Public assessment

bvisible/mcp-ssh-manager (mcp-ssh-manager)

mcp-ssh-manager · v1.2.0 · scanned Aug 3, 2026

What changed in the harness

Selection accuracy 98→95, token cost up 9%, unconfirmed writes 0%→0%.

Category breakdown

Where the score comes from.

Earned points across the four signals Gradable measures. Safety and Legibility are scored out of 30; Economics and Discoverability are scored out of 20.

01Safety

0.0 / 30

0.0 out of 30

02Legibility

19.2 / 30

19.2 out of 30

03Economics

13.8 / 20

13.8 out of 20

04Discoverability

15.5 / 20

15.5 out of 20

Highest-impact fix

Estimated gain +30 points

Add explicit identity and permission preflight tools

Expose machine-readable principal/tenant confirmation and a non-mutating permission check so agents can verify both before destructive actions.

Description evidence

Defects and rewrites.

26 defects found across the exposed tool descriptions. Suggested rewrites make purpose, inputs, boundaries, and returns easier for an agent to understand.

Tool	Defect types	Suggested rewrite
`ssh_upload`	params_unexplained no_return_description	Uploads one local file to a remote destination path over SFTP on the named configured server, overwriting any existing remote file at that path. Mutates remote state and is not idempotent beyond replacing the target. Creates no backup. Requires the local file to exist. Does not use sudo, so the remote path must be writable by the configured SSH user. This tool is blocked entirely on servers set to readonly or restricted security mode. For directory trees use ssh_sync instead. Returns a success or failure result for the upload.
`ssh_download`	params_unexplained no_return_description	Downloads one remote file from the named configured server to a local destination path over SFTP, overwriting any existing local file at that path. Affects only the local filesystem and is read-only on the remote side, so it stays allowed even on servers in readonly or restricted security mode. Reads the remote file using the configured SSH user, which must have permission to read it. Handles single files only; use ssh_sync for directories. Returns a success or failure result for the download and the local path saved.
`ssh_sync`	no_return_description	Synchronizes files or directories between local and remote using rsync over SSH on the named server. Each of source and destination must carry a local: or remote: prefix and one side must be local and the other remote; with no prefix it assumes a push from local to remote. Mutates the destination. Setting delete true removes destination files absent from source, which is destructive; dryRun true previews without changing anything. Compression is on by default. Password authentication requires sshpass installed locally. Blocked on readonly or restricted servers. Timeout defaults to 30000 ms. Returns the sync result including a transfer summary and any errors.
`ssh_session_send`	no_return_description	Runs one command inside an already-open session identified by its session ID, reusing the persisted working directory, environment, and history of that shell. Mutates remote state like any shell command and is not idempotent; cd and export update the saved context for subsequent calls. Commands run through a bash-style shell (Unix-oriented). The security policy of the underlying server is enforced, so readonly or restricted servers may refuse. Default timeout is 30000 ms. Returns the command output, stderr, and exit status.
`ssh_session_close`	no_return_description	Terminates an open SSH session given its session ID, writing exit to the remote shell, ending it, and discarding its in-memory history and context; the session ID becomes unusable afterward. Destructive to session state but does not delete remote files. Passing the literal value all closes every active session at once, ignoring individual close errors. It does not drop the pooled underlying connection, only the interactive shell. Returns the outcome of the close operation and which sessions were closed.
`ssh_group_manage`	params_unexplained no_return_description	Creates, updates, deletes, and inspects named server groups used by ssh_execute_group, persisting changes to local configuration only with no remote side effects. The action selects the operation: create, update, delete, add-servers, remove-servers, or list. Every action except list requires name; add-servers and remove-servers also require a non-empty servers array listing the names of the servers to add or remove. list is read-only. Optional strategy, delay, and stopOnError set default group execution behavior. Returns the updated group details for list or the result of the requested mutation.
`ssh_deploy`	no_return_description	Deploys a list of local files to remote paths on the named server, uploading each to a temporary location first and then moving it into place. Mutates remote state. By default it backs up any existing target file before overwriting; backup can be disabled per call. Options can set owner and permissions, supply a sudo password, and name a single service to restart afterward. Detects sensible owner and permission defaults from the remote path. Runs pre and post deploy hooks. Blocked entirely on servers in readonly or restricted security mode. Returns the deployment result per file including any errors.
