MCP, MCP server
io.github.bvisible/mcp-ssh-manager
A Model Context Protocol (MCP) server that enables Claude Code and OpenAI Codex to manage multiple SSH connections.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
SECRETS_PATH_CREDENTIAL
Why this grade
- SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
CLAUDE.md, line 183
SSH_SERVER_[NAME]_KEYPATH=~/.ssh/key # For SSH key auth
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
debug/test-e2e-policy.js, line 103
fs.unlinkSync(AUDIT_PATH);
mcp-ssh-manager-setup.md, line 363
subprocess.run([sys.executable, '-m', 'pip', 'install', 'paramiko', 'python-dotenv', 'colorama', 'tabulate'])
mcp-ssh-manager-setup.md, line 1384
result = subprocess.run(['npm', 'install'], cwd=self.script_dir)
Show more
mcp-ssh-manager-setup.md, line 1391
subprocess.run([sys.executable, '-m', 'pip', 'install', '-r',
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
src/tunnel-manager.js, line 224
const localSocket = net.connect(localPort, localHost, () => {
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
CLAUDE.md, line 50
ssh-manager codex convert to-toml # Convert .env to TOML
CLAUDE.md, line 51
ssh-manager codex convert to-env # Convert TOML to .env
CLAUDE.md, line 183
SSH_SERVER_[NAME]_KEYPATH=~/.ssh/key # For SSH key auth
Show more
CLAUDE.md, line 201
key_path = "~/.ssh/key" # For SSH key auth
cli/build.sh, line 111
if [ ! -f "$HOME/mcp/mcp-ssh-manager/.env" ] && [ ! -f "$HOME/.ssh-manager/.env" ]; then
cli/build.sh, line 112
print_info "No .env file found. You'll need to configure servers after installation."
cli/demo.sh, line 61
echo " • All configurations are saved in .env file"
cli/install.sh, line 99
echo " .env # Server definitions"
debug/test-e2e-policy.js, line 59
const PASSWORD = process.env.SSH_E2E_PASSWORD;
debug/test-e2e-policy.js, line 60
const KEYPATH = process.env.SSH_E2E_KEYPATH;
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 161138373f4e. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 161138373f4e9779882eafef625f4ec03d6aff2c
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.