SSH LICCO MCP Server
PYPI · SSH-LICCO
SSH Model Context Protocol Server - Enable SSH functionality for AI models
Available components
Last scanned (16 hours ago)
Scores higher than 56% of PyPI servers
Category Cloud Infrastructure
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security50
- Malware scan not yet available for this package.Unverified
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs setuptools.build_meta at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
- 1 of 38 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency23
- Repository check failed: the declared repository URL redirects; it must resolve directly. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 9 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability60
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 2308 tokens (~256/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management70
- Stability observed for 21 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "ssh_execute" implies "execute" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 −14
- Malware scan: pass → unverified ▼ security
- 3 Nov 26 +15
- Malware scan: unverified → pass ▲ security
- 2 Nov 26 −14
- Malware scan: pass → unverified ▼ security
- 1 Nov 26 +15
- Malware scan: unverified → pass ▲ security
- 31 Oct 26 −14
- Malware scan: pass → unverified ▼ security
- 29 Oct 26 +16
- Malware scan: unverified → pass ▲ security
- 28 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- 26 Oct 26 +16
- Malware scan: unverified → pass ▲ security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Analysed pypi/ssh-licco@2.7.3
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
| Reason | No attestation published |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | setuptools.build_meta |
Background: Why install scripts are a supply-chain risk →
Dependencies 38 packages
| Packages resolved | 38 |
|---|---|
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
ssh_connect ~269
Establish an SSH connection to a remote server. If no parameters are provided, auto-connects using environment variables or saved config. Supports password, private key, and agent authentication. Optionally save the config and/or execute a command after connecting.
| Name | Type | Req | Description |
|---|---|---|---|
| accept_new_host_key | boolean | – | Auto-accept new host keys. |
| auth_method | string | – | Authentication method. |
| command | string | – | Optional command to execute immediately after connecting. |
| host | string | – | SSH server hostname or IP. If omitted, auto-reads from env vars or saved config. |
| name | string | – | Use a pre-configured host from hosts.json by name. |
| passphrase | string | – | Passphrase for encrypted private key. |
| password | string | – | SSH password for password-based auth. |
| port | integer | – | SSH port |
| private_key_path | string | – | Path to private key file for key-based auth. |
| save_config | boolean | – | Save connection settings to local config file for future use. |
| sudo_password | string | – | Sudo password (optional). When set, ssh_execute with use_sudo=true will auto-wrap commands with sudo -S, avoiding plaintext password in process list. |
| username | string | – | SSH username. If omitted, auto-reads from env vars. |
No output schema declared.
No examples provided.
ssh_disconnect ~50
Close an active SSH session. If no session_id is provided, lists all currently active sessions with connection details.
| Name | Type | Req | Description |
|---|---|---|---|
| session_id | string | – | Session ID to disconnect. If omitted, lists all active sessions. |
No output schema declared.
No examples provided.
ssh_docker ~255
Manage Docker on the remote server. Supports ps (list containers), images (list images), build (build an image in background), and logs (view container logs).
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Docker action: ps=list containers, images=list images, build=build an image, logs=view container logs. |
| container_name | string | – | Container name or ID. Required for logs. |
| context | string | – | Build context directory for build. |
| dockerfile_path | string | – | Path to Dockerfile for build. |
| host | string | – | SSH server hostname or IP. Alternative to session_id/name, can override hosts.json entry. |
| image_name | string | – | Docker image name. Required for build, optional filter for images. |
| name | string | – | Use a pre-configured host from hosts.json by name. Alternative to session_id. |
| password | string | – | SSH password (used with host). |
| port | integer | – | SSH port (used with host). |
| session_id | string | yes | Active SSH session ID. If omitted, connects via name/host/env vars. |
| tail | integer | – | Number of log lines to retrieve. |
| username | string | – | SSH username (used with host). |
No output schema declared.