`ssh_hooks`	no_return_description	Manages automation hooks that fire around SSH operations such as pre-deploy, toggling them on or off in local configuration only with no immediate remote action. The action selects behavior: list shows each hook with its enabled state, description, and action count; enable and disable flip a hook and both require the hook name; status summarizes which hooks are currently enabled versus disabled. Toggling persists and affects later operations. Returns the current hook state or the outcome of the requested action.
`ssh_profile`	no_return_description	Manages SSH Manager profiles that bundle command aliases and hooks for different project types, affecting local configuration only with no remote side effects. The action selects behavior: list shows available profiles and the active one, current shows the active profile details, and switch activates a named profile and requires the profile argument. A successful switch reports that Claude Code must be restarted before the new profile takes effect. Returns the profile listing, the active profile details, or the outcome of the switch.
`ssh_connection_status`	no_return_description	Inspects and manages the pooled SSH connections held by this server process; affects only local in-memory connections, never remote state. The action parameter selects: status lists active connections with age and keepalive (read-only); reconnect closes then reopens one connection; disconnect closes one connection; cleanup drops aged-out and dead connections. The server parameter is required for reconnect and disconnect and ignored otherwise. Returns connection details for status or the outcome of the requested action.
`ssh_tunnel_create`	params_unexplained	Opens a new SSH connection to the named server and starts a port-forwarding or SOCKS proxy tunnel that keeps running until closed. The type parameter selects local forward, remote forward, or dynamic SOCKS5 proxy. localPort is the port on the local host to bind for the forwarding and is always required; remoteHost and remotePort are required for local and remote types but ignored for dynamic. localHost defaults to 127.0.0.1. Returns a tunnel ID used later to close it.
`ssh_tunnel_close`	no_return_description	Tears down active SSH tunnels created earlier, freeing the bound local ports; this affects only local tunnel state, not the remote host. Exactly one of tunnelId or server must be supplied: tunnelId closes that single tunnel, while server closes every tunnel for the named server and reports how many were closed. Supplying neither raises an error. Closing is final and cannot be undone. Returns the outcome of the close operation and how many tunnels were closed.
`ssh_key_manage`	no_return_description	Manages SSH host key fingerprints in your local known_hosts file for the named server. The action parameter selects: verify, check, and list are read-only comparisons or listings; accept adds or updates the host key in known_hosts; remove deletes it. accept and remove mutate local state and are blocked on servers configured as readonly. server is required for every action except list. autoAccept defaults to false and should be used with caution. Returns the verification result, the listing, or the outcome of the mutation.
`ssh_alias`	no_return_description	Manages local name aliases that let you reference a configured server by a shorter or alternative name. The action parameter selects add, remove, or list. add creates an alias pointing to an existing server and requires both alias and server; remove deletes an alias and requires alias; list shows all aliases (read-only). add and remove persist the alias mapping locally. The target server must already exist for add to succeed. Returns the alias listing or the outcome of the requested change.
`ssh_backup_create`	params_unexplained no_return_description	Creates a database or file backup on the named remote server (the configured SSH server identified by server), writing a compressed archive plus a JSON metadata file into backupDir. Supports mysql, postgresql, mongodb, and files (full is not yet implemented and errors). Database types require database; files requires paths. After writing it prunes backups older than retention days (default 7); compress defaults to true. Runs pre-backup and post-backup hooks. Returns the created backup id and the paths of the archive and metadata files written on the remote host.
`ssh_backup_list`	params_unexplained	Lists existing backups found in backupDir on the named remote server (the configured SSH server identified by server), returning each backup id, type, database or paths, size, compression, retention, status, and creation time parsed from stored metadata. Read-only: it inspects the filesystem and mutates nothing. Optional type filters results to mysql, postgresql, mongodb, files, or full. backupDir defaults to the configured backup directory.
`ssh_backup_restore`	params_unexplained no_return_description	Restores a previously created backup identified by backupId on the named remote server (the configured SSH server identified by server), reading its metadata to pick the engine. This is destructive and overwrites the target: PostgreSQL runs pg_restore with --clean --if-exists which DROPs existing objects, MongoDB runs mongorestore --drop, and MySQL pipes the dump into the live database replacing matching objects. Supports mysql, postgresql, mongodb, and files. Runs pre-restore and post-restore hooks. Returns the restore outcome including which engine was used and the target database or path restored.
