MCP Server SSH Client

A local MCP server that securely connects to remote servers over SSH, acting as a proxy for MCP commands.

A Model Context Protocol Server (Remote SSH client) that connects to remote MCP servers over SSH. This client enables accessing and utilizing MCP tools hosted on remote servers, providing a secure channel for MCP communication.

- Connect to any MCP server over SSH
- Proxy all MCP protocol commands through a secure SSH channel
- Support for key-based authentication
- Support for MCP capabilities including tools, prompts, and resources

In auvmanaged python project, add to dependencies by:

Alternatively, for projects usingpipfor dependencies:

git clone https://github.com/Machine-To-Machine/m2m-mcp-server-ssh-client.git cd m2m-mcp-server-ssh-client pip install -e .

We maintain a public demo server with various MCP tools already configured and ready to use. (This server will be available until we release our open, decentralized registry.)

This demo server has multiple MCP servers including HackerNews, MLB Stats API, and Formula 1 API tools for you to experiment with.

To connect Claude to this server, simply add the following to Claude Desktop settings.

"mcpServers": { "remote-mcp-tools": { "command": "uvx", "args": [ "m2m-mcp-server-ssh-client", "--host", "mcp-beta.machinetomachine.ai", "--port", "8022", "--use-key-server" ] } }

# Connect to the M2M public demo server with automatic key exchange uv run m2m-mcp-server-ssh-client --host mcp-beta.machinetomachine.ai --use-key-server

For setting up your own SSH server, refer tom2m-mcp-server-ssh-server.

# Connect to a local MCP SSH server uv run m2m-mcp-server-ssh-client

# Use the key server for automatic key management (if server has --run-key-server enabled) uv run m2m-mcp-server-ssh-client --use-key-server

# Using existing SSH keys uv run m2m-mcp-server-ssh-client --host your-server.example.com --client-key ~/.ssh/your_key --known-hosts ~/.ssh/known_hosts

"mcpServers": { "remote-mcp-tools": { "command": "uvx", "args": [ "m2m-mcp-server-ssh-client", "--host", "mcp-beta.machinetomachine.ai", "--port", "8022", "--use-key-server" ] } }

For debugging or exploring available tools:

npx @modelcontextprotocol/inspector -- uvx m2m-mcp-server-ssh-client --host mcp-beta.machinetomachine.ai --port 8022 --use-key-server

- --host: Remote SSH server host (default: "localhost")
- --port: Remote SSH server port (default: 8022)
- --username: SSH username (default: "mcp")
- --client-key: Client private key file (default: "~/.ssh/m2m_mcp_server_ssh_client")
- --known-hosts: Path to known hosts file (default: "~/.ssh/known_hosts")
- --passphrase: Passphrase for the private key (default: None)
- --disable-host-key-checking: Skip server signature verification (default: False)
- --log-level: Set logging level (default: INFO)

Connect to a remote MCP server (SSH server) running on port 8022:

uvx m2m-mcp-server-ssh-client --host mcp.example.com

Specify a particular SSH key for authentication:

uvx m2m-mcp-server-ssh-client --host mcp.example.com --client-key ~/.ssh/mcp_custom_key

uvx m2m-mcp-server-ssh-client --host mcp.example.com --client-key ~/.ssh/mcp_custom_key --passphrase "your-passphrase"

Enable detailed logging for troubleshooting connection issues:

uvx m2m-mcp-server-ssh-client --host mcp.example.com --log-level DEBUG

The MCP SSH Client can use a key server for dynamic key exchange and verification:

uvx m2m-mcp-server-ssh-client --host mcp.example.com --use-key-server

- The client fetches the server's public key fromhttp://host:key-server-port/server_pub_key
- The client registers its public key with the server athttp://host:key-server-port/register
- A temporaryknown_hostsfile is created for the SSH connection

This feature is mutually exclusive with--known-hostsand--disable-host-key-checking.

