Aegis-SSH-MCP

AI agents are useful when they can inspect logs, check services, look at containers, or run routine operational commands.

The dangerous version of that is simple:

Give the agent SSH access and hope it behaves.

Give the agent a narrow MCP tool that can only run commands you have approved.

That means an agent can do things like check Docker status, read logs, or run diagnostics without receiving a persistent shell, a pseudo-terminal, SSH agent forwarding, or hidden session state.

- connect an MCP client to Linux hosts over SSH
- let agents run a small set of operational commands
- keep command access host-scoped and rule-based
- audit what the agent tried to do
- preserve your existing SSH, Linux, sudo, and host security model

It is not a replacement for SSH, Linux permissions, sudo, IAM, RBAC, host hardening, or human judgment.

- give agents a persistent shell
- create hidden session state
- provide full OS-level sandboxing
- approve commands through a human workflow
- turn MCP into a full infrastructure automation platform

It gives an MCP client a controlled, auditable way to run approved SSH commands -- and leaves the rest of your security model intact.

- Docker Compose
- an MCP client with SSE support
- a reachable Linux host
- an SSH key or password for a least-privileged remote user

By default, Aegis exposes MCP over SSE at:

Create these folders next todocker-compose.ymlif they do not already exist:

./configs ./keys ./certs # only needed if you enable HTTPS

The repository already includes./ruleswith starter rule profiles.

Place the SSH private key Aegis should use inkeys/.

Keep the key permissions strict and use a dedicated, least-privileged SSH user where possible.

- one MCP endpoint
- one host-scoped SSH tool
- one assigned rule profile
- one bearer-token boundary for SSE

For example, a host with aliasdockerbecomes:

If one agent needs access to two hosts, add Aegis twice in the MCP client: one endpoint and one token per host alias.

A dynamic profile uses the same rule and SSH execution engine, but the MCP tool call supplies the host:

- readonly-safe
- debian-readonly
- debian-ops
- ubuntu-readonly
- ubuntu-ops
- rhel-readonly
- rhel-ops
- proxmox-readonly
- proxmox-ops
- docker-readonly
- docker-ops
- systemd-ops
- kubernetes-readonly
- network-diagnostics
- logs-readonly
- package-readonly

Aegis validates commands before it connects to the remote host.
- Parse the command into executable and arguments.
- Reject shell control features such as redirects, chaining, and command substitution.
- Allow only a limited set of safe pipeline filters.
- Apply executable, argument, and full-command blacklist checks.
- Apply executable, argument, and full-command whitelist checks.
- Attempt SSH only if the command passes validation.

Aegis uses defense in depth. It is not one magic security layer; it is several smaller boundaries working together.

- use dedicated least-privileged SSH users
- pin SSH host keys withhost_key_fingerprint
- use narrow rule profiles first
- enable TLS or run behind a trusted reverse proxy
- rotate bearer tokens regularly
- collect Aegis logs centrally
- keep sudo policy explicit and minimal

- stealth_mode: returns a normal-looking fake response for blocked commands
- fake_response: custom response used whenstealth_modeis enabled
- redaction_enabled: masks matching output before results are returned
- redaction_patterns: regex patterns used for output redaction
- host_key_fingerprint: recommended SSH host key pinning

mcpSettings: allowedDomains: - "192.168.100.184" mcpServers: aegis-docker: type: sse url: "http://192.168.100.184:8443/mcp/docker/sse" headers: Authorization: "Bearer change-me-docker-key" timeout: 120000 initTimeout: 30000

The README is meant to help you understand and try Aegis quickly. The deeper docs are here:

Aegis has an early-stage API and an operational runtime.

- MCP over HTTP/SSE
- MCP over stdio
- multi-host configuration
- rule-based command validation
- audit logging
- SSH key authentication
- password authentication
- host fingerprint pinning
- ephemeral per-request SSH execution
- hardened shell-less distroless container runtime
- optional output redaction
- hot reload for config and rule changes

For bugs, setup questions, or operational feedback, open an issue in this repository.

Contributions are welcome, especially around:

- MCP client interoperability
- rule validation improvements
- observability
- deployment hardening
- transport support
- testing and validation

Until a dedicated contributing guide lands, opening an issue before a large change is the best way to align on direction.

awaBerry Agentic allows for secure remote access to any terminal based device for workflows allowing any Agent and Large Language Model based routine to execute commands on your devices for getting access to required data - and to also write genrated data back.

DevOps MCP — Secure MCP Server for Linux Server Automation

A three-tier access control MCP server that allows AI assistants (Claude Code, Cursor, Windsurf) to safely scan, plan, and operate Linux servers via SSH without full write access. Includes an out-of-band human consent token gate, automated port-conflict scanning, and a completely read-only default safe mode to eliminate accidental destructive commands on production environments.

Give your AI agents access to production without the risks of sharing SSH keys.

A security-focused MCP server for performing safe operations on an Ubuntu system, featuring robust security controls and audit logging.

Secure every MCP server with one governed gateway. Give each AI agent its own scoped MCP access, contain credentials at the gateway, and audit every MCP tool call without wiring agents directly to each server.

Civilian situational awareness for AI deployments — real-time risk dashboards, multi-source threat correlation, anomaly detection, and automated alerting for critical infrastructure and enterprise AI systems.

MCP server to Automate Exposure Management

Security gateway for AI agents. Provides scoped tokens with automatic credential injection, human-in-the-loop approval for dangerous commands, SSH execution, vault management, organization skills, wiki, agent memories, and full audit logging. Self-hosted or cloud.

Monitor WAF events, analyze attacks, tune rules and whitelist IPs for OWASP ModSecurity CRS via Docker