`ssh_backup_schedule`	params_unexplained no_return_description	Schedules a recurring backup on the named remote server (the configured SSH server identified by server) by writing an executable bash script to /usr/local/bin/ssh-manager-backup-NAME.sh and installing a crontab entry for the given cron expression. Mutates the remote filesystem and crontab, and typically needs root to write that path. Supports mysql, postgresql, mongodb, and files; the generated script also deletes backups older than retention days (default 7). Returns confirmation with the installed script path and cron entry.
`ssh_health_check`	params_unexplained	Runs a comprehensive read-only health check on the named server (the configured SSH server identified by server) by executing diagnostic shell commands over SSH, then returns parsed JSON with overall status, CPU, memory, disk usage, and uptime. It only reads metrics and changes nothing on the remote host. Set detailed to true to additionally include load average and network metrics; it defaults to false. Critical CPU, memory, or disk conditions are surfaced in a critical_issues list.
`ssh_service_status`	params_unexplained	Checks the running state of the named system services on a remote server (the configured SSH server identified by server) by querying each one over SSH, returning JSON per service plus running and stopped counts and an aggregate health rating. Read-only: it inspects status without starting, stopping, or restarting anything. The services array parameter is required and lists the service names to check, for example nginx, mysql, or docker; common names are resolved to their actual unit names automatically.
`ssh_process_manager`	params_unexplained	Lists, inspects, or terminates processes on a remote server (the configured SSH server identified by server) over SSH. The action parameter selects: list returns top processes (read-only), info returns details for one process (read-only), and kill sends a signal to terminate a process and mutates remote state. pid is required for kill and info. kill is blocked on servers configured as readonly. signal defaults to TERM, sortBy defaults to cpu, and limit defaults to 20; filter narrows the list by name or command. Returns the matching process list, the selected process details, or the kill result depending on action.
`ssh_alert_setup`	params_unexplained no_return_description	Configures and evaluates CPU, memory, and disk usage alert thresholds for a remote server (the configured SSH server identified by server). The action parameter selects: set writes the threshold config to /etc/ssh-manager-alerts.json on the remote host (mutating, may need write access to /etc, and is blocked on readonly servers); get reads back that config; check reads current metrics and compares them to stored thresholds. get and check are read-only. enabled defaults to true; check errors if no config exists yet. Returns the saved threshold config for set, the stored config for get, and the current metrics with pass/fail results for check.
`ssh_db_dump`	params_unexplained	Dumps a database to a file on the remote server (the configured SSH server identified by server) over SSH; it reads data only and does not modify the database. database names the database to dump on that server, and the output is written to the specified outputFile path on the remote host. Supports mysql (using --single-transaction --routines --triggers), postgresql (custom format with --clean --if-exists, restorable via pg_restore), and mongodb. compress defaults to true and gzips the output. The optional tables list applies to MySQL and PostgreSQL only and is ignored for MongoDB.
`ssh_db_import`	params_unexplained no_return_description	Imports a dump file into a target database on the remote server (the configured SSH server identified by server) and is destructive to existing data. PostgreSQL uses pg_restore --clean --if-exists which DROPs existing objects before loading; MongoDB uses mongorestore with --drop controlled by the drop flag (default true); MySQL pipes the file into the live database, replacing objects defined in it. Supports mysql, postgresql, mongodb. Compressed .gz inputs are decompressed automatically. Returns a confirmation with the import result and counts of objects affected.
`ssh_db_list`	params_unexplained	Lists database objects on the remote server (the configured SSH server identified by server) for the given engine without modifying anything. When database is provided it lists the tables (SQL) or collections (MongoDB) of that database; when omitted it lists all databases with common system databases filtered out. Supports mysql, postgresql, and mongodb. Returns the items and a count. Read-only and safe to call repeatedly.
`ssh_db_query`	params_unexplained	Runs a read-only query against a database on the remote server (the configured SSH server identified by server). database names the database to query. For mysql and postgresql it is strictly limited to SELECT: the query must begin with SELECT and any insert, update, delete, drop, create, alter, truncate, grant, revoke, or exec keyword is rejected before execution. For mongodb it runs a find() and requires the collection parameter. Returns the raw command output as text.