No examples provided.
ssh_execute ~459
Execute a command on a remote server. If session_id is omitted, auto-connects using environment variables. Supports background execution for long-running tasks (auto-detected or manual). Use session_type='screen' or 'tmux' for persistent sessions that survive SSH disconnect.
| Name | Type | Req | Description |
|---|---|---|---|
| background | boolean | – | Run in background for long-running tasks. Auto-detected if not specified. |
| backup_before_delete | boolean | – | For recursive deletion commands (rm -r/rf), explicitly choose whether to backup targets before deleting. Set true to backup to /tmp/ssh_mcp_backup_<timestamp>/ then delete; set false to delete direct… |
| command | string | yes | Shell command to execute on the remote server (required). |
| confirm_dangerous | boolean | – | Bypass security validation for known-dangerous commands (e.g. rm -rf /path). Use with caution — only for operations you explicitly intend to perform. |
| host | string | – | SSH server hostname or IP. Alternative to session_id/name, can override hosts.json entry. |
| log_file | string | – | Log file path for background task output. |
| name | string | – | Use a pre-configured host from hosts.json by name. Alternative to session_id. |
| password | string | – | SSH password (used with host). |
| port | integer | – | SSH port (used with host). |
| session_id | string | – | Session ID from ssh_connect. If omitted, connects via name/host/env vars. |
| session_type | string | – | Background session type: nohup (default), screen, or tmux (persistent). |
| timeout | integer | – | Command timeout in seconds. Default 120s. For long tasks (docker pull, pg_basebackup), set higher or use background=true. |
| use_sudo | boolean | – | Wrap command with sudo -S using sudo_password from ssh_connect. Password is passed via stdin, not visible in process list. |
| username | string | – | SSH username (used with host). |
| wait | boolean | – | Wait for background task to complete. |
| wait_timeout | integer | – | Max wait time in seconds when wait=True. |
| workdir | string | – | Working directory for background tasks. |
No output schema declared.
No examples provided.
ssh_file_transfer ~396
Transfer and manage files between local and remote server via SFTP. Supports upload, download, list, write (write content directly to remote file), append, delete, mkdir, stat, and remote_copy (server-to-server direct transfer via scp/rsync, avoiding local relay).
| Name | Type | Req | Description |
|---|---|---|---|
| content | string | – | Content to write/append to remote file. Required for write/append. |
| direction | string | yes | Action: upload, download, list, write (content->remote file), append, delete, mkdir, stat, remote_copy (server-to-server direct transfer). |
| host | string | – | SSH server hostname or IP. Alternative to session_id/name, can override hosts.json entry. |
| local_path | string | – | Local file path. Required for upload/download. |
| name | string | – | Use a pre-configured host from hosts.json by name. Alternative to session_id. |
| password | string | – | SSH password (used with host). |
| port | integer | – | SSH port (used with host). |
| remote_path | string | – | Remote file/directory path. Required for all directions. For remote_copy, this is the source path on the connected server. |
| session_id | string | yes | Active SSH session ID. If omitted, connects via name/host/env vars. |
| target_host | string | – | remote_copy: Target server hostname/IP. |
| target_password | string | – | remote_copy: Target server password (uses sshpass). If omitted, assumes key-based auth is configured. |
| target_path | string | – | remote_copy: Destination path on target server. |
| target_port | integer | – | remote_copy: Target SSH port. |
| target_user | string | – | remote_copy: Target SSH username. |
| use_rsync | boolean | – | remote_copy: Use rsync instead of scp (better for large directories, supports resume). |
| username | string | – | SSH username (used with host). |
No output schema declared.
No examples provided.
ssh_generate_key ~88
Generate a new SSH key pair (RSA or Ed25519) for secure key-based authentication. Optionally save to a file path.
| Name | Type | Req | Description |
|---|---|---|---|
| comment | string | – | Optional comment to identify the key. |
| key_size | integer | – | Key size for RSA. |
| key_type | string | – | Key algorithm type. |
| save_path | string | – | Optional path to save the generated key files. |
No output schema declared.
