sandbanks/agentic_ssh
Project Overview
agentic_ssh
Rust-based MCP server that gives AI agents pooled, background-capable SSH access to configured remote hosts.
True Intent (AI Assessment)
A Rust MCP server that lets AI agents execute SSH commands against configured hosts with connection pooling, background job support, and token-efficient output handling.
README Accuracy
Notes
Source code matches the README's claims: russh-based connection pool, session log files, keepalives, multi-agent install support, and the documented MCP tool set are all present. The `trust` command and gitleaks configuration suggest security-aware development. No hidden data exfiltration or suspicious network calls observed in the sampled code.
agentic_ssh is a Model Context Protocol (MCP) server written in Rust that exposes SSH operations as structured tools callable by AI coding agents like Claude Code, Cursor, Zed, Gemini, Copilot, and roughly a dozen others. Rather than letting an agent shell out to raw `ssh` commands (which tends to blow up context windows and mangle shell quoting), it wraps SSH access behind a JSON-RPC tool interface with a persistent connection pool built on the pure-Rust `russh` library.
The problem it addresses is practical friction in agent-driven remote administration: long-running remote builds swallow terminal output, network overlays silently drop idle SSH sessions, compiler output floods LLM context, and agents struggle to correctly escape nested shell arguments. agentic_ssh answers each of these with background job detachment (writing to per-session log files under `~/.agentic_ssh/sessions/`), 30-second keepalives, quiet-mode progress tickers, and structured argument templates.
The user is a developer who already manages remote hosts through `~/.ssh/config` and wants their AI agent to run commands on those hosts safely. Installation is via Homebrew, `cargo install`, or `cargo binstall`, followed by `agentic_ssh install` which auto-detects installed agents and registers the MCP server in each one's config file. Tools can also be invoked directly from the CLI via `agentic_ssh json <tool>` for scripting.
Internally, `main.rs` uses clap for a subcommand CLI (`serve`, `install`, `uninstall`, `doctor`, `tui`, `watch`, `json`, `trust`). The `mcp_server` module speaks JSON-RPC 2.0 over stdin/stdout, dispatching to tool implementations in `mcp_server/tools.rs`. Hosts are discovered by parsing `~/.ssh/config` (including `Include` directives) in `ssh_config.rs`. Connections are reused via `ssh_pool.rs` with an idle timeout. Each supported agent has its own module under `src/agents/` implementing an `AgentIntegration` trait covering install, uninstall, and healthcheck. Built-in tools include `run_command`, `list_hosts`, `get_system_stats`, `list_ports`, `tail_log`, `check_docker_status`, `git_pull`, `grep_syslog`, and more.
Notable patterns: a `trust` subcommand cryptographically signs project-local config files (sha2 dependency), indicating a security model where local `.agentic_ssh.toml` files must be explicitly trusted before use. mimalloc is set as the global allocator. The code is well-organized with a dedicated errors module, doctor diagnostics, and ratatui-based TUI. Nothing observed looks malicious - it is what it claims to be.
| Languages | Rust |
| Runtime | Native binary (Rust 1.96+, edition 2024) |
| Framework | Tokio async runtime; MCP (Model Context Protocol) over JSON-RPC |
| Database | None detected |
| Package Manager | Cargo |
| Key Dependencies | tokio, russh, ssh2-config-rs, clap, serde/serde_json, ratatui, crossterm, mimalloc, sha2, regex |
| Build Tool | Cargo |
| Test Framework | Rust built-in test harness with tempfile |