Selection evidence

Confusable tool pairs.

13 pairs where similar names or overlapping descriptions may send an agent toward the wrong tool.

Tool A	Tool B	Confidence	Why they collide
`ssh_command_alias`	`ssh_alias`	high	Both expose add/remove/list actions over 'aliases' with identical vocabulary; a task like 'add an alias' or 'show my aliases' is genuinely ambiguous between command aliases and server-name aliases.
`ssh_execute`	`ssh_execute_group`	medium	Both run a shell command and accept a target selector; a task like 'run this command on production' could be read as one server named production or as the production group, and execute takes no group parameter.
`ssh_execute`	`ssh_execute_sudo`	medium	A task like 'restart nginx' or 'run this as root' is ambiguous: plain execute can embed sudo in the command while execute_sudo prepends it, and the need for escalation is often implicit.
`ssh_connection_status`	`ssh_service_status`	medium	Both answer 'what is the status' and take a server parameter; 'check the server status' is ambiguous between the local pooled SSH connection and remote system services.
`ssh_backup_create`	`ssh_backup_schedule`	medium	A request like 'set up nightly backups for the database' could be read as creating one backup immediately or installing a recurring cron job; both accept type, database, and name.
`ssh_session_list`	`ssh_tunnel_list`	medium	Both list currently active connection-like resources with state, count, and an optional server filter; 'show me what connections are open' does not disambiguate sessions from tunnels.
`ssh_upload`	`ssh_download`	medium	Both transfer a single file; the only differentiator is direction, so phrasings like 'move this file between my machine and the server' or 'sync this file' leave the correct member under-specified.
`ssh_session_close`	`ssh_tunnel_close`	medium	Both tear down an active resource by ID or server; 'close the connection to server X' could target an interactive session or a tunnel, and neither name pins down which.
`ssh_db_list`	`ssh_db_query`	low	Both are read-only database introspection tools; a task like 'show me what's in the database' could mean listing tables/collections or running a SELECT query.
`ssh_execute_group`	`ssh_execute_sudo`	low	A task like 'run this with admin privileges on all servers' splits between a group run without sudo and a sudo run on one server; the tool that satisfies the full request is under-specified.
`ssh_backup_list`	`ssh_db_list`	low	Both can satisfy 'list the databases on this server': backup_list returns backup archives optionally filtered by database type, while db_list returns actual database objects.
`ssh_tail`	`ssh_monitor`	low	Both are read-only 'watch the server' tools; 'monitor the application' could be answered by tailing a log file or by the system-resource monitor.
`ssh_session_start`	`ssh_session_send`	low	A task like 'open a persistent shell and run this setup command' could cause the agent to call send without a prior start (missing session ID) or to start without sending, since both operate on interactive shells.

Compare the field

One score is useful.
The evidence makes it actionable.

Back to the leaderboard