An SSH MCP server exposes SSH-related tools to AI clients that speak the Model Context Protocol. The risky pattern is a second credential file plus unsupervised run_command. The safer pattern is a loopback bridge over an encrypted vault you already unlock, with an approve dialog on every command.
What is an SSH MCP server?
It is a small tool surface, typically listing allowed hosts and running a shell command, reachable by MCP clients such as Cursor, Claude Code, VS Code, or Copilot. iLead's bridge binds to 127.0.0.1, requires a Bearer access key, and stops when the vault locks. It is not a public MCP URL and not a hosted bastion. Setup details: iLead MCP guide.
How can Cursor or Claude Code use SSH safely?
Enable MCP in the desktop app, allowlist specific hosts, paste the client config, then ask the agent to call list_hosts and run_command. Each run shows the exact host and command; Deny is the default. Multi-hop bastions configured on the host still apply internally, agents never manage jump credentials.
Do MCP tools expose SSH private keys?
They must not. In iLead, list_hosts returns id, name, address, port, and user only. Credentials resolve inside the vault for the approved session. Keys and passwords are never MCP tool inputs or outputs. If a third-party SSH MCP package asks you to put key paths in a JSON file beside the agent, treat that as a different threat model.
Is a local MCP bridge safer than pasting credentials into chat?
Yes, when approval and loopback are real. Pasting a password or key into a chat log creates durable copies in model providers and local history. A vault-backed bridge keeps secrets out of the prompt and forces a human click for blast-radius control. SSH itself remains the RFC 4251 transport, MCP only orchestrates who may ask for a one-shot command.
Numbers for the current iLead MCP surface
- 2 tools:
list_hosts,run_command - Loopback only on
127.0.0.1 - Default deny on every command approval dialog
- Audit log source tag:
mcp
Agents may ask. You still Approve. Credentials never ride along in the MCP payload.
Prefer a product walkthrough? See the feature list, the client comparison, or download iLead.