termalSearch “ssh mcp server” and you’ll find a dozen projects that all promise to let an AI agent run SSH commands. They are not the same thing, and the differences — who holds the key, whether you can bound what runs, whether anyone can audit it — are exactly what decides if you can leave one running. This compares the three families: standalone servers you run yourself, hosted connectors you reach by URL, and SSH clients with a server built in.
Disclosure: we build Termalin, which appears in the third group. The rest are described from their public repos and docs, checked October 14, 2026.
Standalone servers (you run them; they hold a key)
You configure the hosts and keys, run the server, and point your agent at it. No GUI, scriptable, lightweight.
- tufantunc/ssh-mcp — the most-starred of the bunch (~800★, MIT, 14 tools, TypeScript), and the one to beat. Its v2 adds command classification (read-only / safe / destructive / privileged), RBAC roles (viewer / operator / admin), approval modes, an audit log with redaction, and host-key pinning. Set up that way, it answers the policy and audit questions most of this family punts on.
- AiondaDotCom/mcp-ssh (“MCP SSH Agent”) — reads your
~/.ssh/configandknown_hostsand shells out to nativessh. Simple and familiar. - blackaxgit/ssh-mcp — also uses
~/.ssh/config, with server groups for working a fleet. - veithly/ssh-client-mcp — SSH plus SFTP, password or key auth.
- idletoaster/ssh-mcp-server — Node, built on the official MCP SDK.
- the-nine-nation/remote-ssh-mcp — persistent, stateful sessions over your local OpenSSH.
- claude-ssh-mcp (MaraBank) —
pip/npx, the classic paste-a-password-in-chat style; the quickest to stand up and the bluntest on secrets.
The shared trait: the key lives wherever the server runs, usually a plain key file in the agent’s reach, and you audit after the fact from logs — if you configured logging. tufantunc’s v2 is the clear exception on both counts.
Hosted connectors (a URL; no key in the agent)
These answer the question the standalone servers can’t: what reaches my servers when my laptop is off?
- browser-ssh — a remote MCP server at
api.browserssh.com/mcpoffering, in its words, “scoped, audited SSH exec, sessions, and SFTP on saved servers without exposing credentials.” You add it to an agent as a URL. - sshrew (duriantaco) — the self-hosted twin: the box dials out through cloudflared and you paste the resulting URL into Claude’s custom connector, with allowlisted commands and a read-only share root (
~/.sshrew-share).
These put the credential on the service or the dialing-out box instead of in the agent, and they work from a chat or CI. The trade is that you’re trusting a hosted path and, for browser-ssh, a third party in your connection.
Client-bundled servers
The SSH clients that ship a server themselves, so the custodian and the UI come in one package:
- Conduit and XPipe — both bundle a local MCP server (Conduit over a socket/pipe, ~60 tools, Apache-2.0; XPipe a local HTTP endpoint, read-only by default). No cloud endpoint, nothing leaves the machine.
- Termalin — a bundled local server (22 tools) and a hosted endpoint (
https://termal.in/mcp, 16 tools, OAuth sign-in for claude.ai/ChatGPT/Claude Code/Codex/Cursor). The MCP server is a key custodian — it signs on the agent’s behalf, so no key is handed over — reaches servers keylessly through an outbound Connector, applies a per-connection policy (full, allowlist or read-only), and writes an audit log.
The comparison
| Server | Family | Key custody | Policy / approvals | Audit | Hosted | License |
|---|---|---|---|---|---|---|
| tufantunc/ssh-mcp | Standalone | Key where it runs | v2: classes + RBAC + approvals | Redacted log | Runs anywhere headless | MIT |
| mcp-ssh (Aionda) | Standalone | Key / ~/.ssh/config | Basic | Logs | Headless | OSS |
| the-nine-nation/remote-ssh-mcp | Standalone | Local OpenSSH | Basic | Logs | Headless | OSS |
| claude-ssh-mcp | Standalone | Password in chat | — | — | Headless | OSS |
| browser-ssh | Hosted | On the service | Scoped exec | Audited | Yes (URL) | — |
| sshrew | Hosted | On the dialing-out box | Allowlisted commands | — | Yes (cloudflared) | OSS |
| Conduit | Client | In its AES-256 vault | None we could find | MCP calls logged | No (local) | Apache-2.0 |
| XPipe | Client | Client-held, local | Read-only until enabled | — | No (local) | Open-core |
| Termalin | Client | Custodian signs; key never handed over | Per-connection (full / allowlist / read-only) | Watch grid + marked recordings + log | Yes (OAuth + API key) | Source-available in parts |
When each fits
- You want one small, auditable moving part and you run headless anyway → tufantunc/ssh-mcp v2, with RBAC and approvals turned on. It’s the standalone server that takes policy seriously.
- You want the lightest native
sshwrapper → mcp-ssh or the-nine-nation, accepting that the key sits with the server and auditing is log-only. - The agent lives in a chat or CI and you don’t run a desktop → a hosted connector: browser-ssh (fully managed) or sshrew (self-hosted via cloudflared).
- You also want a human to watch live, a per-host policy enforced before a command runs, and the key never in the agent at all → a client-bundled custodian. Conduit and XPipe cover the local case; Termalin adds the hosted, keyless endpoint on top.
There’s no single winner — a hardened standalone server and a custodian client are solving the same problem from opposite ends. The question to settle first is the one from what an MCP server is: who holds the credential? Everything in the table above flows from that answer. For the client-only view, see the buying guide.
Termalin is a cross-platform SSH client whose built-in MCP server is a key custodian with per-connection policy, a live watch grid and an agent-tagged audit log — download it or read the security model.