No examples provided.
ssh_host ~141
Manage SSH server configurations in hosts.json. Use action=list to view all hosts, action=add to register a new server, action=remove to delete a server.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action: list all hosts, add a new host, or remove a host. |
| host | string | – | Server hostname or IP. Required for add. |
| name | string | – | Friendly name for the server. Required for add and remove. |
| password | string | – | SSH password (optional for key auth). |
| port | integer | – | SSH port number. |
| timeout | integer | – | Connection timeout in seconds. |
| username | string | – | SSH login username. |
No output schema declared.
No examples provided.
ssh_process ~344
Manage background processes and SSH tunnels on the remote server. Actions: start (launch a detached background process, returns PID), stop (stop a process by PID), status (check if a PID is running), list (list tracked background tasks), tunnel_open (local port forward to remote host:port), tunnel_close (close a tunnel), tunnel_list (list active tunnels).
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Process/tunnel action. |
| command | string | – | Command to run (start). |
| host | string | – | SSH server hostname or IP. Alternative to session_id/name, can override hosts.json entry. |
| local_port | integer | – | Local listen port (tunnel_open). |
| log_file | string | – | Log file path (start). Default /tmp/bg_<taskid>.log |
| name | string | – | Use a pre-configured host from hosts.json by name. Alternative to session_id. |
| password | string | – | SSH password (used with host). |
| pid | string | – | Process ID (stop/status). |
| port | integer | – | SSH port (used with host). |
| remote_host | string | – | Remote target host (tunnel_open). |
| remote_port | integer | – | Remote target port (tunnel_open). |
| session_id | string | yes | Active SSH session ID. If omitted, connects via name/host/env vars. |
| signal | string | – | Signal to send on stop (TERM, KILL, INT, etc.). |
| task_id | string | – | Task ID (stop/status, alternative to pid). |
| username | string | – | SSH username (used with host). |
| workdir | string | – | Working directory (start). |
No output schema declared.
No examples provided.
ssh_session ~306
Manage persistent screen/tmux sessions on the remote server for long-running interactive tasks (deploy, build, test, REPL). Sessions survive SSH disconnect. Actions: create (new detached session running a command), send (send keys/command to a session), capture (read current screen), list (list sessions), kill (kill a session).
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | create=new detached session, send=send keys/command to a session, capture=read current screen content, list=list sessions, kill=kill a session. |
| command | string | – | Command to run initially (create) or to send (send). |
| host | string | – | SSH server hostname or IP. Alternative to session_id/host_name, can override hosts.json entry. |
| host_name | string | – | Use a pre-configured host from hosts.json by name. Alternative to session_id. |
| lines | integer | – | Number of lines to capture (tmux capture-pane -S). |
| name | string | – | Session name. Required for create/send/capture/kill. Only letters, digits, _, ., - allowed. |
| password | string | – | SSH password (used with host). |
| port | integer | – | SSH port (used with host). |
| session_id | string | yes | Active SSH session ID. If omitted, connects via name/host/env vars. |
| session_type | string | – | Use screen or tmux backend. |
| username | string | – | SSH username (used with host). |
No output schema declared.
No examples provided.
How do I install the SSH LICCO MCP Server server?
SSH LICCO MCP Server runs locally as a PyPI package, launched with uvx ssh-licco. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · ssh-licco
claude mcp add echoqili-ssh-licco -- uvx ssh-licco
What is the SSH LICCO MCP Server server?
SSH LICCO MCP Server is listed in the public MCP registry as io.github.Echoqili/ssh-licco. SSH Model Context Protocol Server - Enable SSH functionality for AI models. This page covers its PyPI package (ssh-licco).
Is the SSH LICCO MCP Server server safe to use?
SSH LICCO MCP Server scores 57 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 4 November 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the SSH LICCO MCP Server server expose?
SSH LICCO MCP Server exposes 9 tools: ssh_connect, ssh_execute, ssh_disconnect, ssh_file_transfer, ssh_host, and 4 more. Their descriptions and schemas cost roughly 2,308 tokens of context every time the server is loaded.
Is the SSH LICCO MCP Server server still maintained?
SSH LICCO MCP Server is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the SSH LICCO MCP Server server under?
SSH LICCO MCP Server declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.