Name: MCP SSH SRE
Author: jeprecated

LABSCO SUMMARY

Diagnostics without handing over a shell.

The design point is the restriction: predefined commands mean the agent can read smartctl output and container logs but cannot run anything you did not build in. That covers exactly the questions platform APIs cannot answer — disk health, real load averages, log correlation — and it means a compromised conversation still cannot touch the box.

What it is

An MCP server that runs predefined diagnostic commands on a server over SSH and passes only the results to the model. The credentials and the shell stay on the server side; the agent gets findings, not a prompt.

What you get

12 tool modules with 79+ actions, loaded according to the platform the server auto-detects at startup — 10 core modules on generic Linux, 12 on Unraid
Docker — container logs, stats, environment, ports and network topology
Storage and array — parity checks, SMART data, temperatures and mover logs on Unraid
System and logs — processes, disk I/O, network connections, and search across container and system logs
VMs and security — list and inspect VMs with VNC details and libvirt logs; port scanning, login monitoring and permission audits
Health diagnostics that aggregate status with automatic issue detection
Read-only by design, so there is no path to an accidental change

Requirements

A reachable host over SSH and a key. The quickest path is the published image: docker run ghcr.io/jeprecated/mcp-ssh-sre:latest with SSH_HOST, SSH_USERNAME and SSH_KEY_PATH set and the key mounted read-only, exposing port 3000; then point your client at http://your-server:3000/mcp. Stdio is available too. Unraid and generic Linux are fully supported; TrueNAS and Proxmox are untested, though the core tools should work. Package version 2.0.2. ISC.

Setup effort

One command — docker run -d -p 3000:3000 -e SSH_HOST=server.local -e SSH_USERNAME=mcp-readonly -e SSH_KEY_PATH=/keys/id_ed25519 -v ~/.ssh/id_ed25519_mcp:/keys/id_ed25519:ro ghcr.io/jeprecated/mcp-ssh-sre:latest

See installation options

USE CASES

01

Working out why a container keeps restarting

Pull its logs, inspect its configuration and check resource use, then correlate against the system log.

02

Checking whether a drive is about to fail

Read SMART data and temperatures across the array and get the aggregated health verdict.

03

Finding what is eating the box

Look at processes, disk I/O and network connections together rather than one SSH session at a time.

04

Auditing exposure after a change

Scan open ports, review recent logins and check permissions, all read-only.

INSTALLATION

Connect your client

Add the block to your client, or run the command directly.

Server setup

Configuration file

JSON

{
  "mcpServers": {
    "ssh-sre": {
      "url": "http://<YOUR_SERVER>:3000/mcp"
    }
  }
}

docker

TERMINAL

docker run -d \
  -p 3000:3000 \
  -e SSH_HOST=server.local \
  -e SSH_USERNAME=mcp-readonly \
  -e SSH_KEY_PATH=/keys/id_ed25519 \
  -v ~/.ssh/id_ed25519_mcp:/keys/id_ed25519:ro \
  ghcr.io/jeprecated/mcp-ssh-sre:latest

MCP SSH SRE