⚠️ Security Warning: Using--disable-host-key-checkingmakes your connection vulnerable to man-in-the-middle attacks. Only use this option in trusted networks or for development/testing purposes.

uvx m2m-mcp-server-ssh-client --host localhost --disable-host-key-checking

"mcpServers": { "remote-servers": { "command": "uvx", "args": [ "m2m-mcp-server-ssh-client", "--host", "example.com", "--port", "8022", "--username", "mcp" ] } }

For a more secure configuration with a specific key:

"mcpServers": { "remote-servers": { "command": "uvx", "args": [ "m2m-mcp-server-ssh-client", "--host", "mcp-server.example.com", "--port", "8022", "--username", "claude-mcp", "--client-key", "~/.ssh/claude_mcp_key", "--known-hosts", "~/.ssh/mcp_remote_server" ] } }

The MCP Server SSH Client establishes an SSH connection to a remote server running the MCP Server SSH Server for MCP tools, i.e.,m2m-mcp-server-ssh-server. It then:
- Creates a local proxy server that mirrors the capabilities of the remote MCP server
- Forwards all MCP requests to the remote server through the SSH connection
- Returns responses from the remote server to the local client

%%{init: {'theme':'default', 'themeVariables': { 'primaryColor': '#5D8AA8', 'primaryTextColor': '#fff', 'primaryBorderColor': '#1F456E', 'lineColor': '#5D8AA8', 'secondaryColor': '#006400', 'tertiaryColor': '#fff' }}}%% sequenceDiagram participant Host as MCP Host<br>(Claude/Cursor) participant Client as MCP SSH Client participant KeySrv as Key Server<br>(HTTP API) participant SSHSrv as MCP SSH Server participant MCP as MCP Servers Note over Client,SSHSrv: Initial Key Exchange & Authentication Client->>Client: Generate SSH key pair<br>if does not exist Client->>KeySrv: GET /server_pub_key KeySrv->>Client: Return server's public key Client->>Client: Store server key in<br>temporary known_hosts Client->>KeySrv: POST /register<br>{client_pub_key: "ssh-ed25519 AAAA..."} KeySrv->>SSHSrv: Store client public key<br>in authorized keys KeySrv->>Client: {status: "success"} Note over Client,SSHSrv: Secure SSH Connection Client->>SSHSrv: SSH handshake with<br>client key authentication SSHSrv->>SSHSrv: Verify client key<br>against authorized keys SSHSrv->>Client: Authentication successful Note over Client,SSHSrv: MCP Communication Host->>Client: JSONRPC request Client->>SSHSrv: Forward request<br>over SSH tunnel SSHSrv->>MCP: Route request to<br>appropriate MCP server MCP->>SSHSrv: Process and return results SSHSrv->>Client: Send response over SSH Client->>Host: Return JSONRPC response Note over Client,SSHSrv: Session Management alt Session Termination Host->>Client: Close connection Client->>SSHSrv: Terminate SSH session SSHSrv->>SSHSrv: Clean up resources end

Error running MCP SSH client: [Errno 111] Connection refused

Solution: Verify the host and port are correct and that the SSH service is running.

Error running MCP SSH client: Authentication failed

Solution: Check the key file path. Ensure the remote server has your public key installed.

Error running MCP SSH client: Host key verification failed

Solution: Either add the host key to your known_hosts file or use--disable-host-key-checking(for testing only).

- anyio (>=4.5.0)
- asyncssh (>=2.20.0)
- mcp (>=1.1.3)
- pydantic (>=2.0.0)

git clone https://github.com/Machine-To-Machine/m2m-mcp-server-ssh-client.git cd m2m-mcp-server-ssh-client uv venv source .venv/bin/activate # On Windows: .venv\Scripts\activate uv pip install -e ".[dev]"

# Run linting uv run ruff check . # Run formatting check uv run ruff format --check . # Run security checks uv run bandit -r src/

You can use the MCP inspector to debug the client:

npx @modelcontextprotocol/inspector uvx m2m-mcp-server-ssh-client --host example.com

For advanced debugging, use the following workflow:
- Start the client with--log-level DEBUG
- Check the SSH connection parameters and handshake process
- If using custom keys, verify correct paths and permissions
- Usessh -vdirectly to test basic connectivity first

We welcome contributions to help expand and improvem2m-mcp-server-ssh-client. Whether you want to add new features, enhance existing functionality, or improve documentation, your input is valuable.

Pull requests are welcome! Feel free to contribute new ideas, bug fixes, or enhancements.
- Fork the repository
- Create a feature branch:git checkout -b feature-name
- Commit your changes:git commit -am 'Add some feature'
- Push to the branch:git push origin feature-name
- Submit a pull request

MIT License - See LICENSE file for details.

-

A comprehensive MCP server for configuring and managing Cisco ACI (Application Centric Infrastructure) fabrics through the APIC REST API.