a MongoDB query must be a filter document.
• 🟠 Host keys were never compared (GHSA-cwg3-pfmm-w8rm) — a changed host key is now refused, as OpenSSH does. A server reinstalled since its key was recorded needs ssh-keygen -R <host> once.
• ssh_deploy and ssh_backup_schedule quote every value, and a cron schedule must be a schedule.